Map 110 Controls: CMMC Level 2 Checklist for US Defense Contractors

CMMC Level 2 requires full implementation and evidence for all 110 NIST SP 800-171 Rev. 2 controls across any system that touches Controlled Unclassified Information. Your first move is confirming which contracts trigger the requirement, then building a System Security Plan that documents your scope. From there, the path splits into self-assessment or a C3PAO-led verification, depending on what your contract demands.

---

TL;DR:

• Confirm if your prime contract mandates CMMC Level 2 by checking for DFARS flow-down clauses before you start, as non-compliance may lead to disqualification.
• Proper scoping requires identifying all systems, third parties, and cloud providers that process or store CUI; errors here cause downstream compliance issues and inaccurate SPRS scores.
• Build a comprehensive System Security Plan that clearly defines boundaries, data flows, and control ownership, with narratives specifically addressing how each control is met.
• Evidence must be current, attributable, and mapped to specific assessment objectives, with high-weight controls like SSP and access management requiring strict and detailed documentation.
• Ongoing maintenance includes annual affirmation, regular evidence updates, and internal reviews to sustain compliance beyond the initial certification without risking significant scoring penalties.

---

Table of Contents

• What Does the CMMC Level 2 Checklist Actually Require?
• Step-by-Step Verification Checklist by Control Family
• What Counts as Evidence, and How Do You Map It?
• How Do You Scope CUI and Choose an Assessment Path?
• How Does SPRS Scoring and the POA&M Rule Work?
• How Do You Maintain Level 2 Compliance After Certification?
• What Tatemweb Has Seen Inside CMMC Level 2 Engagements
• The Checklist Everyone Skips Isn’t the One You’d Expect
• Get Assessor-Ready Without Building an Internal Compliance Team
• Where to Verify These Requirements Yourself
• Sources
• FAQ

What Does the CMMC Level 2 Checklist Actually Require?

A working CMMC compliance checklist is a sequence, not a spreadsheet you fill in at random. Skipping the order costs contractors real money, usually because they buy tools before they know what their scope even is.

Here’s the sequence that actually holds up under assessment scrutiny, drawn from how a phased checklist approach is meant to work:

1. Confirm the requirement. Check your prime contract or solicitation for DFARS clause 252.204-7021 or 252.204-7025 flow-downs. If they’re there, Level 2 isn’t optional.
2. Scope your CUI environment. Identify every system, application, and third-party service (cloud providers, MSPs, MSSPs) that stores, processes, or transmits CUI.
3. Build your System Security Plan. Document system boundaries, data flows, and who owns each control family.
4. Map all 110 controls to owners and evidence. Each control needs a named owner and a path to the 320 assessment objectives in NIST SP 800-171A.
5. Collect final evidence and test controls. Logs, configs, training records, patch histories, all dated and tied to your actual scope.
6. Calculate your SPRS score honestly. Report it in the Supplier Performance Risk System before you submit anything.
7. Prepare for assessment and enter maintenance mode. Either package evidence for self-attestation or get assessor-ready for a C3PAO, then set a recurring review cadence.

The biggest mistake contractors make isn’t skipping a control. It’s jumping to step 5 before finishing step 2, which means they document controls for systems that were never actually in scope, or miss ones that were. A Level 2 readiness review usually starts by re-walking these first two steps, because that’s where most gaps hide.

Step-by-Step Verification Checklist by Control Family

The 110 requirements sit across 14 families, and each one carries its own evidence expectations. Treat this as your line-by-line audit prep, not a reading exercise.

Access Control (AC), the largest family at 22 requirements, needs an assigned owner (usually IT or a security lead), documented multi-factor authentication for privileged and remote access, a current account inventory, session timeout settings, and a list of who holds privileged accounts and why. A common failure: dormant accounts from departed employees still active six months later. Most AC items land in your evidence matrix as screenshots, configuration exports, or access log reviews, and few of them qualify for a POA&M deferral.

Audit & Accountability (AU) wants centralized log collection, tamper-evidence (write-once storage or hashing), a defined retention period, and records showing someone actually reviews the logs on a schedule. The failure pattern here is collecting logs nobody reads.

Configuration Management (CM) requires documented baseline configurations for servers and endpoints, a change record system, and proof that changes go through an authorization step rather than getting pushed live by whoever’s on shift.

Identification & Authentication (IA) overlaps with AC but focuses on unique user IDs (no shared logins), MFA enforcement, and credential lifecycle management, including how you rotate or revoke access.

Incident Response (IR) needs a written incident response policy, evidence of at least one table-top exercise, and records from any real incidents showing detection, containment, and reporting timelines.

