CMMC Level 2 Readiness

How ready are you for CMMC Level 2?

Answer 48 practice-level questions across the 14 NIST SP 800-171 security domains. Enter your email to receive an instant scorecard with domain breakdowns and prioritized gaps.

NIST 800-171 aligned

Questions map directly to the 14 CMMC Level 2 security domains and key practices.

Instant gap analysis

See domain-level RAG scores and your top five priority remediation areas.

Results delivered

Provide your email to receive and share the tailored readiness report.

Tell us where to send your results

Enter a business email address so we can deliver your personalized CMMC readiness summary.

Email address

We'll only use this to share your scorecard.

Access Control (AC)

Max 11 pts

Limit system access to authorized users, processes, and devices, and restrict the types of transactions and functions that authorized users are permitted to execute.

Are user accounts configured with least-privilege access aligned to job responsibilities?

4 pts

Yes = full points • No = 0 points.

Yes

Is remote access authorized, monitored, and controlled through encrypted VPN or Zero Trust solutions?

3 pts

Yes = full points • No = 0 points.

Yes

Are session lock and termination controls enforced after defined inactivity periods?

2 pts

Yes = full points • No = 0 points.

Yes

Is wireless access authorized, authenticated, and encrypted using enterprise-grade protocols?

2 pts

Yes = full points • No = 0 points.

Yes

Awareness & Training (AT)

Max 8 pts

Ensure that managers and users of organizational systems are aware of the security risks and are trained to carry out their information security responsibilities.

Do all users receive role-based cybersecurity awareness training upon hire and at least annually?

3 pts

Yes = full points • No = 0 points.

Yes

Is insider-threat awareness training provided to all personnel with access to CUI?

3 pts

Yes = full points • No = 0 points.

Yes

Are simulated phishing exercises conducted regularly with tracked results and remediation?

2 pts

Rate maturity from 1 (ad hoc) to 5 (optimized & automated).

Audit & Accountability (AU)

Max 12 pts

Create, protect, and retain system audit logs and records to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

Configuration Management (CM)

Max 11 pts

Establish and maintain baseline configurations and inventories of organizational systems throughout their system development life cycles.

Identification & Authentication (IA)

Max 9 pts

Identify and authenticate users, devices, and processes as a prerequisite to allowing access to organizational systems.

Is multifactor authentication enforced for all local and network access to privileged and non-privileged accounts?

4 pts

Yes = full points • No = 0 points.

Yes

Are password complexity, length, and rotation requirements enforced consistent with NIST 800-63B guidance?

3 pts

Yes = full points • No = 0 points.

Yes

Are replay-resistant authentication mechanisms used for network access to privileged accounts?

2 pts

Yes = full points • No = 0 points.

Yes

Incident Response (IR)

Max 10 pts

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

Is a documented incident response plan in place that covers CUI-related incidents and is reviewed annually?

4 pts

Yes = full points • No = 0 points.

Yes

Is the incident response plan tested through tabletop exercises or simulations at least annually?

3 pts

Rate maturity from 1 (ad hoc) to 5 (optimized & automated).

Are incidents tracked, documented, and reported to appropriate authorities and stakeholders in a timely manner?

3 pts

Yes = full points • No = 0 points.

Yes

Maintenance (MA)

Max 7 pts

Perform timely maintenance on organizational systems and provide effective controls on maintenance tools, techniques, mechanisms, and personnel.

Is system maintenance performed in a timely manner using documented procedures and controlled tools?

3 pts

Rate maturity from 1 (ad hoc) to 5 (optimized & automated).

Is remote maintenance authorized, logged, and performed using encrypted and authenticated sessions?

2 pts

Yes = full points • No = 0 points.

Yes

Are maintenance-related media (e.g., diagnostic tools) inspected and sanitized before use on production systems?

2 pts

Yes = full points • No = 0 points.

Yes

Media Protection (MP)

Max 10 pts

Protect system media containing CUI, both paper and digital. Control access to, and disposal of, media containing CUI.

