AthenaCMMC Level 2Self-assessment

Level 2 (Self) checklist

The CMMC Level 2 Checklist: All 110 Controls for a Level 2 (Self) Assessment

This CMMC self assessment checklist covers the 110 security requirements of NIST SP 800-171 Rev. 2. Use it for a NIST 800-171 self-assessment, graded objective by objective against NIST SP 800-171A. During the current suspension of the C3PAO phase-in, DoD requirements may designate only Level 1 (Self) or Level 2 (Self). You score yourself, post the result to SPRS, and a senior Affirming Official attests to it. Build to the standard a C3PAO would test anyway.

Status reflects the July 2026 Phase 2 suspension.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 17, 2026

Score all 110 controls — free Quick Score Compare 800-171 vs CMMC

The other free CMMC tools

SPRS score calculator

Score all 110 requirements with official weighted deductions.

320-objective evidence checklist

Every NIST SP 800-171A Rev. 2 objective with evidence planning.

CMMC scoping tool

Categorize assets and define your assessment boundary.

POA&M builder

Build a DoD-oriented POA&M with eligibility warnings.

C3PAO assessment prep

Day-one evidence list, mock intake, and readiness verdict.

What changed in 2026: why Level 2 (Self) is the path contractors face now

The short version: the third-party phase-in is on hold, and the security requirements are not.

The suspension. On July 13, 2026, the Department of War suspended the November 2026 Phase 2 transition. During the suspension, DoD requirements may designate only CMMC Level 1 (Self) or Level 2 (Self).
Existing contracts. DoD has directed contracting officers to remove Level 2 (C3PAO) and Level 3 (DIBCAC) requirements from active solicitations and, by modification, from existing contracts.
The NIST assessment clause. Under DoD's current class deviation, contracting officers use DFARS 252.240-7997 for NIST SP 800-171 DoD Assessment requirements. The CMMC levels themselves remain in DFARS 252.204-7021.
The underlying obligation has not moved. DFARS 252.204-7012 still requires NIST SP 800-171 (DoD currently enforces Revision 2). It also requires you to report cyber incidents to DoD via DIBNet within 72 hours of discovery.
No end date yet. As of mid-October 2026, DoD has not announced an end to the Phase 2 suspension. Treat everything on this page as current to the Last reviewed date, and check CMMC status for updates.

A self-assessment is not an easier test. To reach Final Level 2 (Self), every requirement must be MET under the CMMC Scoring Methodology. A requirement is MET only when every applicable NIST SP 800-171A objective is satisfied. DoD also reserves the right to run a DCMA DIBCAC assessment of your organization. If your self-score would not survive that review, it is not a real score.

Which self-assessment does your contract actually call for?

Contractors use the phrase "NIST 800-171 self assessment checklist" for two different obligations. The control work is identical. The paperwork is not.

	CMMC Level 2 (Self)	NIST SP 800-171 DoD Assessment (Basic)
Where it comes from	The CMMC requirement in your solicitation or contract (DFARS 252.204-7021), under 32 CFR 170.16	The NIST SP 800-171 DoD Assessment clause. Under the current class deviation that is DFARS 252.240-7997; older contracts may still carry 252.204-7019/-7020
What you assess	The 110 requirements of NIST SP 800-171 Rev. 2, against the NIST SP 800-171A objectives	The same 110 requirements
How you score	CMMC Scoring Methodology (32 CFR 170.24)	DoD Assessment Methodology
What goes into SPRS	CMMC level, CMMC Status Date, assessment scope, all CAGE codes in scope, overall score, and POA&M usage and status	The Basic Assessment summary score and related fields
Affirmation	Required: at completion, at POA&M closeout, and annually after a Final status	Not part of the Basic Assessment itself
How often	Every 3 years, with annual affirmations	Per the clause

The work is the same 110 requirements and the same objectives. If you build to the Level 2 (Self) standard, you cover both. Read the clause in your contract or solicitation before you submit anything. The clause decides which SPRS entry you owe.

