CMMC Level 2 Assessments (Pro)

The Compliance tab can score a CMMC Level 2 self-assessment against NIST 800-171 Rev 2, using the DoD Assessment Methodology point weights.

Beta: treat the score as an estimate. While this feature is in beta, the bundled point weights and the resulting SPRS score are advisory and pending validation. Confirm any score against the official DoD NIST SP 800-171 Assessment Methodology before relying on it for an assessment submission or a contractual purpose.

Recording results#

Record a result for each of the 110 requirements:

• Met
• Not met
• Not applicable
• Planned (on POA&M)

Partial credit#

A few requirements have a documented partial condition that the methodology scores at a reduced deduction rather than the full weight. Where one exists, the Partial Credit column lets you record it, and the requirement deducts the reduced points instead. 3.13.11 is the example: encryption employed, but not FIPS-validated, deducts 3 instead of 5.

Requirements with no documented partial condition always deduct their full weight.

Posture evidence#

Four configuration management requirements (3.4.1, 3.4.2, 3.4.6 and 3.4.7) have an Evidence button in the requirements table. It shows what the Asset’s posture scans found in the 90 days up to the assessment date (or up to today, while the date is unset or still ahead): which posture scan types ran, how many failed checks are still open by severity, how many were risk accepted, and the hosts with open failed checks. The scan types that count are the ones set on the Compliance Profile, or the default posture scan types without one.

The evidence is computed each time the page opens and never sets a result. You still record Met or Not met, and the SPRS score follows the result you record. With no posture scan in that window, the evidence says there is nothing to show.

Automation can read the same evidence from GET /api/v2/cmmc_assessments/{id}/posture_evidence/.

What the assessment computes#

SPRS score#

110 minus the deduction for every requirement that is not met or merely planned. Weights are 1, 3, or 5 points, so scores range from 110 down to -203.

Requirement 3.12.4 (the System Security Plan requirement) scores as not applicable, per the methodology.

Whether a conditional status is possible#

CMMC allows conditional certification at a score of at least 88 (80 percent) with every open gap eligible for a POA&M.

The methodology bars certain requirements from POA&Ms entirely. Among requirements weighted above one point, only 3.13.11 (FIPS-validated cryptography) can be deferred.

The closeout clock#

A conditional assessment has 180 days to close its POA&M items. The assessment flips to expired if the clock lapses.

Statuses#

Statuses move from in progress to conditional or final. Conditional assessments show the days remaining on their closeout clock.

Assessments are under audit history: every change records who, what, and when.