The 14 families of CMMC Level 2

NIST SP 800-171 Rev 2 groups its 110 requirements into 14 families, and an assessor walks them family by family. Each page below explains what the family is really about, lists every requirement in it with its point value and POA&M eligibility, and links to the plain English page for each one.

  1. Access Control (AC) →

    22 requirements

  2. Awareness & Training (AT) →

    3 requirements

  3. Audit & Accountability (AU) →

    9 requirements

  4. Configuration Management (CM) →

    9 requirements

  5. Identification & Authentication (IA) →

    11 requirements

  6. Incident Response (IR) →

    3 requirements

  7. Maintenance (MA) →

    6 requirements

  8. Media Protection (MP) →

    9 requirements

  9. Personnel Security (PS) →

    2 requirements

  10. Physical Protection (PE) →

    6 requirements

  11. Risk Assessment (RA) →

    3 requirements

  12. Security Assessment (CA) →

    4 requirements

  13. System & Communications Protection (SC) →

    16 requirements

  14. System & Information Integrity (SI) →

    7 requirements

Want them as one list? The Level 2 checklist has all 110 requirements with point values and POA&M eligibility, and the requirements index has one page per requirement.

Work every family on the platform, at the objective level

The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.

Start the 30 day free trial →See the Level 2 example →
Book a free advisory call

No credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.