CMMC Level 2 Compliance Checklist (2026)

How to Use This Checklist

CMMC Level 2 compliance requires implementing all 110 security requirements from NIST SP 800-171, documenting that implementation in a System Security Plan, resolving any gaps in a Plan of Action and Milestones, and — for contractors on prioritized programs — passing a triennial assessment by a Certified Third-Party Assessment Organization (C3PAO). This checklist breaks that process into discrete, verifiable steps you can track against your actual environment.

Work through each section in order. The sections are sequenced because later steps depend on earlier ones — you cannot write accurate control implementation statements before you've defined your system boundary, and you cannot calculate your SPRS score before you've assessed your controls.

Phase 1: Scoping and Discovery

Before you can comply with anything, you need to know what you're protecting and where it lives.

• Identify your CUI. Review all active DoD contracts for references to Controlled Unclassified Information (CUI), DFARS 252.204-7012, or specific CUI categories. Coordinate with your contracting officer if contract language is unclear.
• Map CUI data flows. Document how CUI enters your organization (email, secure file transfer, government portals), where it is stored and processed (servers, workstations, cloud services), and how it exits (deliverables, email, subcontractor flow-down).
• Define your system boundary. Identify every system component in scope — hardware, operating systems, applications, cloud services, network devices, and physical locations. The boundary must include every system that handles, stores, or transmits CUI.
• Include cloud services. Confirm that Microsoft 365, SharePoint, OneDrive, Teams, Google Workspace, or any other SaaS tool used for government work is explicitly included in your boundary.
• Document external connections. List every connection between your in-scope environment and external systems — cloud providers, MSPs, VPN endpoints, government portals, and subcontractor links.
• Draw a network diagram. Create a current-state diagram showing your system boundary, data flows, internet-facing components, and external connections. This diagram is a required SSP artifact.

Phase 2: Gap Assessment Against NIST 800-171

Work through all 110 NIST 800-171 requirements and evaluate your current implementation status for each one.

• Obtain the NIST 800-171 Rev 2 control list. The current version is available free from csrc.nist.gov. Use this as your working document.
• Also obtain NIST 800-171A. This companion document breaks each of the 110 controls into individual assessment objectives (320 total). Assessors work from 800-171A, not 800-171. Assess yourself at the objective level to avoid surprises.
• Score each requirement as Met, Not Met, or Partially Implemented. Be honest — an inflated self-assessment is a legal liability under the False Claims Act, not just a compliance error.
• Document your evidence for Met controls. For every control you assess as Met, identify the specific artifacts that demonstrate implementation (policy documents, configuration screenshots, training records, audit logs).
• Flag all gaps for the POA&M. Every requirement that is Not Met or only partially implemented needs a POA&M entry.

Phase 3: System Security Plan (SSP)

The SSP is the primary compliance document for CMMC Level 2 and is reviewed first by every C3PAO assessment team.

• Write a system description. Describe what the system is, what CUI it handles, who uses it, and where it is located.
• Document your system boundary. Describe the boundary in narrative form, referencing your network diagram.
• Document user types and access roles. List privileged users, standard users, service accounts, and external users with their respective access rights.
• Write implementation statements for all 110 requirements. For each requirement, describe specifically how your organization implements it — what tool or mechanism, what scope, who is responsible, and where the evidence lives. Vague statements are a common assessment failure point.
• Reference POA&M items for unimplemented controls. For any requirement that is not fully implemented, note it as Not Met in the SSP with a cross-reference to the POA&M.
• Document external service providers. For each cloud service or external provider that handles CUI, describe what security controls they implement and the contractual agreements that govern the relationship.
• Assemble supporting appendices. Attach or reference your network diagram, user access list, hardware and software inventory, policy documents, and any other artifacts cited in implementation statements.

Phase 4: Plan of Action and Milestones (POA&M)

Every NIST 800-171 requirement you cannot currently claim as Met needs a POA&M entry.

• Create a POA&M entry for every Not Met control. Each entry requires: the specific requirement number and title, a description of the gap, the planned remediation steps, the responsible person or team, and a target completion date.
• Set realistic completion dates. Assessors will ask whether your timeline is achievable. Dates that are clearly aspirational undermine your credibility.
• Prioritize high-weight controls. Under the DoD Assessment Methodology, some controls carry deductions of 3–5 points. Implement those first to improve your SPRS score faster.
• Track progress. Review and update your POA&M monthly. Mark items complete when implementation is finished and evidence is collected — then update your SPRS score.

