CMMC 2.0 & NIST SP 800-171 Gap Analysis Checklist | Captiva Solutions

Free resource from Captiva Solutions

CMMC 2.0 & NIST SP 800-171 Gap Analysis Checklist

Find out where you stand before a prime, a contracting officer or an assessor does. Check your program readiness, mark each of the 110 NIST SP 800-171 Rev 2 requirements, and get an estimated SPRS score with a prioritized list of gaps.

Start your gap analysis Why assessments stall

What you’ll get

Know your score, your blockers and what to fix first

A free self-assessment built on the DoD’s official scoring method. No sign-up needed to work through it, and your answers stay in your browser.

Your estimated SPRS score

Updates live as you mark each of the 110 requirements, using the official DoD point values.

Blockers spotted early

See which gaps would stop conditional Level 2 status before an assessor, prime or contracting officer does.

A prioritized fix list

Your gaps ranked by point value, ready to share as a branded PDF report or a CSV spreadsheet.

Where CMMC stands

Last updated: 12 October 2026

Phase 1 is live. Since November 10, 2025, DoD has been adding CMMC requirements to new solicitations and contracts. Most call for a Level 1 or Level 2 self-assessment.
Your results must be in SPRS before award. Contracting officers check the Supplier Performance Risk System (SPRS) before awarding a contract, exercising an option or extending performance. Post your self-assessment score, scope and date there, and have a senior Affirming Official affirm compliance every year. If your status lapses, award and option exercise are withheld. Contracts with DFARS 252.204-7019/-7020 also need a NIST SP 800-171 Basic Assessment score no more than three years old.
Phase 2 is paused. On July 13, 2026 the DoD (Department of War) CIO suspended the planned November 10, 2026 move to mandatory third-party (C3PAO) assessments. A CMMC Reform Task Force delivered its review to the CIO around September 11; the findings have not been published yet.
Self-assessment is the current path. DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026) directs contracting officers to accept Level 1 and Level 2 self-assessments. Until November 9, 2028 the CMMC clause is added case by case; from November 10, 2028 it is added automatically to contracts involving FCI or CUI.
The underlying obligations haven’t moved. DFARS 252.204-7012 still requires all 110 NIST SP 800-171 requirements, DoD can still run its own Medium and High assessments, and primes can still flow stricter requirements down to you.
Rev 2 still governs. NIST published SP 800-171 Rev 3 in May 2024, but DoD assessments and SPRS scoring still use Rev 2, which this checklist follows.

Bottom line: a self-assessed score is a representation to the government. It needs to be accurate and backed by evidence.

This area changes quickly. Check the latest DoD CIO and DFARS guidance before relying on any date above.

Part 1

Program readiness

These items sit around the 110 requirements, and they’re where assessments most often get stuck. Work through one section at a time and tick each statement once it’s true for your organization.

6 common reasons CMMC assessments stall

Each one maps to a part of this checklist. Pick one to jump straight to it.

0 of 25 complete

Part 2

Gap Analysis by Requirement

All 110 NIST SP 800-171 Rev 2 security requirements, which together make up CMMC Level 2. Point values come from the DoD Assessment Methodology. Open one family at a time and mark each requirement.

How to mark: Met every assessment objective is in place and you can show evidence Partial some objectives are in place, not all Not met not implemented N/A genuinely doesn’t apply, and you can justify why

110

Estimated SPRS score
answer items to begin

Met 0 Partial 0 Not met 0 N/A 0 Answered 0/110

Part 3

Your results

Your Level 2 POA&M verdict, Level 1 check and prioritized fix list, updated as you mark requirements above.

Reference

How scoring and POA&Ms work

How is the SPRS score calculated?

You start at 110 and subtract points for each requirement that is not fully implemented: 5 points for requirements whose absence most directly exposes CUI, 3 points for important ones, and 1 point for the rest. The lowest possible score is −203. There is no partial credit, with two exceptions:

Requirement	Not implemented	Partially implemented
3.5.3 Multifactor authentication	−5	−3 if MFA covers remote and privileged access but not all general users
3.13.11 FIPS-validated cryptography	−5	−3 if encryption is used but the modules are not FIPS-validated

In this tool, “Partial” deducts the full value for every other requirement, and “N/A” deducts nothing (you must be able to justify it). 3.12.4, the System Security Plan, has no point value: without an SSP an assessment cannot be completed at all.

Can I still pass with open gaps (POA&M rules)?

For CMMC Level 2, you can reach Conditional status with open items on a Plan of Action and Milestones only if all of these are true:

Your score is at least 88 (80% of 110).
Every open item is a 1-point requirement. The only exception is 3.13.11 when encryption is in place but not FIPS-validated (−3).
None of these are open: 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4 or 3.10.5.
Every open item is closed out within 180 days, or the conditional status expires.

CMMC Level 1 does not allow POA&Ms: all 17 requirements must be fully met.

What’s the difference between Level 1, Level 2 and Level 3?

Level	Protects	Requirements	Assessment
Level 1	FCI	15 FAR 52.204-21 requirements (17 CMMC practices)	Annual self-assessment + affirmation
Level 2	CUI	110 NIST SP 800-171 Rev 2 requirements	Self or C3PAO every 3 years + annual affirmation (new C3PAO mandates currently paused)
Level 3	Higher-priority CUI	Level 2 + 24 selected NIST SP 800-172 requirements	Government (DIBCAC) every 3 years + annual affirmation

Why does “Met” need evidence?

Each requirement breaks down into several assessment objectives in NIST SP 800-171A, and assessors use three methods to check them: examining documents and configurations, interviewing the people responsible, and testing that controls actually work. If any objective fails, the whole requirement is “Not met.” A policy on paper with no matching configuration is a gap.

Key terms

CUI – Controlled Unclassified Information. FCI – Federal Contract Information. SSP – System Security Plan. POA&M – Plan of Action and Milestones. SPRS – Supplier Performance Risk System, where scores and CMMC status are posted. C3PAO – CMMC Third-Party Assessment Organization. ESP – External Service Provider (MSPs, MSSPs, cloud). CRM – Customer Responsibility Matrix. FIPS 140 – the federal standard for validated cryptographic modules.

Found more gaps than you expected?

Captiva Solutions helps defense contractors close them, with CMMC readiness and assessment support, compliance consulting, and hands-on training that builds a compliance-ready team.

Get CMMC Ready Contact Us