Is CUI identified and marked on physical and digital media consistent with organizational procedures?

3 pts

Yes = full points • No = 0 points.

Yes

Is media containing CUI stored in controlled areas with physical access restrictions?

2 pts

Yes = full points • No = 0 points.

Yes

Are media sanitization procedures applied before disposal, release, or reuse of media containing CUI?

3 pts

Yes = full points • No = 0 points.

Yes

Is CUI on portable media encrypted and physically protected during transport?

2 pts

Yes = full points • No = 0 points.

Yes

Personnel Security (PS)

Max 8 pts

Screen individuals prior to authorizing access to systems containing CUI and ensure CUI is protected during and after personnel actions.

Are personnel screened (background checks) prior to being granted access to systems containing CUI?

3 pts

Yes = full points • No = 0 points.

Yes

Are system access and credentials revoked promptly upon personnel termination or role change?

3 pts

Yes = full points • No = 0 points.

Yes

Are access authorizations reviewed and updated during internal personnel transfers?

2 pts

Yes = full points • No = 0 points.

Yes

Physical Protection (PE)

Max 7 pts

Limit physical access to organizational systems, equipment, and operating environments to authorized individuals.

Is physical access to systems and facilities limited to authorized personnel with access logs maintained?

3 pts

Yes = full points • No = 0 points.

Yes

Are visitors escorted, monitored, and activity logged in areas containing CUI?

2 pts

Yes = full points • No = 0 points.

Yes

Are physical access monitoring devices (cameras, alarms) deployed and operational at key entry points?

2 pts

Yes = full points • No = 0 points.

Yes

Risk Assessment (RA)

Max 9 pts

Periodically assess the risk to organizational operations, organizational assets, and individuals resulting from the operation of organizational systems.

Security Assessment (CA)

Max 9 pts

Periodically assess security controls to determine if they are effective in their application and develop and implement plans of action to correct deficiencies.

System & Communications Protection (SC)

Max 13 pts

Monitor, control, and protect communications at the external and key internal boundaries of organizational systems.

Are network boundaries monitored and protected using firewalls, IDS/IPS, and network segmentation?

4 pts

Yes = full points • No = 0 points.

Yes

Is CUI encrypted in transit using FIPS-validated cryptographic mechanisms (e.g., TLS 1.2+)?

4 pts

Yes = full points • No = 0 points.

Yes

Is CUI encrypted at rest on all storage media using FIPS-validated encryption?

3 pts

Yes = full points • No = 0 points.

Yes

Are DNS filtering and network traffic analysis in place to detect and block malicious communications?

2 pts

Yes = full points • No = 0 points.

Yes

System & Information Integrity (SI)

Max 13 pts

Identify, report, and correct system flaws in a timely manner. Protect systems from malicious code and monitor system security alerts.

How scoring works

Each practice is weighted by risk impact aligned to NIST SP 800-171 controls.

Answer every question with either Yes/No or a 1–5 maturity level. Your score automatically updates once you submit the form.

Yes earns the full weight. No earns 0.
Maturity items use (selected level ÷ 5) × weight.
Domain and overall results include a red / amber / green (RAG) status.

Domain weight summary

Access Control (AC)11 pts • 4 questions

Awareness & Training (AT)8 pts • 3 questions

Audit & Accountability (AU)12 pts • 4 questions

Configuration Management (CM)11 pts • 4 questions

Identification & Authentication (IA)9 pts • 3 questions

Incident Response (IR)10 pts • 3 questions

Maintenance (MA)7 pts • 3 questions

Media Protection (MP)10 pts • 4 questions

Personnel Security (PS)8 pts • 3 questions

Physical Protection (PE)7 pts • 3 questions

Risk Assessment (RA)9 pts • 3 questions

Security Assessment (CA)9 pts • 3 questions

System & Communications Protection (SC)13 pts • 4 questions

System & Information Integrity (SI)13 pts • 4 questions

Need help closing gaps?

Our compliance team can walk through your scorecard, build a remediation roadmap, and help you prepare for a CMMC Level 2 assessment.