Free tool · CMMC 2.0 Level 2

CMMC Level 2 Readiness Checklist Calculator

Mark the 10 high-assurance CUI enclave controls, see your self-rated readiness and open items, then download or email your results.

Start the CalculatorBook a 30-Minute Risk Assessment
Your answers stay in this browser.

Nothing is sent anywhere unless you ask us to email your results, and then only your totals and the titles of open controls are sent. Owners, dates and notes are never sent.

CMMC 2.0 LEVEL 2 • NIST 800-171 • DFARS 252.204-7012
110 / 110NIST SP 800-171 Controls Mapped
70% LessC3PAO Audit Scope via CUI Enclave
72-Hour SLADFARS 7012 DoD Cyber Reporting
4 MinutesU.S.-Based 24/7 MDR Isolation

How to use this checklist

  1. 1. Mark a status for each control. Pick In place, Partial, Gap or N/A for each of the 10 controls.
  2. 2. Assign the work. For anything Partial or a Gap, name an owner and a target date.
  3. 3. Note the evidence. Say where the proof lives (policy, screenshot, report, contract), so you can produce it on request. Owners, dates and notes stay in this browser.
  4. 4. Review your results. The results panel counts your answers, works out a self-rated readiness % and lists the open items.
  5. 5. Get a second opinion. Bring the results to a 30-minute risk assessment if you want an outside review.
In place: Implemented today and you can show evidence.Partial: Started, or covers only some users, systems or sites.Gap: Not in place yet.N/A: Does not apply to your firm. Left out of the readiness %.
01. Controlled Unclassified Information (CUI) Enclave Boundary Segmentation

Isolate CUI/ITAR CAD, ERP, and contract files inside a dedicated enclave so 70% of non-CUI commercial endpoints are removed from C3PAO assessment scope.

02. Microsoft 365 GCC High & Azure Government for CUI (DFARS 7012 FedRAMP Moderate)

DFARS 252.204-7012 requires cloud services that hold CUI to meet the FedRAMP Moderate baseline or its equivalent (DoD memo, Dec. 21, 2023). GCC High and Azure Government are FedRAMP High authorized, exceeding that bar, and add screened U.S.-person support for ITAR data.

03. FIPS 140-2 / 140-3 Validated Cryptography Across All CUI Paths (SC.L2-3.13.11)

Enforce FIPS-validated cryptographic modules for BitLocker/FileVault disk encryption, SASE/VPN tunnels, and TLS data in transit. NIST moved all FIPS 140-2 certificates to its Historical List in September 2026; they remain supported for existing systems, so specify FIPS 140-3 validated modules for new deployments.

04. Phishing-Resistant FIDO2 MFA for Privileged & Non-Privileged Enclave Access (IA.L2-3.5.3)

Deploy hardware-bound FIDO2 security keys or Windows Hello for Business across all local, network, and cloud access to CUI repositories.

05. Live 110-Control System Security Plan (SSP) & POA&M Evidence Engine

Maintain a live SSP mapped to all 320 NIST SP 800-171A assessment objectives with automated screenshot/log artifacts and strict 180-day POA&M closeout tracking.

06. Verified SPRS Score Calculation & False Claims Act Defensibility

Ensure your Supplier Performance Risk System (SPRS) score is backed by live technical telemetry rather than aspirational self-attestation.

07. 24/7 U.S.-Citizen SOC Monitoring & 72-Hour DIBNet Incident Reporting

Monitor enclave endpoints and identity logs 24/7 with <4-minute host isolation and forensic packet preservation required for 72-hour DoD DIBNet reporting.

08. CAD / CAM / ERP Engineering Workload Hardening (SolidWorks, AutoCAD, JobBOSS)

Enforce application allowlisting, USB/removable media cryptographic blocks, and high-IOPS segmented VLANs for CNC shop-floor and PDM servers.

09. Sub-24-Hour KEV Remediation & Continuous Vulnerability Scanning (RA.L2-3.11.2/3.11.3)

Emry recommends patching KEV-listed vulnerabilities within 24 hours (CISA's KEV deadlines bind federal civilian agencies only) and exporting monthly authenticated vulnerability scan reports directly into your C3PAO evidence binder.

10. Immutable Air-Gapped CUI Backups (MP.L2-3.8.9) & Quarterly Restoration Testing

Protect the confidentiality of backup CUI (MP.L2-3.8.9) with FIPS-validated encryption and immutable Object-Lock, verified every 90 days via documented test restorations.

Your results and open items

CMMC Level 2 & CUI Enclave Readiness Checklist · Generated . Readiness is your own self-assessment, not a compliance determination.

0In place
0Partial
0Gap
0N/A
0Not yet marked
Readiness (self-rated)
–
Gaps and partials with no owner
0

Readiness = controls marked In place ÷ controls you have marked, excluding N/A. Partial counts as not yet in place.

Open items to close (Gaps first, then Partials)

ControlStatusOwnerTarget

Want a second set of eyes before your C3PAO assessment?

Emry Networks helps small defense suppliers scope a CUI enclave and build NIST SP 800-171 evidence that holds up. Call (603) 202-3200.

EMRY NETWORKS • DEFENSIBLE IT, 24/7 MDR & LIVE COMPLIANCE ENGINEERING
Jacksonville, FL & Manchester, NH Operations Hubs • Serving Regulated SMBs Across All 50 States • (603) 202-3200 • www.emrynetworks.com/contact-us
Book a 30-Minute Risk Assessment

This checklist is an educational self-check, not legal advice, a certification, or a formal assessment. Confirm requirements against the current regulation, your contracts, and your assessor or counsel.

Rules and documents cited in this checklist

Official sources for the rules, standards and documents named in the controls above. Check them for updates before relying on any requirement.

Related Emry Networks resources
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Get audit ready now

Schedule your compliance readiness assessment with our team today.

Book a 30-Minute Risk AssessmentCall (603) 202-3200