How the self-assessment works

Under the July 2026 suspension of the C3PAO phase-in, Level 2 (Self) is the CMMC assessment new DoD requirements can designate. Check the clause in yours. The standard has not changed. Every one of the 110 requirements has to be MET against the NIST SP 800-171A objectives, so build and evidence each control to the standard a C3PAO would test.

The workflow, at a glance:

Scope. Identify the assets that process, store or transmit CUI, plus the Security Protection Assets that protect them (32 CFR 170.19(c)). Wrong scope = wrong score. Start with Scope Check and the CUI boundary guide.
Assess every objective. Work through each of the 110 requirements against NIST SP 800-171A, using the EXAMINE, INTERVIEW and TEST methods. Grading is all-or-nothing per requirement.
Score. Start at 110 and subtract the value of each NOT MET requirement under the CMMC Scoring Methodology (32 CFR 170.24).
POA&M. Only put on the POA&M what 32 CFR 170.21(a)(2) allows: the score ratio must be at least 0.8 (88 of 110), the items must be 1-point requirements (with the 3.13.11 non-FIPS exception), and none of the six excluded requirements can appear. Close it out within 180 days of the Conditional CMMC Status Date.
Submit to SPRS. Enter the CMMC level, CMMC Status Date, assessment scope, all CAGE codes in scope, the overall score, and POA&M usage and status.
Affirm. The Affirming Official attests in SPRS at completion, again after any POA&M closeout, and annually after a Final status. See the affirmation step below.

Score it before anyone signs it.

Run the free Quick Score against all 110 requirements and see where the deductions land.

Start the free Quick Score

The 14 domains — 110 controls total

Code	Domain	Controls	What it covers	Evidence guides
AC	Access Control	22	Least privilege, session control, remote access, external systems.	3.1.1 · 3.1.2 · 3.1.20
AT	Awareness & Training	3	Security awareness for users and privileged roles.	Control library
AU	Audit & Accountability	9	Logging, review, protection, and retention of audit records.	3.3.1
CM	Configuration Management	9	Baselines, change control, least functionality, USB/software allow-lists.	3.4.1 · 3.4.2
IA	Identification & Authentication	11	Unique IDs, MFA, password complexity, credential management.	3.5.1 · 3.5.2 · 3.5.3 · 3.5.3 government cloud
IR	Incident Response	3	IR plan, handling, reporting, and testing.	3.6.1 · 3.6.2
MA	Maintenance	6	Controlled maintenance, media sanitization, remote maintenance MFA.	Control library
MP	Media Protection	9	Marking, storage, transport, and sanitization of media and CUI.	3.8.3
PS	Personnel Security	2	Screening and termination/transfer procedures.	Control library
PE	Physical Protection	6	Facility access, visitor logs, alternate sites, monitoring.	Control library
RA	Risk Assessment	3	Risk assessments and vulnerability scanning cadence.	3.11.2
CA	Security Assessment	4	SSP, control assessment, POA&M, continuous monitoring.	3.12.1 · 3.12.2 · 3.12.4
SC	System & Communications Protection	16	Boundary protection, FIPS crypto, session termination, DNS.	3.13.1 · 3.13.2 · 3.13.5 · 3.13.8 · 3.13.11
SI	System & Information Integrity	7	Flaw remediation, malicious code protection, monitoring, alerts.	3.14.1 · 3.14.2 · 3.14.6
—	Total	110

How to self-score: the CMMC Scoring Methodology

You start at 110, the total number of Level 2 requirements. Each requirement carries a value of 1, 3 or 5 points, assigned by the CMMC Scoring Methodology in 32 CFR 170.24. Use the values in the rule. This page does not restate per-control values.

The rules that decide your number:

Objectives decide the requirement. If one or more applicable NIST SP 800-171A objectives are not satisfied, the requirement is NOT MET, and you lose its full value.
N/A counts as MET. An objective assessed as N/A is treated the same as MET. Write down why it does not apply. An assessor will ask.
Two requirements can earn partial credit: IA.L2-3.5.3 (multifactor authentication) and SC.L2-3.13.11 (FIPS-validated cryptography). The deductions depend on how far the control is implemented. Use the values in 32 CFR 170.24(c)(2)(i)(B)(4).
A POA&M is not a fix. A requirement that has not been implemented is NOT MET, whether or not it appears on a POA&M.
Scores can go negative. 32 CFR 170.24 says the subtraction "may result in a negative score." Adding up every deduction the rule lists gives a lowest possible Level 2 score of −203. That figure is derived; the rule itself states no floor.

