Overview

The Cybersecurity Maturity Model Certification (CMMC) is a unified standard for implementing cybersecurity across the Defense Industrial Base (DIB). It was developed by the Department of Defense (DoD) to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) that is shared with contractors and subcontractors.

Why CMMC Matters

• Required for DoD Contracts: CMMC certification will be required to bid on and win DoD contracts
• Protects Sensitive Information: Ensures proper safeguards for CUI and FCI
• Standardizes Security: Creates a common framework across all defense contractors
• Third-Party Verification: Level 2+ requires independent assessment

CMMC Levels

CMMC Level 2 Requirements

CMMC Level 2 is required for organizations that handle CUI. It includes:

• All 110 security controls from NIST SP 800-171 Rev 2
• Verification through 320 assessment objectives from NIST SP 800-171A
• Achievement of a minimum SPRS score of 110 (perfect compliance)
• Documentation of any weaknesses through a Plan of Action & Milestones (POA&M)

The Certification Process

NIST SP 800-171 Foundation

CMMC Level 2 is based on the 110 security requirements defined in NIST Special Publication 800-171 Revision 2. These controls are derived from FIPS Publication 200 and represent the minimum security requirements for protecting CUI in nonfederal systems and organizations.

The 14 Control Families

Control Status Options

What Are Assessment Objectives?

Assessment objectives are specific, measurable criteria defined in NIST SP 800-171A that assessors use to verify whether a security control is properly implemented. They break down each of the 110 controls into granular checkpoints that can be objectively evaluated.

Why 320 Objectives?

While there are 110 security controls, many controls have multiple components that need independent verification:

• Simple controls may have 1-2 objectives (e.g., "personnel security screening")
• Complex controls may have 8-12 objectives (e.g., "boundary protection" with multiple technical requirements)
• Each objective is labeled with a letter suffix: [a], [b], [c], etc.
• Total of 320 distinct assessment objectives across all 110 controls

Assessment Methods

Each assessment objective specifies how it should be verified using three methods:

Example: Control 3.1.1

Tracking Objectives in This App

Click the checkboxes next to each assessment objective as you gather evidence and verify compliance. Your objective completion percentage contributes to your Overall Compliance score, which is calculated as the average of your Control Compliance percentage and Assessment Objectives percentage.

Official DoD NIST SP 800-171 Assessment Methodology

The Supplier Performance Risk System (SPRS) score is calculated using the official DoD Assessment Methodology. Unlike a simple 1-point-per-control system, each control has a weighted point value based on its security impact.

• Maximum possible score: 110 points
• Minimum possible score: -203 points
• Controls are weighted: 5, 3, or 1 point based on security impact
• The goal for CMMC Level 2 is a perfect score of 110

Control Point Values

Each of the 110 controls has a designated point value based on potential security impact:

Score Deductions by Status

SPRS Score Requirements

How This Application Calculates Your Score

This application uses the official DoD methodology to calculate your SPRS score:

Documentation Tips

• Be Specific: Provide concrete examples, not generic statements
• Use Screenshots: Visual evidence of configurations and implementations
• Date Everything: Include timestamps on all documentation and evidence
• Link to Policies: Reference your security policies and procedures by name/version
• Keep It Current: Update documentation when systems or processes change
• Organize Systematically: Use this app to keep all evidence in one place

Evidence Collection

Common Pitfalls to Avoid

POA&M Management

Key Terms Glossary

Helpful Resources

Frequently Asked Questions

Quick Actions

Data Management

Need Help?