I am not sure whether we handle CUI
Review the information you receive and create, its markings and customer instructions. Use the free identification log to record questions to take to your customer.
Start with CUI identification →For contractors already handling CUI
Free CMMC Level 2 gap review worksheet
New here? Choose where to start →
What do you already have in place, and what still needs work? Use this free Excel workbook to review the 110 requirements of NIST SP 800-171 Revision 2 and the 320 assessment objectives in the Level 2 guides. For each objective, record where the evidence is, what needs checking, and who will follow up. The workbook helps you organize an internal review; it does not give you an official assessment result.
You do not need an account, and there is nothing to upload. Read the example with sample data below, then save and edit your copy in a location your organization has approved.
Your completed workbook can reveal security gaps. Keep it in an approved restricted location. Do not upload CUI, contracts or evidence to this site; use references to records kept in your own environment.
Where should I start?
We handle CUI and want to review our gaps
Save the main Excel workbook in an approved restricted location. Define which systems and providers you are reviewing, then work through the objectives and assign follow-up actions.
See how to use the main workbook →I need help with a particular requirement
Choose a domain guide for practical steps, checks and supporting templates. Use the instructions that match your cloud, devices and identity setup.
Find the guide for your task →Put the requirements into practice
Using Microsoft 365 or Azure Virtual Desktop?
The implementation guides cover all 14 domains, with separate instructions for commercial and government clouds and for AD DS, hybrid joined and Entra joined hosts. Start with the instructions for your environment; a guide cannot determine whether a service is suitable for your CUI.
The main workbook records your overall review. Use the domain workbooks and Word materials for individual tasks, such as maintaining an access register or planning training. Keep the evidence in its approved location and refer to it in your records. Filling in a template does not establish that a control works.
Explore the implementation guides →Browse the 14 domains
Choose the subject you need help with. Each guide explains the requirements and checks, with free Word and Excel materials for the work.
Keep your CUI and evidence in your own approved environment
Do not upload CUI, contracts, credentials, network diagrams, completed workbooks, or security evidence to this site. In the workbook, record a reference that tells authorized colleagues where to find the evidence. Keep the evidence in its approved location. Your completed workbook can reveal security gaps, so protect it under your organization's rules. Check where you save and edit it: a synced folder or online editor may send a copy to its provider.
Source status checked October 21, 2026
Check the contract and current program status first
The Defense Department announced a pause in the CMMC Phase II rollout. Contractors still have to meet the Phase I self-assessment requirements and their existing duties to protect covered defense information under DFARS 252.204-7012. Read the department's current CMMC status.
Read your solicitation and contract, including requirements your customer passes down through a subcontract. Those documents tell you what your organization must do. If you cannot tell whether information is CUI or which assessment is required, ask the government office responsible for the contract or the person or agency that supplied the information. This worksheet cannot make those decisions or replace a required assessment.
This workbook uses NIST SP 800-171 Revision 2 and the June 2018 SP 800-171A assessment objectives, as used in the current Level 2 materials. NIST has also published Revision 3. Check which version your contract and the program require before using this workbook.
What the pause changes: CUI Enforcement & Lessons Learned →Decide which systems to review, then work through the objectives
First, work out which devices, systems, and services belong in your assessment. This is your assessment boundary. Use the official Level 2 Scoping Guide to sort them into the right asset categories, including assets that handle CUI and assets that provide security protection. Include outside providers and record which responsibilities belong to your organization and which belong to the provider. Keep the asset inventory and network diagram consistent with that boundary. Check the system security plan too: it describes the system and its protections. The workbook gives you a place to record these decisions; it cannot decide the boundary for you.
1. List the systems and services
For each asset or provider included in the review, write down what it does, whether it handles CUI or security protection data, and who is responsible for it.
2. Review one objective at a time
Read one objective in the official assessment guide. Write down what you know, where you can find the supporting evidence, and what someone still needs to check.
3. Assign the work
Put unfinished work in the Action list and assign someone to follow up. Adding a task here does not create a formal CMMC plan of action or decide whether a gap is allowed under the program rules.
Made-up example with sample data. No tenant or sign-ins were tested.
Does MFA cover every administrator sign-in?
Imagine a small contractor that uses Microsoft 365 and Windows. For this example, assume it has already confirmed that its tenant is suitable for the contract, included it in the assessment, and listed the ways administrators can sign in. A basic commercial license or free cloud service does not establish suitability for CUI. The team is reviewing objective 3.5.3[c], multifactor authentication for network access to privileged accounts. It will review objective 3.5.3[b], local access to privileged accounts, separately.
- Before checking MFA
- List every administrator account and network sign-in route included in the assessment. Check the tenant's licenses, whether the provider meets the contract's requirements, and which protections each party must supply. Confirm which MFA controls are available and how authorized staff would regain access in an emergency.
- What the team knows so far
- An MFA policy names two administrators. The team has not yet checked the other administrators, exceptions, older sign-in methods, or sign-in records. Seeing the policy does not prove that each sign-in required and completed MFA.
- What to write in the workbook
- Set 3.5.3[c] to Evidence to check. Name the person in IT who will follow up. Add a reference such as MFA-01 to the evidence in its restricted location, list the accounts still to review, and add a task to test each approved sign-in route.
- How to check and recover
- Get authorization to test the relevant sign-ins, then inspect the records and write down any exceptions. If a change blocks access, use the approved emergency-access procedure and contact vendor support as needed. Record any reversal of the change or exception before testing again.
Start with the account list and the settings already in your tenant. Your license and provider arrangement determine which controls and records you can use. This sample entry does not establish compliance with objective 3.5.3[c], the full 3.5.3 requirement, or CMMC Level 2. Read each objective that applies to your system in the official Level 2 Assessment Guide and gather the evidence it calls for.
For help getting started, read the guides to multi-factor authentication, administrator access, and asset and service inventory. Reading a guide helps you plan the work; you still need evidence from your own systems.
Download and work locally
The free Excel workbook has sheets for getting started, listing the assessment boundary, reviewing objectives, assigning follow-up work, reading an example with sample data, and finding sources. Open it in your organization's existing Microsoft Office tools. Save your own copy in an approved restricted location and record where to find evidence without copying sensitive contents into the file.
Download the Excel workbook ↓The statuses you enter describe your internal review. They do not give you official MET findings, a SPRS score, or certification. The action list is not automatically an eligible CMMC plan of action and milestones (POA&M). Use the applicable program and contract rules to review formal findings and any proposed POA&M.
Have a CMMC or worksheet question?
Tell us which part of the worksheet is confusing, ask a general CMMC question, or suggest a topic you would like explained.
Email cmmc@purposefulsecurity.com with a general description of the question. Please do not send CUI, contracts, network diagrams, security evidence, or completed worksheets.
These resources help explain the work. They cannot approve which systems belong in your assessment or determine whether you comply.
Use the official material alongside the worksheet
- Current CMMC status and program overview
Read the Defense Department's guidance and check for changes since October 21, 2026.
- CMMC Level 2 Scoping Guide, version 2.13
Use this to decide which assets and providers belong in the assessment and how to categorize them.
- CMMC Level 2 Assessment Guide, version 2.13
Read what each objective asks you to demonstrate and how an assessor can check it.
- NIST SP 800-171 Revision 2 source
The 110 security requirements used for this workbook.
- NIST SP 800-171A, June 2018
The procedures used to assess the objectives in this workbook.
- Project Spectrum free resources
Find free training and readiness checks. Project Spectrum requires registration to use its tools.
Found an error or a changed source? Send a correction. Do not attach CUI, contract records, evidence, or a completed workbook.