Excel Download
Know Exactly What Your CMMC Level 2 Assessment Will Cover
Before you write a single policy, you need to know which systems, people and providers are in scope. This worksheet takes you there one asset at a time.
What Will You Have When You Finish?
- Every computer, server, cloud service, device and person sorted into one of the five Level 2 asset categories
- A written separation reason for each asset you decide to leave out of scope
- A short list of the outside providers that hold your CUI or your security data
- Counts by category, ready for your System Security Plan
Who Is It For?
Defense contractors that handle Controlled Unclassified Information and are working toward CMMC Level 2, especially small and mid sized shops without a full time compliance person. Not sure you need Level 2? Read what CMMC Level 2 requires first.
The categories follow 32 CFR 170.19 and the DoD CMMC Scoping Guide for Level 2. The worksheet is a planning aid, not legal advice.
Get Your Copy
Tell us where to find you and the file downloads right away.
How Does the Worksheet Work?
Step 1
Trace your CUI
Answer six plain questions: where controlled information comes in, where it lands, which named people work with it, and what touches it by accident, like backups and print queues.
Step 2
List your assets
Add one row for each asset, or for each group of identical assets. Answer four yes or no questions on each row.
Step 3
Pick a category
Choose a category from the dropdown. A five step decision guide inside the file shows you which one fits.
Step 4
Check your summary
The summary tab counts your assets by category as you go. Any out of scope row without a reason stays red until you add one.
The final tab explains how qualifying defense contractors can get an in-kind CMMC gap assessment from Cyber Grants Alliance, at no cost to them.
Get a straight answer about your CMMC path.
Book a free 30-minute call with Rick. No sales pitch, just straight answers about your CMMC path.
Book a Free 30-Min Call with Rick