Free framework self-check
CMMC Level 2 Self-Check
If your company handles Controlled Unclassified Information (CUI), understanding the systems that handle it is a practical first step. This free self-check asks ten questions about the NIST SP 800-171 control families used for CMMC Level 2 preparation. It helps you identify likely gaps before deciding what needs a closer review.
- The risk
- The tool suggests possible gaps from your answers. It does not verify controls or provide an audit, certification or legal advice.
How the self-check works
- You give a first name, company and work email. Your session is stored and a resume link is sent by email.
- An external AI service uses your intake details to draft ten questions about the framework. You answer in your own words; no documents are uploaded.
- You receive a short summary of potential gaps and a suggested order of work, based only on your answers.
- Use the summary to discuss open questions with your team. If you need a professional review, contact us before sharing records or confidential information.
The summary comes from your answers, not a review of your systems. It cannot be used as an audit or certification result.
Who it is for
DoD contractors and subcontractors handling CUI who are preparing for Level 2 requirements, including a C3PAO assessment where the contract requires one. Security leads, IT managers and contract owners can use it together. Check the current contract and program requirements before deciding which assessment type applies; handling CUI does not answer every applicability question.
Protecting Controlled Unclassified Information
The five themes covered
- Access control and identification
- Who can reach CUI and how their identities are checked. Consider approved users, administrators, remote access and the removal of access when responsibilities change. Include external support providers that can reach the same systems.
- Configuration and system integrity
- How systems are configured, updated and protected against malicious activity. Consider approved settings, change records, vulnerability handling and responsibility for applying fixes. Ask whether the systems holding CUI follow those practices consistently.
- Audit, accountability and incident response
- Whether activity can be traced to a person or system, and whether someone reviews important events. Think about log availability, incident responsibilities, reporting procedures and exercises that show the team can respond.
- Awareness, training and personnel security
- How employees understand their responsibilities for protecting CUI. Consider role-specific training, personnel checks where required and access changes when people move or leave. Include staff who administer the environment without routinely reading the information.
- SSP, POA&M and assessment readiness
- Whether the system security plan describes the actual environment and control implementation. Consider open issues, responsible owners and supporting records. Plans of action and milestones have restrictions; not every unmet requirement can be deferred.
From self-check to assessment
A professional gap assessment compares your systems, practices and records with the applicable requirements. For example, a policy may require multifactor authentication while one support connection still bypasses it. We help identify and prepare to address those differences. The self-check does not calculate an official SPRS result or replace the assessment and affirmation your organization must complete.
AuditPartners helps you prepare and is not a C3PAO. A C3PAO performs a certification assessment when required; your organization remains responsible for its submissions and affirmation.
Guides and assessment services
The next step
Start the CMMC Level 2 self-check
Ten questions, answered in your own words. Sessions are stored so you can resume; session pages are not indexed.