What is CMMC Level 2?

CMMC Level 2 is the certification tier for organizations that store, process, or transmit Controlled Unclassified Information (CUI). It requires implementation of all 110 security requirements defined in NIST SP 800-171, and most organizations must pass a third-party assessment conducted by an accredited C3PAO.

Do I need a C3PAO assessment for CMMC Level 2?

Most organizations handling CUI under CMMC Level 2 require a third-party assessment by an accredited C3PAO. A smaller subset of contracts, generally those involving less critical information, may qualify for annual self-assessment instead. Your contract requirements determine which path applies.

How many controls are in CMMC Level 2?

CMMC Level 2 requires implementation of all 110 security requirements from NIST SP 800-171, organized across 14 control families covering access control, audit and accountability, configuration management, incident response, system integrity, and more.

What format is the CMMC Level 2 Control List in?

The list is a Microsoft Excel (.xlsx) file that is also compatible with Google Sheets. It lists all 110 NIST SP 800-171 requirements with columns for implementation status and notes.

Can I have open items on a POA&M for CMMC Level 2?

A limited number of requirements can remain open on a Plan of Action & Milestones (POA&M) with a defined closeout timeline, typically within 180 days. Most requirements must be fully implemented at the time of assessment.

Download CMMC Level 2 Control List

What Is the CMMC Level 2 Control List?

CMMC Level 2 applies to organizations that store, process, or transmit Controlled Unclassified Information (CUI). It is built directly on NIST SP 800-171, requiring implementation of all 110 security requirements across 14 control families, from access control and audit logging to incident response and system integrity.

Unlike CMMC Level 1, which is satisfied through an annual self-assessment, most organizations at Level 2 must pass a third-party assessment conducted by a C3PAO accredited under the DoD CIO’s CMMC program. A smaller subset of contracts allow self-assessment, but every organization still submits a score to the Supplier Performance Risk System (SPRS).

The CMMC Level 2 Control List is a spreadsheet that lists all 110 requirements in one place so you can track implementation status, assign owners, and identify gaps before an assessor does.

What’s Included in the Spreadsheet

All 110 NIST SP 800-171 security requirements, organized by control family (Access Control, Awareness & Training, Audit & Accountability, Configuration Management, Identification & Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System & Communications Protection, System & Information Integrity)
Plain-language descriptions of what each requirement calls for
An implementation status column to mark each control as implemented, partially implemented, or not implemented
A notes column to record how each control is met, who owns it, and where supporting evidence lives

Who Should Use This Spreadsheet

This list is built for organizations that:

Store, process, or transmit CUI, and therefore fall under CMMC Level 2 rather than Level 1
Are preparing for a C3PAO assessment or an eligible self-assessment
Need a working record of control implementation to support their System Security Plan (SSP) and Plan of Action & Milestones (POA&M)
Want a single source of truth before submitting or updating their SPRS score

Download the CMMC Level 2 Control List

Download Spreadsheet

Using the List to Prepare for Your C3PAO Assessment

Work through the list control by control:

Mark each requirement’s current implementation status
Note how the control is met and where supporting evidence lives, referencing the same language used in your SSP
Assign an owner for any requirement that is partially implemented or not yet implemented, and track it in your POA&M
Revisit the list ahead of your C3PAO assessment or self-assessment renewal to confirm nothing has drifted since the last review

Unlike Level 1, most Level 2 gaps can only remain open on a POA&M temporarily. Assessors expect a closeout plan with real dates, not indefinite “in progress” statuses. For a step-by-step view of the full certification path, see our CMMC compliance checklist.

How Espresso Labs Can Help

Tracking 110 requirements in a spreadsheet is a starting point, not a compliance program. Implementing, evidencing, and maintaining every control through a C3PAO assessment, and keeping it that way afterward, is where most organizations need support. Espresso Labs delivers CMMC Level 2 as a managed service: implementing the required safeguards, building and maintaining your SSP and POA&M, and standing behind your environment through assessment and beyond.

Espresso Labs also provides a GRC dashboard preloaded with reference template controls. From there, Espresso’s AI agents implement most technical controls playbook by playbook on your behalf, handling enforcement, monitoring, remediation, and evidence collection so your team doesn’t have to.

Schedule a Demo