CMMC Level 2 Documentation Checklist: SSP, POA&M, Evidence & What Assessors Actually Require

By The Defense Compliance Report Editorial Team · Last reviewed July 2026· Source-checked against 32 CFR Part 170, NIST SP 800-171 Rev. 2, NIST SP 800-171A, DFARS 252.204-7012 / -7019 / -7020 / -7021, and the DoD CMMC Assessment Guide – Level 2.

Educational research, not legal, contractual, or compliance advice. The Defense Compliance Report is not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency.

Bottom line up front:A complete CMMC Level 2 documentation checklist is built around two documents the security requirements name directly — a System Security Plan (SSP) and a Plan of Action & Milestones (POA&M)— plus the scope artifacts, policies, procedures, and evidence you need to prove all 110 security requirements across 14 control families in NIST SP 800-171 Revision 2. There is no official master document pack. What else you need depends on your scoped environment, your assessment type, and your cloud and IT setup.

That last sentence is where most contractors lose months and money. We’ll show you exactly why in a minute. First, who this page is for.

Who this page is for — and who should leave

This is the documentation-and-evidence deep dive. For the complete Level 2 implementation walkthrough — all 110 controls, scoring, and provider categories — see our parent guide, the CMMC Level 2 Checklist.

Required vs. conditional vs. useful: the whole checklist at a glance

Every artifact falls into one of four tiers. Learn the tiers and the rest of the page clicks into place.

What documents does a CMMC Level 2 documentation checklist actually require?

The honest answer:The NIST SP 800-171 Rev. 2 Level 2 security requirements name only two planning documents directly — the System Security Plan (requirement 3.12.4) and the POA&M (requirement 3.12.2). 32 CFR Part 170 separatelyrequires or records other artifacts — your scope, asset inventory, network diagram, SPRS or eMASS status data, affirmations, and evidence retention — but there is no single, government-issued master document pack that guarantees you a pass.

We read the source. The DoD’s own CMMC Assessment Guide – Level 2 describes the documents an assessor might review, then says plainly that the list “is not exhaustive or prescriptive.” NIST goes further in SP 800-171 Rev. 2: for the SSP specifically, “there is no prescribed format or specified level of detail.” The government tells you what outcomes to prove and how the assessment works— it does not hand you a numbered folder and promise that filling it earns you a certificate.

So why does nearly every vendor page publish “the required CMMC documents”? Because a fixed list sells templates and reads easier than the truth. The truth is more useful: two documents are named in the requirements, a handful of scope and status artifacts are effectively mandatory under 32 CFR Part 170, and the rest is evidence that has to match a system you actually operate.

The DCR CMMC Level 2 Documentation Truth Table

Built by reading 32 CFR Part 170, the NIST SP 800-171 Rev. 2 requirements, and the DoD Assessment Guide side by side. Every artifact classified by tier, with the false assumption that costs you and the primary source that resolves it.

The System Security Plan: the one document you cannot skip or defer

The SSP is the center of gravity for CMMC Level 2 documentation.Under 32 CFR Part 170, you must have an up-to-date SSP in place at the time of assessment, and it cannot be deferred to a POA&M. If it’s missing or stale, the assessment doesn’t just go poorly — it can’t be completed.

We’re quoting the rule directly because the consequence language is that important. Per 32 CFR Part 170, an organization “must have a System Security Plan (SSP) (CMMC security requirement CA.L2-3.12.4) in place at the time of assessment,” and “the absence of an up to date SSP at the time of the assessment would result in a finding that ‘an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012.’”

Read that twice. No SSP means two failures at once: your assessment can’t finish, and you’re out of compliance with DFARS 252.204-7012 (the Safeguarding Covered Defense Information clause). This is not a document you draft last.

NIST SP 800-171 requirement 3.12.4 spells out what the SSP has to describe: your system boundaries, your environment of operation, how each security requirement is implemented, and your relationships with or connections to other systems. There’s no mandated format — but there are non-negotiable contents.

What your Level 2 SSP has to cover

At a minimum, build these into the SSP:

• System name, owner, and the CAGE code(s) it maps to
• Your CUI boundary and the in-scope locations, users, and assets
• A reference to your network diagram and CUI data-flow diagram
• Every external connection and every External Service Provider (ESP) relationship, with a Customer Responsibility Matrix where controls are shared or inherited
• A requirement-by-requirement implementation narrative for all 110 requirements, each with a named owner and a pointer to the evidence
• Cross-references to your POA&M for anything not yet met
• Version history and an approval record

The SSP mistakes that quietly sink assessments

The pattern we see over and over: the SSP describes the company someone wants to be, not the systems they actually run. Specifically:

• The SSP describes aspirational controls instead of implemented ones.
• The SSP contradicts the asset inventory or the network diagram.
• The SSP says “our cloud provider handles this” with no CRM to back it.
• The SSP is a template that still references systems the company doesn’t own.
• The SSP is stale and no longer matches the current environment.