Conditional vs Final status

Final Level 2 (Self). Every requirement is MET, which is the maximum score of 110 (32 CFR 170.16(a)(1); 170.24(c)(2)). You can reach it at the start or after you close out your POA&M.
Conditional Level 2 (Self). Your self-assessment produces a POA&M that meets every condition in 32 CFR 170.21(a)(2):
- the score divided by 110 is at least 0.8, which is 88 points;
- every requirement on the POA&M is worth 1 point. The one exception is SC.L2-3.13.11, which may be on the POA&M when encryption is used but is not FIPS-validated;
- none of these six requirements is on the POA&M: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5.
The 180-day clock. You must close out the POA&M within 180 days of the Conditional CMMC Status Date. If you don't, Conditional status expires, and for Level 2 (Self) standard contractual remedies apply.
Below that bar there is no CMMC status, and you cannot receive an award where the contract requires one.

For what to POA&M and how to write it, see the CMMC POA&M template and the POA&M generator. For the arithmetic with worked examples, see how to calculate your SPRS score.

The CMMC Level 2 checklist by family: what to check and the evidence to keep

Each family below gives three things:

the requirement list, using the NIST SP 800-171 Rev. 2 requirement numbers with short names abridged from the NIST statements;
what an assessor would EXAMINE, INTERVIEW and TEST;
the failure pattern we see most often.

Lineage runs Practice ID (e.g. AC.L2-3.1.1) → NIST SP 800-171 Rev. 2 requirement 3.1.1 → its NIST SP 800-171A objectives.

Access Control (AC): 22 requirements, 3.1.1–3.1.22

All 22 AC requirements

3.1.1 Limit system access to authorized users, processes and devices
3.1.2 Limit system access to the transactions and functions users are permitted to execute
3.1.3 Control the flow of CUI per approved authorizations
3.1.4 Separate the duties of individuals
3.1.5 Employ least privilege, including for security functions and privileged accounts
3.1.6 Use non-privileged accounts or roles for nonsecurity functions
3.1.7 Prevent non-privileged users from executing privileged functions; log such execution
3.1.8 Limit unsuccessful logon attempts
3.1.9 Provide privacy and security notices consistent with CUI rules
3.1.10 Use session lock with pattern-hiding displays after inactivity
3.1.11 Terminate user sessions automatically after a defined condition
3.1.12 Monitor and control remote access sessions
3.1.13 Use cryptographic mechanisms to protect remote access sessions
3.1.14 Route remote access via managed access control points
3.1.15 Authorize remote execution of privileged commands and remote access to security-relevant information
3.1.16 Authorize wireless access before allowing connections
3.1.17 Protect wireless access using authentication and encryption
3.1.18 Control connection of mobile devices
3.1.19 Encrypt CUI on mobile devices and mobile computing platforms
3.1.20 Verify and control/limit connections to and use of external systems
3.1.21 Limit use of portable storage devices on external systems
3.1.22 Control CUI posted or processed on publicly accessible systems

EXAMINE: the access control policy, an IdP user and role export, the privileged account list, the remote access configuration, and a CUI flow diagram.
INTERVIEW: the IT administrator, on joiner/mover/leaver handling.
TEST: log in as a standard user and try a privileged function.
Common failure: there is no list of authorized external systems for 3.1.20. That requirement cannot go on a POA&M, so the gap blocks Conditional status.
Evidence guides: 3.1.1 access control, 3.1.2 least privilege, 3.1.20 external connections.

