How many domains does CMMC Level 2 have?

Fourteen. CMMC Level 2 adopts the 110 requirements of NIST SP 800-171 Rev. 2, which are organized into 14 families (domains) from Access Control through System & Information Integrity. The retired CMMC five-level model is a different axis — levels measure maturity, domains group the requirements.

What evidence does a CMMC assessor accept?

Artifacts that prove the practice is operating now: signed policies, procedures with named owners, configuration exports, log samples within their freshness window, time-stamped screenshots, and interview corroboration. A policy alone is not enough — assessors test, observe, and interview against the NIST SP 800-171A assessment objectives.

Which domains do contractors struggle with most?

In practice: Identification & Authentication (MFA coverage), Audit & Accountability (log retention and review), Configuration Management (documented baselines and change control), and System & Communications Protection (FIPS-validated encryption). These domains require operational evidence that cannot be written the week before an assessment.

Can I put missing evidence on a POA&M?

Only if the underlying requirement is POA&M-eligible under 32 CFR 170.21: your score must be at least 88, only 1-point items may be listed (plus 3.13.11 when encryption is used but not FIPS-validated), and several requirements — including 3.12.4 (SSP) — are never eligible. Items must close within 180 days of the Conditional CMMC Status Date.

Does this library give me a verified readiness score?

No. The checklists and the linked self-assessment are self-reported preparation tools. A verified outcome comes from the assessment process defined in 32 CFR Part 170 — a Level 2 self-assessment affirmed in SPRS, or a C3PAO assessment for contracts that require it. Athena Consulting Group is not a C3PAO and does not grant certification.

Evidence Library

CMMC Evidence Library: Checklists and Templates for All 14 Domains

CMMC Level 2 organizes its 110 requirements into 14 domains (the NIST SP 800-171 Rev. 2 families) — not five; the retired five-level model is sometimes confused with domains. For each domain below: what evidence to collect, how many requirements it contains, and links to the detailed per-control evidence guides. Start with the free self-assessment to find your gaps, then use this library to gather the evidence that closes them.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 21, 2026

Take the free self-assessment All 110 requirements by domain

How to use this library

An assessor grades assessment objectives, not intentions. For every requirement you marked “met” in the self-assessment, you need artifacts that prove the practice is operating today — policies, configuration exports, logs, records, and screenshots. For every gap, you need a POA&M entry (where eligible) with an owner and a closure date. The checklists below tell you what to collect per domain; the linked guides go deeper on individual controls.

Freshness matters: configuration evidence within 90 days, log samples covering the last 30–90 days, policies reviewed within 12 months. A screenshot from last year is a historical artifact, not evidence.

AC — Access Control (22 requirements)

Access control policy and account management procedure, with named owners
User account lists from the identity provider, plus recent provisioning and deprovisioning tickets
Least-privilege and separation-of-duties configuration exports (role assignments, admin group membership)
Session lock, wireless access, and remote access configuration evidence

Detailed evidence guides: 3.1.1 Access Control · 3.1.2 Least Privilege · 3.1.3 CUI Flow Control · 3.1.4 Separation of Duties · 3.1.17 Wireless Protection · 3.1.18 Mobile Device Control · 3.1.20 External Systems · 3.1.21 Portable Storage · 3.1.22 Publicly Accessible Content

AT — Awareness & Training (3 requirements)

Security awareness and training policy with assigned roles
Role-based training content matched to actual job duties
Training completion records with dates for all users in scope
Insider-threat awareness material and refresh cycle evidence

Detailed evidence guides: 3.2.2 Role-Based Training

AU — Audit & Accountability (9 requirements)

Audit and accountability policy defining which events are logged
SIEM or log-management configuration showing required event capture
Log samples covering the retention window, with review records
Time-synchronization configuration across in-scope systems

Detailed evidence guides: 3.3.1 Audit Logging

CA — Security Assessment (4 requirements)

System Security Plan describing the boundary and how each requirement is implemented
Most recent self-assessment report against the 110 requirements
POA&M for every requirement not fully implemented, with owners and milestones
Continuous monitoring plan and its recent outputs

Detailed evidence guides: 3.12.1 Security Assessment · 3.12.2 POA&M · 3.12.4 System Security Plan

CM — Configuration Management (9 requirements)

