CMMC 2.0 & NIST SP 800-171 Gap Analysis Checklist

Find out where you stand before a prime, a contracting officer or an assessor does. Work through program readiness first, then mark each of the 110 NIST SP 800-171 Rev 2 requirements to get an estimated SPRS score and a prioritized list of gaps.

110 requirements · 14 families
CMMC Level 1 & Level 2
SPRS score estimator
POA&M eligibility check
Updated October 2026

Confirm scope

Know which contracts carry CUI or FCI and which systems, people and providers touch it. Everything else depends on this.

Mark every requirement

Be strict: a requirement is Met only if every assessment objective is in place and you can show evidence.

Plan remediation

Fix the high-point gaps first, record the rest in a POA&M, and export your results to share with your team.

Where CMMC stands — October 2026

The rules are in force. The CMMC Program rule (32 CFR Part 170) took effect in December 2024, and the DFARS acquisition rule began Phase 1 on November 10, 2025.
Phase 2 is paused. On July 13, 2026 the DoD (Department of War) CIO suspended the planned November 10, 2026 move to mandatory third-party (C3PAO) assessments and set up a CMMC Reform Task Force to review the program.
Self-assessment is the current path. DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026) lets contracts require CMMC Level 1 or Level 2 self-assessments. Until November 9, 2028 the CMMC clause is added case by case; from November 10, 2028 it is added automatically to contracts involving FCI or CUI.
The underlying obligations haven’t moved. DFARS 252.204-7012 still requires all 110 NIST SP 800-171 requirements, DoD can still run its own Medium and High assessments, and primes can still flow stricter requirements down to you.
Rev 2 still governs. NIST published SP 800-171 Rev 3 in May 2024, but DoD assessments and SPRS scoring continue to use Rev 2, which is what this checklist follows.

Bottom line: a self-assessed score is a representation to the government. It needs to be accurate and backed by evidence.

This area is changing quickly. Check the latest DoD CIO and DFARS guidance before relying on any date above.

Part 1

Program readiness

These items sit around the 110 requirements. Gaps here are the most common reason assessments stall.

Part 2

Requirement-by-requirement gap analysis

All 110 NIST SP 800-171 Rev 2 security requirements, which together make up CMMC Level 2. Point values come from the DoD Assessment Methodology. Your answers are saved in this browser only.

110

Estimated SPRS score
answer items to begin

Met 0 Partial 0 Not met 0 N/A 0 Answered 0/110

Part 3

Your results

Updates as you mark requirements above.

Level 2 conditional status check

Level 1 (FCI) check

Fix these first

Reference

How scoring and POA&Ms work

How is the SPRS score calculated?

You start at 110 and subtract points for each requirement that is not fully implemented: 5 points for requirements whose absence most directly exposes CUI, 3 points for important ones, and 1 point for the rest. The lowest possible score is −203. There is no partial credit, with two exceptions:

Requirement	Not implemented	Partially implemented
3.5.3 Multifactor authentication	−5	−3 if MFA covers remote and privileged access but not all general users
3.13.11 FIPS-validated cryptography	−5	−3 if encryption is used but the modules are not FIPS-validated

In this tool, “Partial” deducts the full value for every other requirement, and “N/A” deducts nothing (you must be able to justify it). 3.12.4, the System Security Plan, has no point value: without an SSP an assessment cannot be completed at all.

Can I still pass with open gaps (POA&M rules)?

For CMMC Level 2, you can reach Conditional status with open items on a Plan of Action and Milestones only if all of these are true:

Your score is at least 88 (80% of 110).
Every open item is a 1-point requirement. The only exception is 3.13.11 when encryption is in place but not FIPS-validated (−3).
None of these are open: 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4 or 3.10.5.
Every open item is closed out within 180 days, or the conditional status expires.

CMMC Level 1 does not allow POA&Ms: all 17 requirements must be fully met.

What’s the difference between Level 1, Level 2 and Level 3?

Level	Protects	Requirements	Assessment
Level 1	FCI	15 FAR 52.204-21 requirements (17 CMMC practices)	Annual self-assessment + affirmation
Level 2	CUI	110 NIST SP 800-171 Rev 2 requirements	Self or C3PAO every 3 years + annual affirmation (C3PAO currently paused for new mandates)
Level 3	Higher-priority CUI	Level 2 + 24 selected NIST SP 800-172 requirements	Government (DIBCAC) every 3 years + annual affirmation

Why does “Met” need evidence?

Each requirement breaks down into several assessment objectives in NIST SP 800-171A, and assessors use three methods to check them: examining documents and configurations, interviewing the people responsible, and testing that controls actually work. If any objective fails, the whole requirement is “Not met.” A policy on paper with no matching configuration is a gap.

Key terms

CUI – Controlled Unclassified Information. FCI – Federal Contract Information. SSP – System Security Plan. POA&M – Plan of Action and Milestones. SPRS – Supplier Performance Risk System, where scores and CMMC status are posted. C3PAO – CMMC Third-Party Assessment Organization. ESP – External Service Provider (MSPs, MSSPs, cloud). CRM – Customer Responsibility Matrix. FIPS 140 – the federal standard for validated cryptographic modules.

Found more gaps than you expected?

Captiva Solutions helps defense contractors close them, with CMMC readiness and assessment support, compliance consulting, and hands-on training that builds a compliance-ready team.

Get CMMC Ready Contact Us