Awareness & Training (AT): 3 requirements, 3.2.1–3.2.3

All 3 AT requirements

3.2.1 Make managers, administrators and users aware of security risks and applicable policies and procedures
3.2.2 Train personnel to carry out their security-related duties
3.2.3 Provide awareness training on recognizing and reporting insider threat indicators

EXAMINE: the training content, dated completion records, and the insider-threat module.
INTERVIEW: a randomly chosen user, about what they would report and to whom.
Common failure: generic training with no CUI handling or insider-threat content.
Evidence guides: control library.

Audit & Accountability (AU): 9 requirements, 3.3.1–3.3.9

All 9 AU requirements

3.3.1 Create and retain system audit logs and records
3.3.2 Ensure user actions can be uniquely traced to those users
3.3.3 Review and update logged events
3.3.4 Alert on an audit logging process failure
3.3.5 Correlate audit record review, analysis and reporting
3.3.6 Provide audit record reduction and report generation
3.3.7 Synchronize system clocks with an authoritative time source
3.3.8 Protect audit information and logging tools from unauthorized access, modification and deletion
3.3.9 Limit management of audit logging to a subset of privileged users

EXAMINE: the log source inventory, retention settings, review records, and the time-sync configuration.
TEST: generate an event and trace it all the way to the SIEM or log store.
Common failure: logs are collected but nobody reviews them, and there is no record that a review ever happened.
Evidence guides: 3.3.1 audit logging.

Configuration Management (CM): 9 requirements, 3.4.1–3.4.9

All 9 CM requirements

3.4.1 Establish and maintain baseline configurations and inventories
3.4.2 Establish and enforce security configuration settings
3.4.3 Track, review, approve or disapprove, and log changes
3.4.4 Analyze the security impact of changes before implementation
3.4.5 Define, document, approve and enforce access restrictions associated with changes
3.4.6 Employ least functionality: provide only essential capabilities
3.4.7 Restrict, disable or prevent nonessential programs, functions, ports, protocols and services
3.4.8 Apply deny-by-exception or deny-all, permit-by-exception policy for software
3.4.9 Control and monitor user-installed software

EXAMINE: the baseline configurations, change tickets, the software allow-list, and the list of disabled services.
TEST: compare one endpoint against its baseline.
Common failure: the baseline exists as a document, but nothing enforces it.
Evidence guides: 3.4.1 baseline configuration, 3.4.2 configuration enforcement.

Identification & Authentication (IA): 11 requirements, 3.5.1–3.5.11

All 11 IA requirements

3.5.1 Identify system users, processes acting on behalf of users, and devices
3.5.2 Authenticate users, processes or devices before allowing access
3.5.3 Use MFA for local and network access to privileged accounts and network access to non-privileged accounts
3.5.4 Employ replay-resistant authentication for network access
3.5.5 Prevent reuse of identifiers for a defined period
3.5.6 Disable identifiers after a defined period of inactivity
3.5.7 Enforce minimum password complexity and change of characters
3.5.8 Prohibit password reuse for a specified number of generations
3.5.9 Allow temporary passwords only with an immediate change to a permanent password
3.5.10 Store and transmit only cryptographically-protected passwords
3.5.11 Obscure feedback of authentication information

EXAMINE: the IdP MFA policy, a password policy export, and the conditional access rules.
TEST: try a network or privileged login without MFA.
Common failure: MFA is on cloud apps but not on local privileged access or network access. That earns partial credit at best.
Evidence guides: 3.5.1 identification, 3.5.2 authentication, 3.5.3 MFA, 3.5.3 MFA in a government cloud tenant.

Incident Response (IR): 3 requirements, 3.6.1–3.6.3

All 3 IR requirements

3.6.1 Establish an operational incident-handling capability
3.6.2 Track, document and report incidents to internal and external officials and authorities
3.6.3 Test the organizational incident response capability

EXAMINE: the IR plan, incident tickets, a tabletop after-action report, and the procedure for reporting to DoD via DIBNet within 72 hours under DFARS 252.204-7012.
INTERVIEW: the IR lead.
Common failure: the plan has never been tested, which fails 3.6.3.
Evidence guides: 3.6.1 incident handling, 3.6.2 incident reporting.

