NIST SP 800-171 checklist for CMMC Level 2
Every NIST SP 800-171 Rev 2 requirement, broken into the NIST SP 800-171A objectives an assessor checks. Mark each objective, watch each family fill in, keep your evidence notes, and leave with a CSV, a summary or a printed worksheet. Free, no sign-up, and it stays in your browser.
What this checklist checks
NIST SP 800-171 Rev 2 has 110 security requirements in 14 families. CMMC Level 2 uses the same list: in the words of 32 CFR 170.14(c)(3), “The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2.” A requirement is not one check, though. NIST SP 800-171A (June 2018) breaks each one into assessment objectives, 320 in all, and that is the level a Level 2 self-assessment is run at.
32 CFR 170.4; 32 CFR 170.24(b)(2)Assessment objective means a set of determination statements that, taken together, expresses the desired outcome for the assessment of a security requirement.
Not Met. One or more applicable objectives for the security requirement is not satisfied.
Take 3.1.1, the first requirement. It reads as one sentence, but 800-171A asks six questions: are authorized users identified, are the processes acting for them identified, are the devices allowed to connect identified, and is access limited to each of the three. A shop with a clean user list and no device list fails 3.1.1, even though most of the work is done. Access control alone carries 70 objectives.
The rule for a Level 2 self-assessment, 32 CFR 170.16(c)(1), says to conduct it “in accordance with NIST SP 800-171A Jun2018” and to score it with the method in 170.24. This page is the first half of that job. Which requirements are in force for your contracts today depends on the clause, so check the status box first. For the requirements one by one in plain English, read CMMC Level 2 requirements.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
How to use the checklist
Your answers stay in this browser and nothing is sent anywhere. Clear the browser or switch computers and they are gone, so keep the CSV as your copy. The checklist opens on an example shop; Reset clears it to a blank sheet.
Worked example: a 25-person machine shop
The checklist opens on an invented shop of 25 people: an office network, a file server, three CAM workstations and two CNC controllers inside the scope. It has done most of the work and it has the gaps a shop that size usually has. Here is where it stands, straight from the tool.
95
9
4
2
| Requirement | Objectives marked | Finding | What the shop found |
|---|---|---|---|
| AC.L2-3.1.12 | 3.1.12[d] Partial | Partial | VPN sessions are logged on the firewall; nobody reviews the log yet. |
| AC.L2-3.1.18 | 3.1.18[c] Not met | Not met | Two phones get email that carries drawings. No device logging. |
| AC.L2-3.1.20 | 3.1.20[c] Partial, 3.1.20[e] Partial | Partial | Home PCs are banned in policy; nothing technical stops a sign-in from one. |
| AT.L2-3.2.3 | 3.2.3[b] Not met | Not met | Annual training has no insider-threat module. |
| AU.L2-3.3.4 | 3.3.4[b] Partial, 3.3.4[c] Not met | Not met | The file server's log volume can fill without anyone being told. |
| AU.L2-3.3.5 | 3.3.5[b] Not met | Not met | Firewall, server and laptop logs are read separately, never correlated. |
| CM.L2-3.4.1 | 3.4.1[e] Partial, 3.4.1[f] Partial | Partial | Inventory misses the two CNC controllers and the shop-floor PC. |
| CM.L2-3.4.8 | 3.4.8[a] Not met, 3.4.8[b] Not met, 3.4.8[c] Not met | Not met | No allowlisting yet. Planned for the three CAM workstations first. |
| IA.L2-3.5.3 | 3.5.3[d] Not met | Not met | MFA on admin accounts and the VPN; office staff reach the file server with a password only. |
| IR.L2-3.6.3 | 3.6.3 Not met | Not met | Incident response plan written in March, never tested. |
| MA.L2-3.7.5 | 3.7.5[a] Not met | Not met | The machine-tool builder's remote support session has no MFA. |
| PE.L2-3.10.6 | 3.10.6[a] N/A, 3.10.6[b] N/A | N/A | No telework: CUI never leaves the building. Stated in the SSP. |
| RA.L2-3.11.2 | 3.11.2[c] Not met, 3.11.2[e] Not met | Not met | Monthly network scan; the ERP and CAM applications are never scanned. |
| SC.L2-3.13.5 | 3.13.5[a] N/A, 3.13.5[b] N/A | N/A | No publicly accessible system in scope: the website is hosted outside the boundary. |
| SC.L2-3.13.11 | 3.13.11 Partial | Partial | BitLocker on every laptop; FIPS mode not yet confirmed on the file server. |
Three things to notice. 3.5.3 is three-quarters done, MFA on admin accounts and the VPN, and still not met, because one objective fails. 3.13.5 is N/A for the reason the rule itself uses as its example: no publicly accessible system inside the scope. And 3.14.6 and 3.14.7 are not answered yet, so the total is not final.
