← All checklists
CMMC Level 2 readiness checklist
The CMMC Level 2 practices a defense contractor handling CUI has to meet, mapped to their practice ID and NIST SP 800-171 Rev. 2 requirement, with the evidence an assessor will ask for. Preview 17 of the 117 items below; the full checklist comes as a branded, fillable PDF.
Checklist v1.0Covers CMMC Level 2 (32 CFR Part 170)Reviewed 30 Oct 2026117 items · 13 sections
Scope, score and assessment type
7 items
- Prep 1Confirm from the contract or solicitation whether you need a Level 2 self-assessment or a Level 2 certification assessment by a C3PAO. Both last three years.Evidence: Contract clause or solicitation text naming the required CMMC level and assessment type.
Access control: accounts and sessions
11 items
- AC.L2-3.1.1Limit system access to authorized users, processes acting for them and approved devices.Evidence: User and device lists reconciled against HR and the asset inventory.
- AC.L2-3.1.2Limit what each authorized user can do to the transactions and functions their role needs.Evidence: Role definitions and access settings in key systems.
Access control: remote, wireless, mobile and external
11 items
- AC.L2-3.1.12Monitor and control remote access sessions.Evidence: VPN or ZTNA configuration and connection logs.
- AC.L2-3.1.13Use cryptography to protect the confidentiality of remote access sessions.Evidence: Remote access encryption settings showing approved protocols.
Awareness, training and audit
12 items
- AT.L2-3.2.1Make managers, administrators and users aware of the security risks of their work and the policies that apply.Evidence: Awareness training content and completion records.
- AT.L2-3.2.2Train staff to carry out their assigned security duties.Evidence: Role-based training records for admins and security staff.
Configuration management
9 items
- CM.L2-3.4.1Set and maintain baseline configurations and inventories of systems, including hardware, software, firmware and documentation.Evidence: Approved baselines and current asset inventory.
Identification and authentication
11 items
- IA.L2-3.5.1Identify system users, processes acting for users and devices.Evidence: Identity provider user list and device inventory.
- IA.L2-3.5.2Authenticate users, processes and devices before allowing access.Evidence: Authentication settings for users, services and devices.
Incident response and maintenance
9 items
- IR.L2-3.6.1Run an incident handling capability covering preparation, detection, analysis, containment, recovery and user response.Evidence: Incident response plan and tickets from recent incidents.
Media protection
9 items
- MP.L2-3.8.1Protect and securely store paper and digital media that contain CUI.Evidence: Media storage procedure and records of locked storage.
Personnel and physical protection
8 items
- PS.L2-3.9.1Screen people before giving them access to systems that hold CUI.Evidence: Screening procedure and records for a sample of staff.
Risk and security assessment
7 items
- RA.L2-3.11.1Assess the risk to operations, assets and people from running systems that handle CUI, on a periodic basis.Evidence: Dated risk assessment and risk register.
System and communications protection: boundaries and networks
8 items
- SC.L2-3.13.1Monitor, control and protect communications at external and key internal boundaries.Evidence: Network diagram and boundary firewall configuration.
System and communications protection: encryption and sessions
8 items
- SC.L2-3.13.8Use cryptography to prevent unauthorized disclosure of CUI in transit unless other physical safeguards protect it.Evidence: TLS and VPN encryption settings.
System and information integrity
7 items
- SI.L2-3.14.1Identify, report and correct system flaws in a timely manner.Evidence: Patch policy with SLAs and patch compliance report.
Changelog
- v1.030 Oct 2026First release. Covers CMMC Level 2 under 32 CFR Part 170, assessed against NIST SP 800-171 Rev. 2, including scoping, SPRS scoring and POA&M rules.
Take it to your team
Fillable PDF with owner and target date fields, your name on every page.