For the remaining families, the pattern repeats with different artifacts:

• Media Protection (MP): inventory of removable media, sanitization records, and encryption evidence for CUI at rest.
• Physical Protection (PE): visitor logs, badge access records, and facility access lists for anywhere CUI-handling systems live.
• Personnel Security (PS): documented screening procedures and termination checklists showing access gets revoked same-day.
• Maintenance (MA): logs of who performed maintenance on CUI systems and what tools or media they used.
• Risk Assessment (RA): a documented risk assessment methodology and evidence it’s actually been run, not just written once and shelved.
• Security Assessment (CA): this is where your SSP itself becomes the artifact, along with assessment records and your POA&M.
• System & Communications Protection (SC): network diagrams, boundary protection configs (firewalls, VPNs), and encryption-in-transit evidence.
• System & Information Integrity (SI): patch management records, malware protection logs, and vulnerability scan results.
• Awareness & Training (AT): training rosters with dates, content summaries, and role-specific training records for privileged users.

Pro Tip: Assign one named owner per control family before you touch evidence collection. Contractors who split ownership by “whoever’s free” end up with duplicate work and gaps nobody notices until the assessor asks a question nobody can answer.

POA&M eligibility varies sharply across these families. Configuration and documentation gaps are often deferrable with a remediation plan. Access control and authentication failures rarely are, because they represent the exact attack surface CUI protections exist to close.

What Counts as Evidence, and How Do You Map It?

Your SSP is the backbone document, and assessors read it before they read anything else. It needs clearly defined system boundaries, a component inventory, and control-by-control narratives explaining how each requirement is met, not just a checkbox saying it is. Vague narratives (“access is controlled”) get flagged immediately; specific ones (“MFA enforced via Azure AD Conditional Access for all remote sessions”) pass review.

POA&M rules are stricter than most contractors expect. Not every unmet control can go on a Plan of Action & Milestones, and the ones that can typically carry an expectation of remediation within roughly 180 days. High-weight requirements, the ones worth the most SPRS points, often can’t be deferred at all without jeopardizing your score.

Acceptable evidence generally shares four traits: it’s dated, it’s signed or attributable to a specific system or person, it reflects your actual in-scope environment (not a template), and it’s current within your review cycle. Assessors use three verification methods drawn straight from NIST SP 800-171A:

• Examine — reviewing documents, configs, and diagrams.
• Interview — talking to the control owner to confirm the practice matches the paperwork.
• Test — actively verifying the control works (attempting an unauthorized login, checking a log for a specific event).

Every artifact you collect should map to one of the 320 assessment objectives tied to the 110 requirements. A patch record isn’t just “proof of patching.” It’s evidence against a specific SI objective, and labeling it that way in your evidence matrix saves hours during the actual review.

How Do You Scope CUI and Choose an Assessment Path?

Scoping decisions made in week one determine your evidence burden for the next two years, so get this right before anything else moves forward.

Start with your contract language. DFARS clause 252.204-7021 typically specifies the required CMMC level, and 252.204-7025 covers the self-attestation and affirmation requirements tied to SPRS reporting. Read every flow-down clause in subcontracts too. Primes routinely push Level 2 requirements down to subs who never expected to need them.

Your scope has to include cloud providers, managed service providers, and any MSSP touching CUI systems. Document each provider’s shared responsibility boundary in writing. A cloud host handling your infrastructure isn’t automatically covering your access control obligations.

Some primes now require C3PAO-based third-party verification as a contract condition, even while DoD’s Phase 2 rollout remains paused for the broader program. If a prime asks for third-party certification, that requirement holds regardless of program-wide timelines.

Your procurement and program teams should:

• Log every DFARS clause reference by contract number.
• Flag any clause requiring third-party assessment versus self-attestation.
• Document cloud and MSP boundaries in the SSP, not in a separate side file nobody checks later.
• Revisit scope annually or whenever a new contract or subcontract is signed.

Small contractors and subs benefit from scoping guidance built for their size, since the temptation to over-scope (and waste money securing systems that never touch CUI) is common.

How Does SPRS Scoring and the POA&M Rule Work?

SPRS scoring runs on a weighted system: 44 requirements carry 5 points each, 14 carry 3 points, and 51 carry 1 point, for a maximum possible score of 110. Miss a 5-point control and your score drops fast, which is why failing high-weight items has outsized consequences compared to missing a handful of 1-point items.

One control acts as a gatekeeper: CA.L2-3.12.4, the requirement to have a current SSP. Without it, your score and your certification path are both compromised, since the SSP is the document every other control gets measured against.

Common scoring errors worth avoiding:

• Scoring a control as “met” when evidence only partially supports it.
• Leaving high-weight controls unaddressed and assuming a POA&M will cover them.
• Failing to update the SPRS score after remediation, leaving an outdated number on file.

How Do You Maintain Level 2 Compliance After Certification?

Certification isn’t a finish line. It’s a snapshot, and DoD expects contractors to keep that snapshot accurate through annual affirmation and continuous evidence upkeep.

1. Complete annual affirmation. A designated senior official signs off yearly, confirming your posture still matches what’s on file.
2. Refresh evidence on a cadence. Set quarterly or monthly reviews, plus event-driven updates whenever you patch systems, hire staff with privileged access, or change infrastructure.
3. Run internal readiness reviews. Re-test controls on your own schedule, not just before an external assessment.
4. Close out POA&M items on schedule. Track remediation deadlines and document completion the same way you’d document original evidence.

