Download the free checklist
For Level 2, use the free browser-based Level 2 self-assessment checklist.
Level 1 checklist (15 requirements)
| CMMC ID | Requirement | FAR item | NIST SP 800-171 mapping |
|---|---|---|---|
| AC.L1-b.1.i | Authorized Access Control | 52.204-21(b)(1)(i) | 3.1.1 |
| AC.L1-b.1.ii | Access Enforcement | 52.204-21(b)(1)(ii) | 3.1.2 |
| AC.L1-b.1.iii | External Connections | 52.204-21(b)(1)(iii) | 3.1.20 |
| AC.L1-b.1.iv | Control Publicly Posted Information | 52.204-21(b)(1)(iv) | 3.1.22 |
| IA.L1-b.1.v | Identification | 52.204-21(b)(1)(v) | 3.5.1 |
| IA.L1-b.1.vi | Authentication | 52.204-21(b)(1)(vi) | 3.5.2 |
| MP.L1-b.1.vii | Media Sanitization | 52.204-21(b)(1)(vii) | 3.8.3 |
| PE.L1-b.1.viii | Limit Physical Access | 52.204-21(b)(1)(viii) | 3.10.1 |
| PE.L1-b.1.ix | Visitor Escort, Physical Access Logs & Access Devices | 52.204-21(b)(1)(ix) | 3.10.3, 3.10.4, 3.10.5 |
| SC.L1-b.1.x | Boundary Protection | 52.204-21(b)(1)(x) | 3.13.1 |
| SC.L1-b.1.xi | Subnetwork Separation | 52.204-21(b)(1)(xi) | 3.13.5 |
| SI.L1-b.1.xii | Flaw Remediation | 52.204-21(b)(1)(xii) | 3.14.1 |
| SI.L1-b.1.xiii | Malicious Code Protection | 52.204-21(b)(1)(xiii) | 3.14.2 |
| SI.L1-b.1.xiv | Malicious Code Updates | 52.204-21(b)(1)(xiv) | 3.14.4 |
| SI.L1-b.1.xv | System & File Scanning | 52.204-21(b)(1)(xv) | 3.14.5 |
Level 1 is an annual self-assessment with an annual affirmation in SPRS. No POA&M is allowed at Level 1: all 15 requirements must be met when you affirm.
Level 2 checklist (step by step)
- Define your CUI scope and asset categories. Identify where CUI is processed, stored and transmitted, and categorize every asset. See CUI boundary.
- Write the System Security Plan. See the CMMC SSP template.
- Assess all 110 requirements and their 320 assessment objectives. Every objective must be met for a requirement to be met. See CMMC Level 2 requirements.
- Calculate your SPRS score. See how to calculate your SPRS score.
- Use a POA&M only for eligible items. The score must be at least 88 (0.8 × 110). Only 1-point requirements may be on a POA&M, plus 3.13.11 when encryption is used but not FIPS-validated. 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 and 3.12.4 can never be on a POA&M. Items must be closed out within 180 days of the Conditional CMMC Status Date. See the CMMC POA&M template.
- Affirm. A senior affirming official affirms compliance in SPRS, and again annually.
Phase 2 was suspended on 13 July 2026; only Level 1 (Self) and Level 2 (Self) are currently designated. See CMMC status for what still applies.