Maintenance (MA): 6 requirements, 3.7.1–3.7.6

All 6 MA requirements

3.7.1 Perform maintenance on organizational systems
3.7.2 Control the tools, techniques, mechanisms and personnel used for maintenance
3.7.3 Sanitize equipment removed for off-site maintenance of any CUI
3.7.4 Check diagnostic and test media for malicious code before use
3.7.5 Require MFA for nonlocal maintenance sessions over external connections, and terminate them when done
3.7.6 Supervise maintenance personnel without required access authorization

EXAMINE: maintenance logs, the MFA configuration for remote maintenance, and escort records for maintenance personnel.
Common failure: vendor remote sessions run with no MFA, and nobody terminates them afterwards.
Evidence guides: control library.

Media Protection (MP): 9 requirements, 3.8.1–3.8.9

All 9 MP requirements

3.8.1 Protect (physically control and securely store) system media containing CUI, paper and digital
3.8.2 Limit access to CUI on system media to authorized users
3.8.3 Sanitize or destroy media containing CUI before disposal or reuse
3.8.4 Mark media with CUI markings and distribution limitations
3.8.5 Control access to and maintain accountability for CUI media during transport
3.8.6 Use cryptography to protect CUI on digital media during transport
3.8.7 Control the use of removable media on system components
3.8.8 Prohibit portable storage devices with no identifiable owner
3.8.9 Protect the confidentiality of backup CUI at storage locations

EXAMINE: CUI marking samples, sanitization certificates, the removable-media policy or GPO, and the encrypted backup configuration.
Common failure: there are no sanitization records for drives that have been disposed of.
Evidence guides: 3.8.3 media sanitization; for marking, see the CUI marking guide.

Personnel Security (PS): 2 requirements, 3.9.1–3.9.2

Both PS requirements

3.9.1 Screen individuals before authorizing access to systems containing CUI
3.9.2 Protect systems containing CUI during and after personnel actions such as terminations and transfers

EXAMINE: screening records and a termination checklist with timestamps showing when access was revoked.
Common failure: accounts are still active after the person has left.
Evidence guides: control library.

Physical Protection (PE): 6 requirements, 3.10.1–3.10.6

All 6 PE requirements

3.10.1 Limit physical access to systems, equipment and operating environments to authorized individuals
3.10.2 Protect and monitor the physical facility and support infrastructure
3.10.3 Escort visitors and monitor visitor activity
3.10.4 Maintain audit logs of physical access
3.10.5 Control and manage physical access devices
3.10.6 Enforce safeguarding measures for CUI at alternate work sites

EXAMINE: visitor logs, a badge system export, the escort procedure, and the alternate work site policy.
Common failure: treating physical controls as "easy points" to POA&M later. 3.10.3, 3.10.4 and 3.10.5 cannot go on a POA&M.
Evidence guides: control library.

Risk Assessment (RA): 3 requirements, 3.11.1–3.11.3

All 3 RA requirements

3.11.1 Periodically assess risk to operations, assets and individuals
3.11.2 Scan for vulnerabilities periodically and when new vulnerabilities are identified
3.11.3 Remediate vulnerabilities in accordance with risk assessments

EXAMINE: the risk assessment, dated scan reports, and remediation tickets.
TEST: compare the scan scope against the asset inventory.
Common failure: scans miss assets that are in scope.
Evidence guides: 3.11.2 vulnerability scanning.

Security Assessment (CA): 4 requirements, 3.12.1–3.12.4

All 4 CA requirements

3.12.1 Periodically assess security controls for effectiveness
3.12.2 Develop and implement plans of action to correct deficiencies
3.12.3 Monitor security controls on an ongoing basis
3.12.4 Develop, document and periodically update system security plans

EXAMINE: the SSP, the self-assessment record, the POA&M, and continuous-monitoring evidence.
Common failure: no SSP. Because 3.12.4 cannot go on a POA&M, having no SSP means having no Conditional status.
Evidence guides: 3.12.1 security assessment, 3.12.2 POA&M, 3.12.4 SSP; see also SSP automation.

