--- title: "CMMC Level 2 Readiness Self-Assessment | EFROS" description: "20-question self-assessment for CMMC Level 2 readiness across 14 NIST SP 800-171 control families. Score, gap analysis, prioritized next steps." canonical: https://efros.com/tools/cmmc-readiness/ --- - [Home](https://efros.com/) - /[Tools](https://efros.com/tools/) - /CMMC Readiness Quiz Tool # CMMC Level 2 readiness quiz Twenty questions across the NIST SP 800-171 control families that drive most CMMC Level 2 assessment outcomes. Each answer maps to a 0-to-3 maturity score. At the end you get a total, a gap list (questions you answered 0 or 1), and a recommended next step tied to where you land. By [Stefan Efros](https://www.linkedin.com/in/stefanefros-cyberdefense/), CEO & Founder, EFROS Updated · June 17, 2026 0 of 20 answered - 1Access ControlMulti-factor authentication is enforced on all privileged accounts (domain admin, cloud admin, security tools).0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 2Access ControlSession timeout policies are applied to systems that store or process CUI.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 3Awareness and TrainingPersonnel who handle CUI complete annual CUI-specific training with tracked completion records.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 4Audit and AccountabilityLogs from systems that process CUI are aggregated into a central SIEM or log platform.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 5Audit and AccountabilitySecurity-relevant logs are retained for at least 12 months and protected against tampering.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 6Configuration ManagementBaseline configurations are documented for each system type and enforced through technical controls.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 7Configuration ManagementA documented change management process is used for systems in the CUI environment, with approval and rollback steps.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 8Identification and AuthenticationEvery user has a unique account (no shared accounts for CUI system access).0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 9Identification and AuthenticationPhishing-resistant MFA (FIDO2, smart card, WebAuthn platform) is used for CUI access, not SMS or TOTP alone.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 10Incident ResponseA documented incident response plan exists and has been tested through a tabletop or live exercise within the past 12 months.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 11MaintenanceRemote maintenance activities on CUI systems are logged, authorized in advance, and terminated when complete.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 12Media ProtectionMedia sanitization procedures are documented and followed for disposal of any media that stored CUI.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 13Personnel SecurityBackground checks are completed before granting access to CUI, with periodic revalidation.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 14Physical ProtectionPhysical access to facilities that house CUI systems is controlled and logged.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 15Risk AssessmentA documented risk assessment is completed at least annually and drives the security roadmap.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 16Risk AssessmentVulnerability scanning runs monthly or more frequently across the CUI environment.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 17Security AssessmentSecurity control effectiveness is assessed annually through an internal or third-party review.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 18System and Communications ProtectionCUI in transit is protected using FIPS 140-2 or 140-3 validated cryptography.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 19System and Communications ProtectionNetwork segmentation separates CUI systems from general corporate networks and non-CUI workloads.0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated - 20System and Information IntegrityFlaw remediation is performed on a defined cadence (within 30 days for high-severity vulnerabilities, faster for critical).0Not implemented1Partially implemented, no documented evidence2Implemented with some documentation3Fully implemented, evidence continuously generated Your answers stay in your browser. Nothing is submitted anywhere. Score my readiness ## What CMMC Level 2 certification actually requires CMMC Level 2 is aligned to NIST SP 800-171 (110 controls across 14 families). For most contractors handling Controlled Unclassified Information (CUI), a certified third-party assessment organization (C3PAO) must verify that all 110 controls are implemented. There are some allowances for POA&M (Plan of Action and Milestones) items, but the set of controls that cannot be on a POA&M is growing, and the scoring methodology penalizes each missing control by the weight assigned in the CMMC scoring methodology (1, 3, or 5 points deducted from a maximum of 110). The contractual trigger is DFARS 252.204-7021 (the CMMC clause), which has been rolling into DoD solicitations on a phased schedule. If your next recompete or new award includes the CMMC clause and you are not certified at the required level by the award date, you will not be eligible. This is a procurement gate, not a best-practice recommendation. ## How the readiness score is calculated Each question maps to a representative control (or in some cases a small cluster of related controls). You pick one of four maturity levels: 0 (not implemented), 1 (partially implemented, no documented evidence), 2 (implemented with some documentation), 3 (fully implemented with evidence continuously generated). Your total is out of 60 points, converted to a percentage, and placed into one of four bands. The bands are calibrated against the gap between "the control is working" and "an assessor can verify the control is working" (which is typically where programs get caught in pre-assessment). A score above 85 percent means your controls are not only in place but evidenced well enough to survive an assessment. A score in the 60 to 85 range means controls are real but evidence is incomplete. Below 60 and you are in remediation program territory (6 to 12 months of focused work). ## What the quiz does not cover This is a 20-question self-assessment against a 110-control standard. It samples the families that drive most readiness gaps (access control, audit and accountability, configuration management, identification and authentication, incident response, risk assessment, system and communications protection, system and information integrity). It does not evaluate your System Security Plan, your POA&M discipline, your scoping decisions around CUI boundaries, or the specific implementation of any individual control. It is not a substitute for a gap assessment and it is not a pre-assessment readiness review. It also does not tell you what CUI you actually have or where it flows. CUI scoping is the single most expensive mistake in a CMMC program (either overscoping and making every system in-bounds, or underscoping and missing systems that process CUI through indirect channels like shared file stores, email distribution lists, or developer build pipelines). If you are not certain about your CUI inventory and data flows, start there before worrying about control implementation. ## Next steps based on your score Below 30 percent the program needs structural work first (CUI inventory, scoping, System Security Plan, and baseline configurations) before individual control hardening will move the needle. Between 30 and 60 percent, a targeted remediation program focused on the lowest-scoring families typically closes the gap in 3 to 6 months. Between 60 and 85 percent you are close enough that a formal gap assessment against all 110 controls is the right next step. Above 85 percent you are ready to engage a C3PAO on a pre-assessment basis and schedule the certified assessment. Regardless of score, do not wait until the CMMC clause appears in a solicitation to begin the program. Lead time from "start remediation" to "certified" runs 9 to 18 months for most mid-sized contractors. If the solicitation window is tighter than that, you are not winning that award. [Get a detailed assessment](https://efros.com/contact/) Related EFROS resources ## From quiz to certification [### Full 110-control scorecard Deeper assessment than the quiz — per-control evidence expectations.Open→](https://efros.com/resources/cmmc-level-2-scorecard/) [### vCISO for CMMC ownership Named operator runs the SSP, POA&M, C3PAO relationship.Open→](https://efros.com/security/vciso/) [### Manufacturing CMMC case study From 60s SPRS to Level 2 certified in 9 months.Open→](https://efros.com/case-studies/manufacturing-cmmc-level2/) [### Zero Trust for 3.13.3 Architectural answer to NIST 800-171 separation requirements.Open→](https://efros.com/security/zero-trust/) [### EFROS for manufacturing Full defense-industrial-base service stack.Open→](https://efros.com/industries/manufacturing/) [### CMMC roadmap call Book a 20-minute call to plan certification path from your quiz score.Open→](https://efros.com/contact/)