Here’s the one thing we’ll admit that most checklist pages won’t: a documentation checklist — including this one — will not make you compliant. You can assemble every artifact on this page and still fail, because a CMMC assessment doesn’t score documents. It scores whether your documents describe a system you actually operate, verified by examination, interview, and testing.

Free primary-source starting point: NIST publishes a free CUI System Security Plan template and a free CUI Plan of Action template alongside SP 800-171 Rev. 2 on the NIST Computer Security Resource Center (csrc.nist.gov). They’re the closest thing to an official starting structure. Just remember NIST’s own planning note: a template gives you structure, not compliance.

Scope first: the asset inventory, network diagram, and CUI data-flow diagram

Scope comes before documentation, not after.For Level 2, 32 CFR 170.19 requires you to define your assessment scope before the assessment and to categorize every asset — because the category determines what evidence an assessor will expect and what falls outside the boundary. Get the boundary wrong and you either overpay for compliance on systems that never needed it, or under-scope and fail.

The five CMMC Level 2 asset categories

Build the scope package first: a CUI inventory, a CUI data-flow diagram, an asset inventory tagged by category, a network diagram, a user-and-location list, an external-connection list, an ESP/CSP list, a Customer Responsibility Matrix, and — if you’re shrinking scope — enclave boundary documentation. Do this and the family-by-family evidence work below gets dramatically smaller.

CUI usually touches more than the file server. Email systems, endpoints used for multi-factor authentication, and cloud collaboration tools frequently pull themselves into scope. If that’s you, use the CMMC Scoping Guide to understand asset categories and boundary reduction, or use Find My CMMC Path to determine whether your next step is RPO/RP scoping help, an MSSP, a GRC platform, or a CUI enclave.

The CMMC Level 2 documentation checklist, family by family

CMMC Level 2 maps to all 110 requirements in NIST SP 800-171 Rev. 2, organized into 14 control families.Each family generally needs a documented policy, documented procedures, and evidence that the applicable requirements are met — but the exact artifacts depend on your scoped environment, not a universal list.

Read the “documentation” column as “what an assessor will typically look for to confirm you’ve met the objectives in this family.” Not “the documents the rule requires.” Watch the freshness — the artifacts that fail most are the ones built once and never updated.

Add the counts and you get the number that anchors the whole standard: 22 + 3 + 9 + 9 + 11 + 3 + 6 + 9 + 2 + 6 + 3 + 4 + 16 + 7 = 110 requirements across 14 families. For the full requirement text and evidence mapping see our NIST 800-171 Requirements Checklist.

How your CMMC Level 2 documentation is actually assessed

Assessors don’t just read your policies — they examine, interview, and test. NIST SP 800-171A, the companion assessment methodology, breaks the 110 requirements into 320 assessment objectives, and every objective for a requirement must be MET (or Not Applicable) for that requirement to count. Documentation that doesn’t match what your people say and your systems show will fail, no matter how polished it looks.

• Examine — the assessor reviews your documentation: SSP, policies, procedures, configurations, logs.
• Interview — the assessor talks to the people who do the work to confirm the documents describe reality.
• Test — the assessor verifies the technical controls actually behave as described.

That’s why practitioners talk about a triad: documentation (is it written down?), implementation (is it deployed?), and institutionalization (is it performed, repeatable, and evidenced over time?). A policy satisfies the first. It does nothing for the other two.

A quick note on versions: 32 CFR 170.2 incorporates NIST SP 800-171 Rev. 2 and the June 2018version of SP 800-171A by reference for Level 2 assessments. Until DoD amends the rule, those are the controlling versions. If you build your package around Rev. 3, you’re building to the wrong standard.

Build an evidence index — it’s the difference between passing and scrambling

The single most useful artifact the rule doesn’t name is an evidence index: a register that maps every requirement and objective to a specific artifact. For a C3PAO assessment, you must hash your evidence files and hand the assessor the artifact names, hash values, and hashing algorithm — so traceability isn’t optional in practice; it’s how the assessment runs.

Requirement ID · assessment objective · control family · artifact name · artifact type · owner · system/component · evidence date · refresh interval · storage location · CUI/sensitive flag · status (MET / NOT MET / N/A) · POA&M link · reviewer

And a hard rule from the assessment guidance: evidence must be final, not draft. Unapproved SOPs, undated screenshots, “the tool supports this” claims, one-time screenshots for recurring activities, and anything outside your assessed boundary do not count. If it isn’t final, current, and owned, an assessor can disregard it.

