Free readiness aid

CMMC Level 2
self-assessment checklist

A 14-domain readiness checklist for Defense Industrial Base contractors preparing for CMMC 2.0 Level 2 under NIST SP 800-171. Score each item, get a readiness read, print the result. Written by someone who has enforced these controls on DoD programs.

View services

0%0 of 0 items scored

Start scoring. The read updates as you go.

How to useMark each item Met, Partial, or Not met. Anything short of Met belongs on your Plan of Action and Milestones (POA&M). A C3PAO assessor will check the same items. Finding the gap now is cheaper than finding it after a failed certification. Your answers stay in this browser; nothing is sent anywhere.

DisclaimerThis is a high-level readiness aid, not a formal gap assessment. Talk to a CMMC Certified Professional (CCP) or Certified Assessor (CCA) before you submit an SPRS score.

Pre-flight

Scope and boundary

SCOPECUI boundary definition

I have identified all systems that store, process, or transmit Controlled Unclassified Information (CUI).
I have a current network and data-flow diagram showing the CUI boundary.
I have a current asset inventory (hardware, software, cloud services) for in-scope systems.
I have identified all External Service Providers (ESPs) that touch CUI and verified their FedRAMP Moderate or equivalent status.
If using Microsoft 365, I am on GCC High, or I have a documented justification for Commercial or GCC.

The 14 domains

NIST 800-171, 110 practices, one pass

01 ACAccess Control

Unique user accounts; no shared or generic logins on CUI systems.
Role-based access enforced; least privilege documented and reviewed.
Separation of duties for privileged functions.
Session lock after 15 minutes of inactivity on CUI systems.
Remote access is encrypted, logged, and routed through approved channels (VPN or jump host).
Mobile device access to CUI is controlled and encrypted at rest.
Public CUI posting is blocked; no CUI on public-facing sites.

02 ATAwareness & Training

Annual security awareness training completed and documented for all users.
Role-based training for privileged users and ISSOs.
Insider-threat awareness module included.

03 AUAudit & Accountability

Audit logs are generated for all in-scope systems and centrally collected (SIEM).
Logs are retained for the minimum required period (1 year typical, longer if the contract requires).
Logs are protected from unauthorized modification or deletion.
Logs are reviewed regularly, with a documented review cadence and a named reviewer.
Time synchronization (NTP) is enforced across all logging sources.

04 CMConfiguration Management

Baseline configurations exist for all in-scope OS, applications, and network devices (DISA STIGs or CIS Benchmarks).
Change-control process documented and followed.
Least-functionality principle applied: unnecessary services, ports, and protocols disabled.
Software allowlisting or application control deployed where feasible.
User-installed software is restricted on CUI systems.

05 IAIdentification & Authentication

MFA enforced for all privileged accounts and all remote access to CUI systems.
Password policy meets NIST 800-63 guidance (length, complexity, no forced rotation absent compromise).
FIPS 140-2 or 140-3 validated cryptography used for authenticator transmission and storage.
Stored passwords are cryptographically protected (hashed and salted).

06 IRIncident Response

Documented Incident Response Plan covering preparation, detection, containment, eradication, recovery, and post-incident review.
IR roles and responsibilities are assigned and trained.
Tabletop exercise conducted within the last 12 months.
72-hour DoD reporting capability via dibnet.dod.mil established and tested.

07 MAMaintenance

Maintenance activities are scheduled, approved, and logged.
Maintenance tools are inspected before use on CUI systems.
Remote maintenance sessions are authorized, monitored, and use MFA.
Media is sanitized before equipment leaves the organization.

08 MPMedia Protection

CUI on physical media is marked and controlled.
Removable media use on CUI systems is restricted or disabled.
Media is sanitized or destroyed per NIST 800-88 before disposal or reuse.
Encryption is applied to CUI on portable storage.

09 PSPersonnel Security

Background screening completed for personnel with access to CUI.
Termination procedures revoke access to CUI systems within 24 hours.
Transfer and role-change procedures trigger access reviews.

10 PEPhysical Protection

Physical access to facilities housing CUI systems is controlled and logged.
Visitors are escorted and access is logged.
Alternate work sites (telework) have documented physical safeguards for CUI.

11 RARisk Assessment

A documented risk assessment exists and is reviewed annually.
Vulnerability scans run on a defined cadence (monthly or better).
Identified vulnerabilities are tracked and remediated per documented timelines.

12 CASecurity Assessment

System Security Plan (SSP) authored, current, and signed.
Plan of Action and Milestones (POA&M) actively maintained.
Self-assessment completed against NIST 800-171A; SPRS score submitted.
Continuous monitoring program documented and operating.

13 SCSystem & Communications Protection

CUI is encrypted in transit using FIPS-validated cryptography (TLS 1.2 or later).
CUI is encrypted at rest using FIPS-validated cryptography.
Boundary protections deployed (firewall, IDS/IPS, DNS filtering).
Internal network segmented from the CUI enclave.
Mobile and collaborative computing devices controlled (cameras, mics, screen sharing).

14 SISystem & Information Integrity

Anti-malware deployed, updated, and centrally monitored on all CUI systems.
Patch management process documented; critical patches applied within 30 days.
System-generated security alerts are monitored 24/7 (in-house or via an MSSP).
Email and web protections deployed (anti-phishing, URL filtering, sandboxing).
Spam protection and inbound mail filtering active.

Reading your score

What the number means

100% metYou are likely ready for a C3PAO assessment. Schedule a mock audit to validate before you book the real one.

80% to 99%Level 2 conditional certification is realistic with a focused 90-day remediation sprint. The 88-of-110 threshold on the real assessment sits at 80%.

Below 80%A formal gap assessment and remediation engagement should come before any C3PAO booking.

Scoring: Met counts as 1, Partial as 0.5, Not met as 0, divided by the 64 items on this page. It is a readiness read, not your SPRS score.

Need a hand walking the controls?

Southern Cyber Solutions is an independent practice opening after my December 2026 graduation: CMMC readiness, gap assessments, remediation, and pre-assessment mock audits for the Defense Industrial Base. Early conversations are welcome now. The first 30 minutes are free.

Book a discovery call Full service catalog