Phase 5: SPRS Score Submission

Once you have completed your gap assessment, you are ready to calculate and submit your SPRS score.

• Calculate your score using the DoD Assessment Methodology. Start at 110. For each Not Met requirement, deduct the points assigned to it in the DoD Assessment Methodology weighting table (available at dodcio.defense.gov). The minimum possible score is -203.
• Confirm your SSP and score are consistent. Every control marked Met in your score must be described as implemented in your SSP. Discrepancies are findings in both a C3PAO assessment and a DoD audit.
• Have a senior official authorize the submission. The SPRS submission is a legal attestation. It must be signed off by someone authorized to bind the company — not an IT vendor or junior compliance analyst.
• Submit to SPRS at sprs.csd.disa.mil. You will need an active SAM.gov registration, a SPRS account linked to your CAGE code, and a DoD-approved PKI or ECA certificate for authentication.
• Record your submission. Document the score submitted, the assessment date, the POA&M completion date entered, and the authorizing official's name and title. Store this with your SSP and POA&M.

Phase 6: C3PAO Assessment Preparation (If Required)

Contractors on prioritized programs — those the DoD designates as handling CUI for critical programs or high-value assets — must undergo a triennial C3PAO assessment rather than relying solely on self-assessment.

• Confirm your assessment requirement. Review your contract for language specifying a C3PAO assessment. If your contract requires one, begin scheduling at least 6–9 months in advance — C3PAO lead times have extended significantly as CMMC rolls out.
• Select a C3PAO. The authorized C3PAO list is maintained at cyberabb.com (the CMMC Accreditation Body). Verify that the organization you select is currently authorized.
• Conduct an internal readiness review. Before the assessment, compare your SSP implementation statements against your actual technical configurations. Resolve every discrepancy you find — assessors will find them if you don't.
• Prepare your evidence package. For each control you've assessed as Met, assemble the corresponding evidence: configuration screenshots with timestamps, policy documents, training completion records, audit log samples. Don't wait for the assessor to ask — have it ready.
• Conduct staff interviews in advance. Assessors will interview the individuals responsible for each control area. Ensure those individuals know what the SSP says about their area and can describe implementation in their own words. Mismatches between the SSP and staff interviews are findings.
• Run a mock assessment on your highest-risk areas. Focus on Access Control, Identification and Authentication, and Audit and Accountability — the families where assessment failures are most common.

Phase 7: Ongoing Compliance

Compliance is not a one-time project. These activities must continue after your initial assessment.

• Update your SSP for every significant environment change. New cloud services, network changes, personnel changes, and software additions all trigger an SSP update.
• Track and close POA&M items on schedule. When an item is completed, update your SSP, collect evidence, and update your SPRS score.
• Conduct annual security awareness training. Requirement 3.2.1 mandates awareness training for all personnel. Document completion.
• Perform periodic access reviews. Review all user accounts and access rights at least annually. Revoke access that is no longer needed. Document the review with evidence.
• Run vulnerability scans on a defined schedule. Requirement 3.11.2 requires periodic scanning of organizational systems. Establish a scan frequency, remediate findings, and keep records.
• Test your incident response plan. Requirement 3.6.1 requires an operational incident-handling capability. An untested plan does not meet that standard — conduct at least an annual tabletop exercise and document it.
• Schedule your next SPRS score update. When POA&M items are completed, recalculate and resubmit your score. A stale score that no longer reflects your implementation creates liability.

Where RegulatoryForge Fits

RegulatoryForge is built around this exact workflow. The Compliance Tracker covers all 110 NIST 800-171 requirements with implementation status tracking, evidence attachment, and POA&M integration. The SSP Builder generates assessor-ready implementation statements from your tracker data. The SPRS Wizard calculates your score using the official DoD weighting table and walks through the submission process. Use the checklist above to understand the sequence — use RegulatoryForge to execute it.

Before you start: use our free SPRS score calculator to see where you stand today. Mark each of the 110 requirements as Met or Not Met and your score calculates live — no account required.