The CMMC Level 2 controls, tracked properly

All 110 NIST SP 800-171 controls, the 14 families they fall in, and the exact columns a real tracking spreadsheet needs, point values and POA&M eligibility included. Then why a live scored tracker beats a static sheet that goes stale.

Last updated July 4, 2026~6 minute readPrimary sources cited
110
Controls to track
320
Underlying assessment objectives
14
Families
7
Columns a real tracker needs

The 110 controls by family

FamilyCodeControls
Access ControlAC22
Awareness & TrainingAT3
Audit & AccountabilityAU9
Configuration ManagementCM9
Identification & AuthenticationIA11
Incident ResponseIR3
MaintenanceMA6
Media ProtectionMP9
Personnel SecurityPS2
Physical ProtectionPE6
Risk AssessmentRA3
Security AssessmentCA4
System & Communications ProtectionSC16
System & Information IntegritySI7
Total110

Want each control by name and statement? See the free 110 requirement checklist.

The columns a real tracker needs

Requirement numberThe NIST SP 800-171 identifier, e.g. 3.1.1. Your anchor for everything else.
FamilyOne of 14, from Access Control to System and Information Integrity.
Point value1, 3, or 5. What it costs your score if not met. Drives your prioritization.
StatusMet, not met, or partially met, judged against the underlying 800-171A objectives.
POA&M eligibleWhether a gap here can be deferred, or must be fully closed before you file.
Evidence linkThe artifact that proves the claim: a screenshot, config export, policy, or log sample.
Owner and due dateWho closes an open item and by when, inside the 180 day window.

Track the 110 in a tracker that scores itself

The Level 2 Accelerator tracks every control with its point value and POA&M eligibility, runs your live score out of 110, links each control to real evidence, and exports the whole thing. No stale spreadsheet, no manual math.

Start the 7-day free trial →Book a free demo →

No credit card. Phase 2 begins Nov 10, 2026, when applicable DoD solicitations start requiring a current Level 2 status to win the award.

Questions, answered

Is there a free CMMC Level 2 controls spreadsheet?+

Yes. The 110 controls are public, drawn from NIST SP 800-171 Revision 2, and you can track them in a sheet with the columns above. See the full list on our free Level 2 checklist. The catch is that a static spreadsheet does not score itself, does not know which gaps you can defer, and goes stale the moment your systems change.

What columns should a controls tracker have?+

At minimum: requirement number, family, point value, status, POA&M eligibility, evidence link, and an owner with a due date. Without point values and POA&M eligibility you cannot tell whether you are actually filable, which is the whole point of tracking.

Why is a live tracker better than a spreadsheet?+

Because Level 2 is scored out of 110 and the rules are not obvious: some gaps cost 5 points, some can never be deferred, and Conditional status needs 88 or better with every remaining gap POA&M eligible. A live tracker runs that math for you and always shows your honest, filable number. A spreadsheet makes you do it by hand and hope.

Does the platform export a spreadsheet?+

Yes. Everything you track on the platform exports, and the Audit Room bundles your SSP, POA&M, inventory, and evidence with a manifest an assessor can walk. You get the tracker and the deliverables, kept current automatically.

Source: NIST SP 800-171 r2 · NIST SP 800-171A · 32 CFR § 170.24. Related: the checklist · what the assessment looks like.
Keep going
Level 2 overview→110 requirement checklist→Real 2026 cost→SSP template→Scoping worksheet→The C3PAO assessment→