How to use this checklist
- Decide your scope first. List the systems, cloud services, locations and people that store, process or send CUI. Everything on the checklist applies to that boundary, so a smaller boundary means less to check.
- Go domain by domain. For each practice ask one question: is it in place and working today, and could we show evidence? Tick the box only if the answer is yes for the whole scope.
- Note the point value. Each practice is worth 5, 3 or 1 point in your SPRS score. Unticked 5-point practices are your first priorities.
- Write down the evidence. A policy alone is not enough; keep the screenshot, log, record or configuration that shows the practice working.
- Turn the gaps into a plan. Every unticked practice becomes a remediation task or a POA&M entry with an owner and a date.
Practices marked L1 are also the 17 CMMC Level 1 practices, so a company that handles only Federal Contract Information can work through those alone; see CMMC Level 1. Your ticks are not saved; print the page (Print, then save as PDF) to keep a copy, or use the SPRS score calculator to score the same list.
Before you start: documents to gather
- Your DoD contracts and subcontracts, with every mention of FAR 52.204-21, DFARS 252.204-7012, 7019, 7020 or 7021 (see the DFARS clauses explained).
- A current system security plan (SSP) and any POA&M you already keep.
- An asset inventory: computers, servers, network devices, cloud services and mobile devices in scope.
- Network and data-flow diagrams that show where CUI enters, is stored and leaves.
- Policies and procedures for each domain, plus the records that prove they are followed: training, access reviews, logs, incident reports, maintenance and visitor records.
- Contracts or responsibility matrices for outside providers, such as your MSP or cloud provider, showing which practices they cover.
The 110-practice checklist
AC: Access Control (22 practices)
AT: Awareness and Training (3 practices)
AU: Audit and Accountability (9 practices)
CM: Configuration Management (9 practices)
IA: Identification and Authentication (11 practices)
IR: Incident Response (3 practices)
MA: Maintenance (6 practices)
MP: Media Protection (9 practices)
PS: Personnel Security (2 practices)
PE: Physical Protection (6 practices)
RA: Risk Assessment (3 practices)
CA: Security Assessment (4 practices)
SC: System and Communications Protection (16 practices)
SI: System and Information Integrity (7 practices)
After the checklist
Turn gaps into a remediation plan
Sort the unticked practices by point value and effort. The 5-point items usually need tools or configuration changes (MFA, central logging, endpoint protection, baseline hardening), while many 1-point items are policy, settings or record-keeping. Assign each one an owner and a target date.
Update the SSP and POA&M
For every practice, the SSP should say how it is met, by which system or provider, and where the evidence lives. Open items go in the POA&M. Under 32 CFR 170.21 only certain lower-value items may stay on a Level 2 POA&M, and they must be closed within 180 days.
Score it and affirm it
When the gaps are closed, complete your self-assessment against the assessment objectives, post the score in SPRS and have a senior official affirm it. While CMMC Phase 2 is suspended, new requirements may call for Level 1 (Self) or Level 2 (Self), so this self-assessment is what most contracts look for now; the Level 2 self-assessment guide walks through the steps.
Prefer a second pair of eyes? Galaxy Consulting is a Cyber-AB Registered Provider Organization. Its gap assessment runs this same checklist with your team and ends with a prioritized roadmap. Read more about CMMC readiness at Galaxy.
Frequently asked questions
How many practices are on the CMMC Level 2 checklist?
CMMC Level 2 has 110 practices, the 110 security requirements of NIST SP 800-171 Rev 2, grouped into 14 domains from Access Control to System and Information Integrity. CMMC Level 1 is the 17 practices marked L1 in the checklist.
Is this checklist enough to complete my self-assessment?
It is a starting point. A self-assessment checks each practice against assessment objectives in NIST SP 800-171A and your evidence, and records the result in your system security plan and SPRS. Use the checklist to see where you stand and what to gather.
What documents should I have before an assessment?
At minimum a current system security plan (SSP) that covers your system boundary and explains how each practice is met, a POA&M for open items, your policies and procedures, an asset inventory, network and data-flow diagrams, and the records that show controls work, such as logs, training records and access reviews.
Which practices should I work on first?
Start with the SSP (3.12.4), because no assessment can be completed without it, and then the 5-point practices such as MFA, audit logging, configuration baselines and malware protection. They move your SPRS score the most and cannot be left on a POA&M.
Is there a downloadable PDF version?
Not yet. The checklist on this page prints cleanly from your browser (use Print and save as PDF). The SPRS score calculator uses the same 110 practices if you want a score as you go.
Can someone walk through the checklist with us?
Yes. In a Galaxy gap assessment a Cyber-AB Registered Practitioner goes through every applicable practice with your team, typically over 2 to 3 weeks, and you get a written gap report, a remediation roadmap and an SPRS estimate.
Related CMMC pages
- SPRS score calculator: score the same 110 practices
- NIST 800-171 and CMMC gap assessment service
- CMMC Level 1: the 17 practices
- CMMC Level 2 self-assessment guide
- What a CMMC Level 2 assessment costs
Talk it through with a Registered Practitioner
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) in Fort Washington, Maryland. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.