Contractors who treat this as ongoing operations, rather than a once-a-year fire drill, tend to keep their scores stable and avoid the scramble that happens when a contract renewal suddenly demands proof.

What Tatemweb Has Seen Inside CMMC Level 2 Engagements

Tatemweb brings more than 26 years of Florida-based technology consulting to compliance work, including hands-on CMMC Level 2 consulting alongside HIPAA and PCI engagements. A typical engagement produces a gap analysis, a drafted SSP, an evidence matrix mapped to the 110 controls, a POA&M template, and an assessor-ready package. For small contractors juggling limited IT staff, prioritizing the highest SPRS-weighted controls first usually closes the biggest risk gaps before deadline pressure sets in.

The Checklist Everyone Skips Isn’t the One You’d Expect

Most guidance on this topic treats the 110 controls as the hard part. They’re not. The hard part is scoping, and it’s the step contractors rush through because it feels like paperwork instead of security work.

Get scope wrong and everything downstream inherits the mistake: your SSP describes the wrong boundary, your evidence matrix covers systems that were never at risk, and your SPRS score reflects effort spent in the wrong place. I’d argue the industry’s obsession with control-by-control checklists, useful as they are, has quietly buried scoping as the actual point of failure in most failed assessments.

The other place conventional advice falls short: treating POA&Ms as a safety net. They’re not. High-weight controls that can’t be deferred mean a POA&M-heavy strategy often just delays a bad outcome rather than preventing one.

If you take one thing from this, prioritize scoping and SSP accuracy before you spend a dollar on remediation tools. Everything else, including whether you need a C3PAO or can self-attest, follows from getting that foundation right.

— Matt

Get Assessor-Ready Without Building an Internal Compliance Team

Building a compliance program from scratch, hiring dedicated staff, and learning CMMC’s evidence requirements by trial and error costs most small contractors far more time than hiring a consultant who’s already mapped the 110 controls dozens of times. Tatemweb is the alternative to building that expertise in-house: a direct path to a completed SSP, evidence matrix, and POA&M template, built by a team that’s spent 26 years in Florida serving small and mid-size businesses under real compliance deadlines.

Engagements typically start with a gap analysis against your current NIST SP 800-171 posture, move through SSP drafting and evidence mapping, and end with an assessor-ready package whether you’re heading toward self-attestation or a C3PAO review. Contractors juggling limited IT staff benefit most, since prioritization guidance alone often prevents months of wasted remediation spend. If you’re also weighing outside consultants generally, this guide to choosing a CMMC consultant walks through what to ask before signing anyone.

Call Tatemweb at 772-224-8118 or visit the CMMC compliance services page to schedule a consultation and find out where your gaps actually are.

Where to Verify These Requirements Yourself

Cross-check every requirement against primary sources before relying on any third-party summary. Start with NIST SP 800-171 and its assessment companion 800-171A for the technical baseline, review your contract’s DFARS clauses directly, and confirm your SPRS score status through the official reporting system. The CISA Defense Industrial Base sector page rounds out sector-specific guidance worth bookmarking.

Sources

• CMMC Level 2 Checklist: 110 Controls, Evidence & SPRS (2026)
• Phase 2 of CMMC is delayed. That doesn’t mean compliance is. | Manufacturing Dive
• CMMC Level 2 Controls List - 110 Requirements & SPRS Points

FAQ

What Is Needed for CMMC Level 2?

Contractors need full implementation of all 110 NIST SP 800-171 Rev. 2 controls, a current System Security Plan, an accurate SPRS score, and evidence mapped to the 320 assessment objectives in NIST SP 800-171A.

Can You Self-Certify for CMMC Level 2?

Some contracts allow self-assessment with annual affirmation, while others require a C3PAO-led third-party assessment; the DFARS clauses in your specific contract determine which path applies.

How Much Does a CMMC Level 2 Audit Cost?

Costs vary widely based on your environment’s size and existing security maturity, since assessment fees depend on scope, evidence readiness, and whether a gap analysis or remediation work happens first; a readiness review before scheduling an assessment typically reduces surprise costs.

What Is a SOC 2 Type 2 Compliance Checklist?

SOC 2 Type 2 evaluates a service organization’s controls over an extended period, unlike CMMC Level 2, which assesses compliance with the 110 NIST SP 800-171 controls specifically for protecting CUI in the defense supply chain.

Which NIST Revision Applies to Current CMMC Level 2 Assessments?

Current assessments align to NIST SP 800-171 Revision 2, not Revision 3; treat Rev. 3 as future planning guidance rather than the active audit standard.

Recommended

• CMMC for Small Business: What to Do Right Now
• How to Choose a CMMC Consultant for Your Business
• Cybersecurity Compliance for SMBs: 2026 Guide