The 110 requirements in one table
Every CMMC Level 2 assessment covers the same 110 security requirements from NIST SP 800-171 Rev. 2. They are not weighted equally: 44 are worth 5 points, 14 are worth 3, 51 are worth 1, and one (3.12.4, the system security plan) carries no score but is required for an assessment to proceed.
| Family | Requirements | Points | What it covers |
|---|---|---|---|
| AC Access Control | 22 | 54 | Who gets in, from where, and what they can touch |
| AT Awareness & Training | 3 | 11 | Security training and insider-threat awareness |
| AU Audit & Accountability | 9 | 19 | Logging, review, retention and audit protection |
| CM Configuration Management | 9 | 33 | Baselines, change control, least functionality |
| IA Identification & Authentication | 11 | 27 | Identity, MFA, password handling |
| IR Incident Response | 3 | 11 | Handling, tracking and testing incident response |
| MA Maintenance | 6 | 18 | Tools, personnel and media used in maintenance |
| MP Media Protection | 9 | 23 | CUI on paper, removable media and backups |
| PS Personnel Security | 2 | 8 | Screening and handling of personnel changes |
| PE Physical Protection | 6 | 14 | Facility access, visitors, alternate work sites |
| RA Risk Assessment | 3 | 9 | Risk assessment, scanning, remediation |
| CA Security Assessment | 4 | 13 | Control assessment, POA&M, continuous monitoring |
| SC System & Comms Protection | 16 | 42 | Boundaries, encryption, network architecture |
| SI System & Information Integrity | 7 | 31 | Flaw remediation, malware defence, monitoring |
Points are the SPRS weight. Total: 313 points across 110 requirements, which is why the score runs from 110 down to -203.
Where contractors lose the most points fastest
If you are starting from nothing, the order you fix things in matters. These are the requirements that cost the most when they are missing:
| Requirement | Points | Why it is usually missing |
|---|---|---|
| 3.5.3 Multifactor authentication | 5 | MFA is on email but not on VPN, admin consoles or cloud apps |
| 3.13.11 FIPS-validated cryptography | 5 | Encryption is on, but not with a FIPS-validated module |
| 3.12.4 System security plan | 0 | Everyone postpones it; without an SSP the assessment cannot proceed |
| 3.12.1 / 3.12.3 Assess & monitor controls | 10 | Treated as an annual paperwork exercise rather than a process |
| 3.3.1 / 3.3.5 Audit logs & review | 10 | Logs are collected but never reviewed or retained to spec |
Score yourself against all 110 in about 15 minutes
The calculator walks the same 110 requirements, applies the real weights, and shows you the point gap by family.
Open the SPRS calculatorHow to use this checklist
- Scope first. Decide what is in scope: which systems, which people, where CUI actually lives. Requirements that fall outside scope are not automatically N/A, but scoping decides what you have to evidence.
- Work family by family. AC and SC carry 96 of the 313 points between them. If you fix anything first, fix those.
- Write the SSP as you go. 3.12.4 is worth zero points but stops the assessment dead if it is missing. Do not leave it to the end.
- Separate "met" from "documented". A control you have implemented but cannot evidence will not survive a C3PAO assessment.
- Record gaps in a POA&M. Every unmet requirement needs an owner, a date and a cost estimate — that is what an assessor reads first.
Related: CMMC Level 2 assessment guide · How to run a self-assessment · Software that tracks the 110