POA&M rules for Level 2: what you can defer, and what you can’t

A POA&M is not a “we’ll fix it later” escape hatch. Under 32 CFR 170.21, you can only earn a Conditional Level 2 status if your score is at least 80% (a minimum of 88 out of the 110-point maximum), every deferred item is a 1-point requirement (with one narrow encryption exception), none of six specific controls is deferred, and you close everything within 180 days.

The score gate. Your score must be at least 88 on the 110 scale. The DoD scoring methodology weights requirements at 1, 3, or 5 points and subtracts from 110, so scores can even go negative.

The point-value gate. Only requirements worth 1 point may go on the POA&M. The single exception: CUI Encryption (SC.L2-3.13.11) can be deferred only if encryption is in use but not yet FIPS-validated, which scores it at 3 points instead of 5. Everything worth 3 or 5 points — MFA, most access and audit controls — must be fully MET at assessment.

The clock. If you earn Conditional status, you have 180 days from the Conditional CMMC Status Date to close every POA&M item and pass a closeout assessment. Miss it, and Conditional status expires. See our full Conditional Level 2 & POA&M Closeout guide.

The six controls you can never defer

Per 32 CFR 170.21(a)(2)(iii), these are barred from a Level 2 POA&M. If any is unmet, you cannot earn Conditional status — full stop:

One more distinction the rule draws: an operational plan of action (the ongoing list of patches and reconfigurations you manage as threats evolve, referenced in requirement 3.12.2) is not the same as an assessment POA&M. Only the assessment POA&M triggers the 88-point gate and the 180-day clock.

Write each POA&M entry like an assessor will read it: requirement ID, assessment objective, the finding, root cause, remediation action, owner, start date, target close date, the evidence needed to close it, an eligibility check, and the risk if it isn’t closed.

Self-assessment vs. C3PAO: does the documentation change?

The 110 requirements are identical for a Level 2 self-assessment and a C3PAO assessment. What changes is who reviews the evidence, how hard they scrutinize it, and where the results are recorded: self-assessment results go into SPRS, while C3PAO results go into the CMMC instantiation of eMASS. Your contract clause tells you which path applies. See our self-assessment vs. C3PAO guide for the full breakdown.

DFARS 252.204-7021 (the contract clause that makes CMMC binding) took effect November 10, 2025, which started Phase 1 of the rollout. Phase 2 begins November 10, 2026, when DoD intends to include Level 2 (C3PAO) for applicable solicitations as a condition of award. If you’re documenting for a self-assessment today, build the evidence to a C3PAO standard anyway. It’s the same package, and your path can change with your next contract.

What goes in SPRS — and what must never go in a web form

SPRS (the Supplier Performance Risk System) stores your assessment record, not your evidence.For a CMMC Level 2 self-assessment, 32 CFR 170.16 requires you to record, at minimum, your CMMC level and status, the CMMC Status Date, the assessment scope, your CAGE code(s), your Level 2 self-assessment score, and POA&M status if applicable. A lead-routing or contact form is not SPRS, and it should never collect sensitive information.

There’s a related-but-separate posting people conflate with this. The legacy NIST SP 800-171 DoD Assessment under DFARS 252.204-7020 posts its own record — the NIST version assessed, the organization that ran it, CAGE code(s), a brief SSP architecture description, the assessment date, the summary score, and the expected full-implementation date. DFARS 252.204-7019 requires an offeror to have a currentassessment on file — generally not more than three years old — with the summary score posted in SPRS. Two systems, two records; know which one your solicitation is asking about.

How long do you have to keep CMMC Level 2 evidence?

Six years. For a Level 2 self-assessment, 32 CFR 170.16 requires you to retain the artifacts used as evidence for six years from the CMMC Status Date. For a Level 2 C3PAO assessment, 32 CFR 170.17 requires the same six-year retention — but the artifacts must be hashed with a NIST-approved algorithm, and you provide the C3PAO with the artifact names, the hash values, and the hashing algorithm for upload into eMASS.

Your evidence library isn’t a one-time assessment prop. It’s a six-year record you have to preserve intact — which is one more reason the evidence index earns its keep. If you can’t produce a named, dated, unaltered artifact two years after your assessment, you don’t really have evidence; you have a memory.

How to organize your CMMC documentation library

Organize by scope, requirement, owner, and evidence date — and make everything trace back to the SSP. An assessor should be able to follow any requirement to its proof without asking you where it lives.

