Insights · Worksheet
CMMC Level 2 self-assessment worksheet
The distance between a self-assessed score and an assessor’s finding is where contractors fail. This worksheet performs the self-assessment the way an assessor would: scope first, evidence for every requirement, no credit without proof.
How to use it
Before the first step.
- Use the revision of NIST SP 800-171 your contract and the CMMC program specify.
- Involve the people who operate the systems, not only the compliance function.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | Identify every place CUI enters, is stored, processed or transmitted, including cloud services and subcontractors. | Compliance lead with IT | CUI flow diagram |
| 02 | Define the assessment scope: the systems, users and locations that handle CUI, and the enclave boundary if one exists. | Compliance lead | Scope document |
| 03 | Confirm cloud services in scope meet the contract’s requirements and document the shared responsibility boundary. | IT lead | Cloud service register |
| 04 | For each requirement, record implementation status: implemented, partially implemented, not implemented, not applicable with justification. | Control owners | Requirement worksheet |
| 05 | For each implemented requirement, attach the evidence an assessor would examine. | Control owners | Evidence references per requirement |
| 06 | For each partial or unimplemented requirement, record the gap and the planned action with a date. | Compliance lead | Plan of action and milestones |
| 07 | Write or update the System Security Plan to describe the environment as it actually is. | Compliance lead with IT | System Security Plan |
| 08 | Score the assessment using the published methodology; do not award credit without evidence. | Compliance lead | Score calculation |
| 09 | Have a second person review a sample of requirements for evidence quality. | Reviewer | Review notes |
| 10 | Submit the score to the Supplier Performance Risk System with the assessment date and scope. | Compliance lead | Submission record |
| 11 | Prioritize remediation by assessment weight and exposure; track to closure. | Compliance lead | Remediation tracker |
| 12 | Schedule the readiness review and, where the contract requires it, the third-party assessment. | Compliance lead | Assessment calendar |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days