Baseline configuration documents (hardening standard, golden image, or IaC manifest)
Change control records showing approval before implementation
Security impact analyses for recent changes
Configuration enforcement evidence (GPO, MDM, or drift-detection reports)

Detailed evidence guides: 3.4.1 Baseline Configuration · 3.4.2 Config Enforcement · 3.4.4 Security Impact Analysis

IA — Identification & Authentication (11 requirements)

User identification and authentication policy
MFA enforcement evidence: admin console export plus a recent authentication log sample
Password and authenticator configuration matching the defined policy
Replay-resistant authentication settings for network access

Detailed evidence guides: 3.5.1 Identification · 3.5.2 Authentication · 3.5.3 Multifactor Authentication · 3.5.3 MFA in GCC High · 3.5.4 Replay-Resistant Authentication

IR — Incident Response (3 requirements)

Incident response plan with roles, phases, and escalation paths
Incident tickets or reports showing the plan in use
Tabletop or functional test records with lessons learned
Documented procedure for reporting incidents to DoD (DIBNet) where required

Detailed evidence guides: 3.6.1 Incident Handling · 3.6.2 Incident Reporting

MA — Maintenance (6 requirements)

System maintenance policy and procedures
Maintenance logs for in-scope equipment
Media sanitization records before equipment leaves the controlled area
Authorization list for maintenance personnel and nonlocal session controls

Detailed evidence guides: 3.7.5 Nonlocal Maintenance

MP — Media Protection (9 requirements)

Media protection policy covering marking, handling, and transport of CUI media
Encryption evidence for removable and portable media containing CUI
Sanitization or destruction records following NIST SP 800-88 methods
Access logs or custody records for controlled media

Detailed evidence guides: 3.8.3 Media Sanitization · 3.8.7 Removable Media

PE — Physical Protection (6 requirements)

Physical access control policy for facilities housing in-scope systems
Facility access logs or badge-system reports
Visitor logs with escort procedure evidence
Physical protection of media and equipment (locked storage, server room controls)

Detailed evidence guides: 3.10.2 Facility Protection & Monitoring

PS — Personnel Security (2 requirements)

Personnel security policy covering screening and termination
Background screening completion evidence for in-scope personnel
Termination checklists showing same-day access revocation
Transfer and role-change access review records

Detailed evidence guides: 3.9.1 Personnel Screening · 3.9.2 Personnel Actions

RA — Risk Assessment (3 requirements)

Risk assessment policy defining scope and frequency
Most recent risk assessment report with identified risks
Vulnerability scan results for in-scope systems
Remediation tracking showing findings moved to closure

Detailed evidence guides: 3.11.2 Vulnerability Scanning

SC — System & Communications Protection (16 requirements)

Network architecture diagram showing the CUI boundary and trust zones
Firewall ruleset exports demonstrating deny-by-default and controlled flows
FIPS-validated encryption evidence for CUI in transit and at rest
Configuration evidence for DNS, VoIP, and split-tunneling restrictions

Detailed evidence guides: 3.13.1 Boundary Protection · 3.13.2 Security Architecture · 3.13.5 Subnetwork Separation · 3.13.8 Transmission Encryption · 3.13.11 FIPS Encryption

SI — System & Information Integrity (7 requirements)

Flaw remediation policy with patch SLAs by severity
Patch and vulnerability remediation records against those SLAs
Malware protection configuration and recent alert samples
Security alert monitoring evidence (advisories reviewed and acted on)

Detailed evidence guides: 3.14.1 Flaw Remediation · 3.14.2 Malicious Code Protection · 3.14.6 System Monitoring

Templates and worksheets

System Security Plan (SSP) template — The document every Level 2 assessment starts from — 3.12.4 is not POA&M-eligible.
POA&M template and eligibility rules — Which gaps may go on a POA&M under 32 CFR 170.21, and which may not.
Level 2 self-assessment checklist — All 110 requirements as a working checklist.
Level 1 self-assessment checklist — The 15 FAR 52.204-21(b)(1) requirements for FCI.
Evidence collection guide (320 objectives) — What assessors accept, by objective, evidence type, and freshness window.
Level 2 requirements CSV — all 110 requirements with SPRS point values and POA&M eligibility.
Level 1 requirements CSV — the 15 FAR 52.204-21(b)(1) requirements.