How do I know if I need the Level 1 or Level 2 checklist?

Check your contract's clauses section. FAR 52.204-21 alone means you handle Federal Contract Information and Level 1 applies; DFARS 252.204-7012 means CUI is involved and Level 2 applies. When the clauses are unclear, ask your contracting officer before investing effort at the wrong level.

What is the DoD Assessment Methodology?

It is the DoD's official scoring guide for NIST SP 800-171, formally the NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1. It defines the weighted point values behind the SPRS score and three assessment confidence levels: Basic (self-assessment), Medium (government-led), and High. It applies to Level 2, not Level 1.

What do I do with gaps after completing the checklist?

It depends on your level. Level 1 gaps must be closed before you affirm compliance; there is no deferral mechanism at Level 1. Level 2 gaps go into a POA&M documenting the weakness, the fix, the owner, the cost, and the target date. An honest gap list is expected, not a failure.

Where do CMMC Level 2 organizations most commonly have gaps?

The recurring problem areas are multi-factor authentication coverage, formal change control and configuration management, encryption of CUI in transit and at rest, audit logging that is actually retained and reviewed, vulnerability scanning with risk-based remediation, and password policy requirements such as complexity and reuse restrictions.

CMMC Compliance Checklist 2026: Level 1 and 2

body{font-family:'Inter',sans-serif;max-width:800px;margin:40px auto;padding:0 20px;line-height:1.6}CMMC Compliance Checklist 2026: Level 1 and 2Work through all 15 CMMC Level 1 practices and the most common Level 2 gap areas with plain-language descriptions and actionable steps for each.Supports Level 1 (15 practices, FAR 52.204-21) and Level 2 (110 practices, NIST SP 800-171).Please enable JavaScript to use CMMCTrack.