System & Communications Protection (SC): 16 requirements, 3.13.1–3.13.16

All 16 SC requirements

3.13.1 Monitor, control and protect communications at external and key internal boundaries
3.13.2 Employ architectural designs, development techniques and engineering principles that promote security
3.13.3 Separate user functionality from system management functionality
3.13.4 Prevent unauthorized and unintended information transfer via shared system resources
3.13.5 Implement subnetworks for publicly accessible components, separated from internal networks
3.13.6 Deny network traffic by default; allow by exception
3.13.7 Prevent split tunneling for remote devices
3.13.8 Use cryptography to prevent unauthorized disclosure of CUI in transmission
3.13.9 Terminate network connections at session end or after defined inactivity
3.13.10 Establish and manage cryptographic keys
3.13.11 Employ FIPS-validated cryptography to protect the confidentiality of CUI
3.13.12 Prohibit remote activation of collaborative computing devices; indicate use
3.13.13 Control and monitor the use of mobile code
3.13.14 Control and monitor the use of VoIP technologies
3.13.15 Protect the authenticity of communications sessions
3.13.16 Protect the confidentiality of CUI at rest

EXAMINE: the network diagram, firewall rules, FIPS 140 certificate numbers for the cryptographic modules in use, and the VLAN or segmentation configuration.
TEST: try a connection that should be denied.
Common failure: encryption is in place, but the module is not FIPS-validated (3.13.11).
Evidence guides: 3.13.1 boundary protection, 3.13.2 security architecture, 3.13.5 subnetwork separation, 3.13.8 transmission encryption, 3.13.11 FIPS encryption.

System & Information Integrity (SI): 7 requirements, 3.14.1–3.14.7

All 7 SI requirements

3.14.1 Identify, report and correct system flaws in a timely manner
3.14.2 Provide protection from malicious code at designated locations
3.14.3 Monitor security alerts and advisories and take action
3.14.4 Update malicious code protection when new releases are available
3.14.5 Perform periodic scans and real-time scans of files from external sources
3.14.6 Monitor systems, including inbound and outbound traffic, to detect attacks
3.14.7 Identify unauthorized use of organizational systems

EXAMINE: patch reports, an AV/EDR console export, alert subscriptions, and the monitoring configuration.
TEST: confirm EDR is active on a sample endpoint.
Common failure: patch SLAs are missed and there are no exception records.
Evidence guides: 3.14.1 flaw remediation, 3.14.2 malicious code, 3.14.6 monitoring.

Checklist structure — how to run it by domain

For each of the 14 domains, make the same four passes:

Read every requirement's objectives in NIST SP 800-171A. Those objectives, not the requirement summary, are what gets graded.
Ask "who does this, on what asset, and how do I know?" The answer is your evidence. Get it with EXAMINE, INTERVIEW and TEST. An assessor uses all three, so your self-assessment should too.
Mark each objective MET or NOT MET. If any objective is not met, the whole requirement is not met.
Capture the evidence artifact (policy, config export, log sample, screenshot) with the date and the person who produced it. Keep the artifacts for six years from the CMMC Status Date.

For family-by-family evidence examples, see the Athena CMMC control evidence library. It has evidence guides for 24 requirements across 10 families, and each is linked from its family in the checklist above.

Score all 110 controls — free Quick Score

Score each requirement against its objectives and see which ones drive your deductions.

All 110 controls
SPRS score projection
No signup required

Start the free Quick Score

The affirmation step: what the Affirming Official signs

Who signs. The Affirming Official is the senior-level representative of each organization seeking assessment (OSA). That person is responsible for the OSA's compliance with CMMC Program requirements and has the authority to affirm continuing compliance. A prime and each of its subcontractors are separate OSAs, and each affirms its own status.

What they sign.

The Affirming Official's name, title and contact information.
A statement that the OSA "has implemented and will maintain implementation of all applicable CMMC security requirements" for every information system in the CMMC Assessment Scope.

When.

At the completion of the Level 2 self-assessment.
After any POA&M closeout self-assessment.
Annually after the Final CMMC Status Date.

