CMMC Level 2 Checklist and Self-Assessment Workbook (Free Excel Template)

The Cybersecurity Maturity Model Certification (CMMC) program is how the US Department of Defense (DoD) verifies that contractors protect the information it shares with them. The program rule, 32 CFR Part 170, took effect on 16 December 2024, and the contract clause DFARS 252.204-7021 began appearing in solicitations from 10 November 2025.

CMMC protects two types of information. Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information (CUI) is more sensitive information that requires safeguarding under law, regulation or government policy, such as technical drawings and specifications for defense systems.

• Level 1 (Foundational): for contractors handling FCI only. 15 requirements from FAR 52.204-21. An annual self-assessment and affirmation in SPRS. Every requirement must be met, and POA&Ms are not allowed.
• Level 2 (Advanced): for contractors handling CUI. The 110 requirements of NIST SP 800-171 Revision 2. Either a self-assessment or a certification assessment by an authorized C3PAO every three years, depending on the contract, plus an annual affirmation.
• Level 3 (Expert): for the most sensitive programs. Level 2 certification plus 24 selected requirements from NIST SP 800-172, assessed by the DoD's DIBCAC.

This workbook covers Level 1 and Level 2, which is where the vast majority of the defense industrial base sits.

Level 2 uses the DoD Assessment Methodology, written into 32 CFR 170.24. You start with 110 points and subtract a value for every requirement that is NOT MET:

• 5 points for 44 requirements whose absence has the greatest impact, such as access control, MFA, incident response and malware protection.
• 3 points for 14 requirements.
• 1 point for the remaining 51 requirements.

Two requirements allow partial credit. Multifactor authentication (IA.L2-3.5.3) and FIPS-validated cryptography (SC.L2-3.13.11) lose only 3 points instead of 5 when they are partly implemented. The System Security Plan (CA.L2-3.12.4) has no point value, because without an SSP an assessment cannot be completed. The lowest possible score is -203. Requirements marked N/A are scored as MET.

You do not need a perfect score to win work. Under 32 CFR 170.21, an organization can achieve conditional Level 2 status with a plan of action and milestones (POA&M) if:

• the assessment score is at least 88 (80% of 110),
• no gap on the POA&M is worth more than 1 point, except SC.L2-3.13.11 when encryption is used but not FIPS-validated, and
• none of these six requirements is NOT MET: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5.

Every POA&M item must then be closed and verified within 180 days. The workbook applies all of these rules automatically and counts down to the deadline.

CMMC requirements flow down from US prime contractors to their subcontractors, wherever those subcontractors are based. If your organisation supplies a US defense program, including work linked to AUKUS, you may be asked to show CMMC compliance alongside your obligations under Australia's Defence Industry Security Program (DISP). The two programs are separate, but there is real overlap, and NIST SP 800-171 maps closely to NIST SP 800-53, which many Australian organisations already use. Read more in Defence supply chain security.