Checklist, score, POA&M: four different questions
A finding is not a score. This page decides, objective by objective, whether each requirement is met. The score takes that list and subtracts points: the maximum Level 2 score is 110, and each requirement not met subtracts its value (1, 3 or 5 points) from 110, which may result in a negative score. The POA&M decides what may stay open for a while, and the SSP is where each answer is written down for the assessor.
| Document | The question | What comes out |
|---|---|---|
| This checklist | Is each objective satisfied? | Met, not met or N/A per requirement, with notes |
| SPRS score calculator | What number goes into SPRS? | 110 minus 1, 3 or 5 points per requirement not met |
| POA&M template builder | Which gaps may wait, and until when? | 1-point gaps (plus 3.13.11 at 3), closed out within 180 days |
| SSP template | How is each requirement done here? | The implementation statement an assessor reads |
The order matters. Without an up-to-date SSP (CA.L2-3.12.4) at the time of assessment, the assessment cannot be completed, so a shop with no SSP should start with the SSP template and come back here. Your notes here become the implementation statements of your system security plan, and the three Awareness and Training rows are worked through for a small shop's staff in CUI training.
Why the objectives come from NIST's PDF, not its spreadsheet
Most free 800-171 spreadsheets start from the CSV file NIST publishes next to SP 800-171A. NIST's own page says the PDF wins: “The PDF of SP 800-171A is the authoritative source of the assessment procedures.” We compared the two line by line on 2026-10-22, and they do not match.
- 31 of the 320 objectives, in 16 requirements, are worded differently in the CSV.
- 3.1.4 (separation of duties): the PDF asks whether responsibilities and access privileges are given to separate individuals; the CSV's [b] and [c] ask different questions.
- 3.1.17 (wireless): the CSV swaps [a] authentication and [b] encryption.
- 3.13.12 (collaborative devices): the CSV leaves the requirement text blank.
Every objective in this checklist is copied from the PDF. One more trap: NIST has withdrawn the June 2018 edition and replaced it with a Rev 3 version, but the CMMC rule names the old one. A self-assessment follows “NIST SP 800-171A Jun2018”, so that is the edition used here. The differences between the two revisions are in CMMC vs NIST SP 800-171.
Where the rule says so
- 32 CFR 170.14(c)(3)Level 2 is the 110 security requirements of NIST SP 800-171 Rev 2.
- 32 CFR 170.4An assessment objective is a set of determination statements; every applicable one must be met.
- 32 CFR 170.16(c)(1)A Level 2 self-assessment follows NIST SP 800-171A Jun2018, is scored by 170.24 and goes into SPRS.
- 32 CFR 170.24(b)Three findings only: Met, Not Met, N/A. An objective assessed as N/A counts as met.
- 32 CFR 170.21(a)(2)Which NOT MET requirements may sit on a POA&M for a Conditional status.
- DFARS 252.204-7012(b)(2)The contract clause that requires NIST SP 800-171 on systems holding covered defense information.
For the families as a reference rather than a worksheet, see the NIST SP 800-171 controls by family. A shop that only holds FCI needs the shorter CMMC Level 1 checklist instead.
Questions small shops ask
Is finishing this checklist the same as a CMMC Level 2 self-assessment?
It is the working half. A Level 2 (Self) assessment is scored with the 32 CFR 170.24 method and entered in SPRS with the level, the date, the scope, your CAGE codes, the score and any POA&M, and a senior official affirms it. This page records the findings; the SPRS score calculator turns them into the number, and how to submit your SPRS score covers the entry.
Should I use NIST SP 800-171 Rev 3 instead?
Not for DoD work today. DoD binds NIST SP 800-171 Rev 2: Part 170 incorporates Rev 2, and the deviated 7012 names ‘Revision 2’. NIST published Rev 3 in May 2024 and marks Rev 2 withdrawn on 2024-05-14. Rev 3 has 97 requirements in 17 families, so a Rev 3 checklist will not line up with what your contract asks for.
Does a partial objective count for anything?
Not in the finding. The rule credits partial implementation only in limited cases, and those live in the score: MFA (IA.L2-3.5.3) costs 3 points if used only for remote and privileged users, 5 if not used at all; encryption (SC.L2-3.13.11) costs 3 points if not FIPS-validated, 5 if absent. The requirement is still NOT MET. Partial here is a note to yourself that the work has started.
When can I mark an objective N/A?
When it does not apply at the time of the assessment, inside your scope. The rule's own example is 3.13.5, separating publicly accessible systems, when there are none in the scope. An N/A objective counts the same as a met one, so write the reason in the notes: an assessor will ask.
How often do I repeat it?
Level 2 (Self), Level 2 (C3PAO) and Level 3 (DIBCAC) assessments are repeated every three years, and the Affirming Official affirms in SPRS after every assessment, after a POA&M closeout, and annually after a Final status. Keep the CSV from each round: the next one starts from it.
Where are my answers kept?
In your browser's local storage on this computer, nowhere else. Nothing is uploaded. Download the CSV or print the worksheet before you clear the browser or change machines.