Here’s a folder structure that mirrors how a Level 2 assessment actually flows:

/00_Read_Me_and_Index
/01_Scope
  /Asset_Inventory
  /Network_Diagrams
  /CUI_Data_Flows
  /ESP_CSP_CRM
/02_SSP
  /Current_Approved_SSP
  /Version_History
/03_POAM
  /Current_POAM
  /Closeout_Evidence
/04_SPRS_and_Affirmation
/05_Policies_and_Procedures
/06_Evidence_By_Family
  /AC_Access_Control
  /AT_Awareness_and_Training
  /AU_Audit_and_Accountability
  /CM_Configuration_Management
  /IA_Identification_and_Authentication
  /IR_Incident_Response
  /MA_Maintenance
  /MP_Media_Protection
  /PS_Personnel_Security
  /PE_Physical_Protection
  /RA_Risk_Assessment
  /CA_Security_Assessment
  /SC_System_and_Communications_Protection
  /SI_System_and_Information_Integrity
/07_Assessment_Workpapers
/08_Archive

Name files so the requirement, artifact, date, and status are visible before anyone opens them:

AC.L2-3.1.1_User_Access_Review_Q2-2026_APPROVED.pdf
CM.L2-3.4.1_Baseline_Config_Windows_Workstations_2026-06-15.pdf
IR.L2-3.6.2_Incident_Response_Test_After_Action_Report_2026-05.pdf

The documentation mistakes that make you look ready when you’re not

The most dangerous documentation mistake is mistaking intent for proof.CMMC evidence has to show requirements that are implemented and operating — not policies that say you plan to. These are common upkeep failures to check before your assessment:

Which provider category do you actually need?

A documentation gap means different things depending on where it sits — and the fix is a different category of provider each time.No SSP or POA&M usually points to readiness help; controls that aren’t operated day-to-day point to managed IT/security; disorganized evidence points to a GRC platform; too much CUI in scope points to an enclave; and a ready package on a C3PAO-required contract points to an assessment. Matching the problem to the category is the whole game.

This table is our editorial guidance based on the regulatory separation between readiness work, evidence workflow, secure architecture, and formal assessment. It is not a CMMC score, a legal opinion, or a named-provider ranking.

One independence rule you have to respect.Under the Cyber AB’s conflict-of-interest requirements referenced in 32 CFR 170.8, a member of the CMMC ecosystem generally cannot participate in your Level 2 certification assessmentif they served as a consultant to prepare you for that assessment within the prior three years. Keep readiness and remediation help appropriately separated from formal assessment. Don’t hire the same firm to build your program and then certify it where that’s prohibited.

Source-checked means we’ve checked the provider’s category, public status where relevant, claimed role, any compensation relationship with us, and the routing destination as of a stated date. It does not mean a Cyber AB or DoD endorsement, and it is not a guarantee of certification.

Your next 7 days

Don’t start by buying every template or booking a C3PAO.Start by confirming your assessment path, locking scope, updating the SSP, and building an evidence index — in that order.

Do the seven days, and you’ll know exactly what you have, what you’re missing, and who to call. That’s the whole point of a documentation checklist — not to collect paper, but to make your next expensive decision an informed one.

How we built and verified this checklist

We built this from primary sources first, then translated the rule and assessment mechanics into a working documentation package. Every regulatory claim on this page is tied to the authority that established it, and we re-verify the volatile ones quarterly.

This page is educational research, not legal, contractual, or compliance advice. Confirm scope and applicability with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney before you rely on any interpretation. See our editorial standards and corrections policy for how we source and update this work.

CMMC Level 2 documentation checklist: FAQ

Keep going

• CMMC Level 2 Checklist: 110 Controls, Evidence & SPRS — the full readiness sequence (parent guide)
• CMMC Levels Explained — confirm whether you need Level 1, 2, or 3
• CMMC Self-Assessment vs. C3PAO — which path your clause requires
• CMMC Scoping Guide — asset categories and boundary reduction
• NIST 800-171 Requirements Checklist — all 110 requirements in detail
• NIST 800-171A Assessment Objectives — the 320 checks behind the 110 requirements
• Conditional Level 2 & POA&M Closeout — the 180-day path
• CMMC Level 2 Cost — what readiness and assessment actually run
• The CMMC Final Rule, Explained — 32 CFR Part 170 background
• Find My CMMC Path — map your situation to the right provider category

Primary sources

• 32 CFR Part 170 (CMMC Program Rule) — ecfr.gov/current/title-32/…/part-170
• NIST SP 800-171 Rev. 2 — csrc.nist.gov/pubs/sp/800/171/r2/upd1/final (free CUI SSP and Plan of Action templates linked on publication page)
• NIST SP 800-171A (assessment methodology, June 2018) — csrc.nist.gov/pubs/sp/800/171/a/final
• CMMC Assessment Guide – Level 2 and CMMC Scoping Guide – Level 2 — dodcio.defense.gov/CMMC
• DFARS 252.204-7012 / -7019 / -7020 / -7021 — Acquisition.gov
• SPRS (Supplier Performance Risk System) — sprs.csd.disa.mil

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification.