CMMC 2.0 & NIST SP 800-171 Gap Analysis Checklist | Captiva Solutions
Free resource from Captiva Solutions

CMMC 2.0 & NIST SP 800-171 Gap Analysis Checklist

Find out where you stand before a prime, a contracting officer or an assessor does. Check your program readiness, mark each of the 110 NIST SP 800-171 Rev 2 requirements, and get an estimated SPRS score with a prioritized list of gaps.

Start your gap analysis Why assessments stall

What you’ll get

Know your score, your blockers and what to fix first

A free self-assessment built on the DoD’s official scoring method. No account needed: your answers are saved only in this browser on this device. Contact details are requested only to unlock the detailed results and the branded report.

Your estimated SPRS score

Updates live as you mark each of the 110 requirements, using the official DoD point values.

Blockers spotted early

See which gaps would stop conditional Level 2 status before an assessor, prime or contracting officer does.

A prioritized fix list

Your gaps ranked by priority, with the evidence to prepare, ready to share as a branded PDF report or a CSV spreadsheet.

Who it’s for: defense contractors and subcontractors that handle Federal Contract Information (FCI, Level 1) or Controlled Unclassified Information (CUI, Level 2). What it isn’t: it estimates readiness from your own answers. It doesn’t verify evidence, submit anything to SPRS or establish your CMMC status.

Latest CMMC updateWhere CMMC standsLast updated: 12 October 2026 Read the updateHide
  • Phase 1 is live. Since November 10, 2025, DoD has been adding CMMC requirements to new solicitations and contracts. Most call for a Level 1 or Level 2 self-assessment.
  • Your results must be in SPRS before award. Contracting officers check the Supplier Performance Risk System (SPRS) before awarding a contract, exercising an option or extending performance. Post your self-assessment score, scope and date there, and have a senior Affirming Official affirm compliance every year. If your status lapses, award and option exercise are withheld. Contracts with DFARS 252.204-7019/-7020 also need a NIST SP 800-171 Basic Assessment score no more than three years old.
  • Phase 2 is paused. On July 13, 2026 the DoD (Department of War) CIO suspended the planned November 10, 2026 move to mandatory third-party (C3PAO) assessments. A CMMC Reform Task Force delivered its review to the CIO around September 11; the findings have not been published yet.
  • Self-assessment is the current path. DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026) directs contracting officers to accept Level 1 and Level 2 self-assessments. Until November 9, 2028 the CMMC clause is added case by case; from November 10, 2028 it is added automatically to contracts involving FCI or CUI.
  • The underlying obligations haven’t moved. DFARS 252.204-7012 still requires all 110 NIST SP 800-171 requirements, DoD can still run its own Medium and High assessments, and primes can still flow stricter requirements down to you.
  • Rev 2 still governs. NIST published SP 800-171 Rev 3 in May 2024, but DoD assessments and SPRS scoring still use Rev 2, which this checklist follows.

Bottom line: a self-assessed score is a representation to the government. It needs to be accurate and backed by evidence.

This area changes quickly. Check the latest DoD CIO and DFARS guidance before relying on any date above.

Part 1

Program readiness

These items sit around the 110 requirements, and they’re where assessments most often get stuck. Work through one section at a time and tick each statement once it’s true for your organization.

6 common reasons CMMC assessments stall

Each one maps to a part of this checklist. Pick one to jump straight to it.

ShowHide
0 of 25 checklist items ticked

Part 2

Gap Analysis by Requirement

All 110 NIST SP 800-171 Rev 2 security requirements, which together make up CMMC Level 2. Point values come from the DoD Assessment Methodology. Open one family at a time and mark each requirement.

Assessing for: Not sure which level you need?
How to mark: Met: every assessment objective is in place and you can show evidence. Partial: some objectives are missing. A planning label only; a formal assessment scores this as Not Met. Not met: not implemented yet. N/A: genuinely doesn’t apply; add a written justification. Unsure: you don’t know yet; counted as not met until resolved.

Your answers save automatically in this browser on this device. Nothing you mark here is sent anywhere.

110
Estimated SPRS score
answer items to begin
Met: 0 Partial: 0 Not met: 0 N/A: 0 Unsure: 0 Answered: 0/110

Part 3

Your results

Your preliminary conditional-status check, Level 1 check and prioritized fix list, updated as you mark requirements above. Every result is based on your answers only.

Reference

How scoring and POA&Ms work

How is the SPRS score calculated?

You start at 110 and subtract points for each requirement that is not fully implemented: 5 points for requirements whose absence most directly exposes CUI, 3 points for important ones, and 1 point for the rest. The lowest possible score is −203. There is no partial credit, with two exceptions:

RequirementNot implementedPartially implemented
3.5.3 Multifactor authentication−5−3 if MFA covers remote and privileged access but not all general users
3.13.11 FIPS-validated cryptography−5−3 if encryption is used but the modules are not FIPS-validated

A formal assessment records each requirement as Met, Not Met or N/A. In this tool, “Partial” is a planning label and deducts the full value, like Not Met. For 3.5.3 and 3.13.11, choosing Partial asks a follow-up question so the reduced deduction is applied only when it genuinely fits. “Unsure” deducts the full value until you resolve it. “N/A” deducts nothing but needs a written justification. 3.12.4, the System Security Plan, has no point value: without a current SSP an assessment cannot be completed at all.

Until every requirement is answered, the score is provisional: unanswered requirements are not scored, so the number can only go down as you answer more.

Can I still pass with open gaps (POA&M rules)?

For CMMC Level 2, you can reach Conditional status with open items on a Plan of Action and Milestones only if all of these are true:

  • Your score is at least 88 (80% of 110).
  • Every open item is a 1-point requirement. The only exception is 3.13.11 when encryption is in place but not FIPS-validated (−3).
  • None of these are open: 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4 or 3.10.5.
  • Every open item is closed out, and the closeout assessed, within 180 days of the Conditional CMMC Status Date; otherwise the conditional status expires.

This conditional-status POA&M is different from your own internal remediation plan, which can include anything. CMMC Level 1 does not allow POA&Ms: all 15 requirements must be fully met.

What’s the difference between Level 1, Level 2 and Level 3?
LevelProtectsRequirementsAssessment
Level 1FCI15 safeguarding requirements in FAR 52.204-21 (this tool shows them as the 17 NIST SP 800-171 rows they map to)Annual self-assessment + affirmation; no POA&M allowed
Level 2CUI110 NIST SP 800-171 Rev 2 requirementsSelf or C3PAO every 3 years + annual affirmation (new C3PAO mandates currently paused)
Level 3Higher-priority CUILevel 2 + 24 selected NIST SP 800-172 requirementsGovernment (DIBCAC) every 3 years + annual affirmation

Which level do I need? If your contracts include DFARS 252.204-7012, or you receive information marked CUI, plan for Level 2. If you only handle FCI (contract information not meant for public release) under FAR 52.204-21, Level 1 applies. Your contract and any prime flow-downs decide; if you’re unsure, ask your contracting officer or prime, or contact us.

Why does “Met” need evidence?

Each requirement breaks down into several assessment objectives in NIST SP 800-171A, and assessors use three methods to check them: examining documents and configurations, interviewing the people responsible, and testing that controls actually work. If any objective fails, the whole requirement is “Not met.” A policy on paper with no matching configuration is a gap.

Key terms

CUI – Controlled Unclassified Information. FCI – Federal Contract Information. SSP – System Security Plan. POA&M – Plan of Action and Milestones. SPRS – Supplier Performance Risk System, where scores and CMMC status are posted. C3PAO – CMMC Third-Party Assessment Organization. ESP – External Service Provider (MSPs, MSSPs, cloud). CRM – Customer Responsibility Matrix. FIPS 140 – the federal standard for validated cryptographic modules.

Found more gaps than you expected?

Captiva Solutions helps defense contractors close them, with CMMC readiness and assessment support, compliance consulting, and hands-on training that builds a compliance-ready team.

Get CMMC Ready Contact Us

Disclaimer: This checklist is a self-assessment aid, not legal advice or an official DoD assessment. Requirement summaries are plain-language paraphrases; always assess against NIST SP 800-171 Rev 2, NIST SP 800-171A and the CMMC Assessment Guides. Your contract and any prime flow-downs determine your actual obligations.

Rules last reviewed: 14 October 2026. Baseline: NIST SP 800-171 Rev 2 (110 requirements) with SP 800-171A assessment objectives (June 2018).

Primary sources: NIST SP 800-171 Rev 2 and SP 800-171A (csrc.nist.gov) · FAR 52.204-21 · NIST SP 800-171 DoD Assessment Methodology · 32 CFR Part 170 · DFARS 252.204-7012, -7019, -7020, -7021 · DoD CIO CMMC resources (dodcio.defense.gov/CMMC) · DFARS Class Deviation 2026-O0025, Revision 3.

Scroll to Top