CMMC Level 2 Quick-Check
The 10 controls that fail audits most often. One page. Zero cost. Find the gaps before the assessor does.
What you get
- The 10 CMMC Level 2 controls most likely to fail a C3PAO assessment
- One-line plain-English explanation of each control and why it trips up contractors
- A pass/fail self-check column so you know where you stand today
- Direct mapping to NIST SP 800-171 Rev 2 control families
CMMC Level 2 Quick-Check
Score your CMMC readiness right here. Check each control you pass, then download your completed checklist as a PDF.
| Control | NIST | What the assessor looks for | Pass |
|---|---|---|---|
| AC.L2-3.1.3 | 3.1.3 | Control CUI Flow. A documented data-flow diagram showing every system, share, and device where CUI moves. | |
| AC.L2-3.1.5 | 3.1.5 | Least Privilege. Evidence that admin rights and file-share access are reviewed periodically and scoped to need. | |
| AU.L2-3.3.1 | 3.3.1 | System Auditing. Audit logs retained for the period your SSP states, with a documented review cadence and evidence. | |
| AU.L2-3.3.2 | 3.3.2 | User Accountability. Every action on CUI systems traceable to an individual user. No shared logins or generic admins. | |
| CM.L2-3.4.1 | 3.4.1 | System Baselines. A dated baseline configuration for each CUI system — OS version, approved software, enabled services. | |
| CM.L2-3.4.2 | 3.4.2 | Security Config Enforcement. STIG or CIS benchmarks applied via GPO, Intune, or config management — with compliance scan on file. | |
| IA.L2-3.5.3 | 3.5.3 | Multi-Factor Auth. MFA enforced on all network access to CUI systems — including RDP, on-prem apps, and database access. | |
| SC.L2-3.13.1 | 3.13.1 | Boundary Protection. Controls at every point CUI enters or exits the network — inbound and outbound, including USB and cloud sync. | |
| IR.L2-3.6.1 | 3.6.1 | Incident Handling. An IR plan covering CUI-specific scenarios, tested via tabletop exercise, with documented findings. | |
| RA.L2-3.11.1 | 3.11.1 | Risk Assessments. A periodic, environment-specific risk assessment with real threat/vuln analysis and prioritized remediation. |
Already know the gaps? Grab the full CMMC Self-Assessment for $40 or talk to our GRC team.