Question 1

What is CMMC Level 2?

Accepted Answer

CMMC Level 2 is the tier for defense contractors that store, process, or transmit Controlled Unclassified Information (CUI). It is assessed against the 110 security practices in NIST SP 800-171 Rev 2 and produces an SPRS score on the official DoD Assessment Methodology.

Question 2

How many practices are in CMMC Level 2?

Accepted Answer

There are 110 practices in CMMC Level 2, drawn from NIST SP 800-171 Rev 2. Each practice is assessed met, not met, or not applicable, and the result feeds an SPRS score.

Question 3

How is the SPRS score calculated for Level 2?

Accepted Answer

The SPRS score starts at 110 and subtracts points for gaps. Scores can run down into the negatives, with a floor of -203; a negative score is normal for an early assessment, not an error. Partial credit applies only where the methodology allows it (multi-factor authentication and FIPS-validated encryption).

Question 4

Does CMMCTrack certify my Level 2 compliance?

Accepted Answer

No. CMMCTrack helps you complete a defensible Level 2 self-assessment, POA&M, and System Security Plan. It does not certify you. Only a Certified Third-Party Assessment Organization (C3PAO) can perform the official Level 2 certification assessment.

Question 5

How much does the Level 2 self-assessment cost?

Accepted Answer

The CMMCTrack Level 2 self-assessment is $199 one-time for a single company, with no subscription. It includes the full 110-practice assessment, evidence library, AI-drafted POA&M and SSP, DoD-methodology SPRS scoring, exports, and re-scoring after remediation.