Where. Electronically, in SPRS.

Before the Affirming Official signs, check:

The assessed scope matches the SSP boundary and the CAGE codes you enter in SPRS.
The score you report matches the objective-level assessment record, line by line.
Every POA&M item is eligible under 32 CFR 170.21(a)(2) and has a closeout date inside the 180-day window.
Every piece of evidence can be retrieved today, not just described.
Nothing "planned" or "in progress" has been scored as MET.

An affirmation is a representation to the Government. Treat it with the same care as any other certification you sign on a federal contract, and get your own counsel's advice on what it means for your organization.

Five failure patterns that sink a self-assessment

Scoring the requirement instead of the objectives. "We have MFA" is not a score. One unmet objective makes the whole requirement NOT MET.
Scope drift. The SSP boundary does not match the systems that actually touch CUI. The score is then for a system that doesn't exist.
Putting the wrong requirements on the POA&M. These include the SSP (3.12.4), 3.1.20, 3.1.22 and 3.10.3–3.10.5, and any 3- or 5-point requirement other than the 3.13.11 non-FIPS case. Any one of them on the POA&M means it does not meet 170.21(a)(2).
Counting the 180 days from the wrong date. The clock runs from the Conditional CMMC Status Date, not from the day you finished assessing.
Policies with no operating evidence. A policy says what should happen. Logs, tickets and records show that it did. Without them the objective is not met.

More patterns from real findings: common CMMC audit failures.

Check your score before your Affirming Official signs

Score your 110 controls against the objectives, see where the deductions land, and fix them before anyone signs.

Run the free Quick Score CMMC Level 2 readiness assessment

Prepared by the Athena Consulting Group CMMC practice. Athena is not a C3PAO and does not certify; this page explains the published rules so you can prepare.

Frequently asked questions

How many controls are in CMMC Level 2?

110: the security requirements of NIST SP 800-171 Rev. 2, organized into 14 families and evaluated against the assessment objectives in NIST SP 800-171A.

Can I self-assess for CMMC Level 2?

Yes, where your contract calls for Level 2 (Self). During the July 2026 suspension of the C3PAO phase-in, DoD requirements may designate only Level 1 (Self) or Level 2 (Self). Your clause still decides. Some contracts instead require a NIST SP 800-171 DoD Assessment posted to SPRS.

What's the passing SPRS score for CMMC Level 2?

Final Level 2 (Self) requires every requirement MET, the maximum score of 110 (32 CFR 170.16(a)(1); 170.24(c)(2)), either at the start or after POA&M closeout. Conditional Level 2 (Self) needs a POA&M that meets 32 CFR 170.21(a)(2): a score of at least 88 of 110, only eligible 1-point items, and none of the six excluded requirements. The POA&M must be closed out within 180 days of the Conditional CMMC Status Date. Below that bar there is no CMMC status, and no award where the contract requires one.

What's the difference between a requirement and an objective?

A requirement is the top-level control, for example 3.5.3, Use multifactor authentication. Objectives are the specific determinations made about that requirement, per NIST SP 800-171A. Scoring is per requirement, but grading is per objective: miss one objective and the requirement is NOT MET.

Who signs a CMMC Level 2 self-assessment?

The Affirming Official, a senior-level representative of the organization who is responsible for CMMC compliance and has authority to affirm it. They affirm in SPRS at completion of the self-assessment, after any POA&M closeout, and annually after a Final status.

How often is a Level 2 self-assessment required?

Every three years, with an affirmation annually in between.

Is a NIST 800-171 self-assessment the same as CMMC Level 2 (Self)?

They cover the same 110 requirements and the same objectives. The clause, the SPRS fields and the affirmation rules differ. Check which clause is in your contract before you submit.

Can DoD check a self-assessment?

Yes. DoD reserves the right to conduct a DCMA DIBCAC assessment of an organization that has self-assessed. If that assessment finds the requirements are not achieved or maintained, its results take precedence over any pre-existing CMMC status (32 CFR 170.16(a)(1)(iv)).