---
title: "CMMC Level 2 Checklist: 110 Controls"
description: "The CMMC Level 2 checklist: all 110 NIST SP 800-171 Rev 2 controls by control family, with implementation status tracking and a POA&M template, by email."
url: https://policycortex.com/cmmc-checklist
sealed: 2026-09-02
amended: 2026-09-05
register: cmmc-checklist
records: 4
digest: sha3:560a3f362b6e2526905b3ef5534b700e726d0b2ab71a6e0e30be3c5544750a66
---

# 110 controls, 14 families, one checklist.

CMMC LEVEL 2 / NIST SP 800-171 REV 2

The CMMC Level 2 checklist lists all 110 NIST SP 800-171 Rev 2 controls, organized by the 14 control families, with implementation status tracking, an evidence documentation guide, and a POA&M template. It is sent by email as a PDF at no cost. The families and their control counts are printed below.

[Request the checklist](#request) · [Take the ten-question assessment](https://policycortex.com/cmmc-assessment)

## Fourteen families, 110 controls

The checklist covers every control family in NIST SP 800-171 Rev 2, required for CMMC Level 2 certification. Fourteen families; the counts below sum to 110.

1. **Access Control** (AC): 22 controls
2. **Awareness and Training** (AT): 3 controls
3. **Audit and Accountability** (AU): 9 controls
4. **Configuration Management** (CM): 9 controls
5. **Identification and Authentication** (IA): 11 controls
6. **Incident Response** (IR): 3 controls
7. **Maintenance** (MA): 6 controls
8. **Media Protection** (MP): 9 controls
9. **Physical and Environmental Protection** (PE): 6 controls
10. **Personnel Security** (PS): 2 controls
11. **Risk Assessment** (RA): 3 controls
12. **Security Assessment** (CA): 4 controls
13. **System and Communications Protection** (SC): 16 controls
14. **System and Information Integrity** (SI): 7 controls

Total: 110 controls across 14 families

## What the document contains

One PDF. Built for defense contractors validating Phase I self-assessments now and preserving readiness for the CMMC model that follows the Phase II review.

1. All 110 NIST 800-171 controls
2. Organized by 14 control families
3. Implementation status tracking
4. Evidence documentation guide
5. POA&M template included

## The same 110, as evidence

A checklist lists the requirements; it does not observe your environment. PolicyCortex records the evidence for the same 110 requirements inside your tenant: every observation content hashed with SHA3-256, timestamped, appended to the chain, retained seven years. A control that stopped being observed produces a declared gap, not a stale green.

Work the checklist requirement by requirement, then hand the assessor a package built to be verified rather than believed. [Read what the assessor receives.](https://policycortex.com/cmmc/emass-c3pao-handoff)

**Stated limit.** PolicyCortex is not a C3PAO and does not certify anything. Completing the checklist organizes the requirements; the assessor remains the authority on what passes.

## Questions about the checklist

**Q: How many controls are in the CMMC Level 2 checklist?**
A: 110, the full set of NIST SP 800-171 Rev 2 requirements, organized into 14 control families. The counts per family are printed on this page and sum to 110.

**Q: What is included besides the control list?**
A: Implementation status tracking, an evidence documentation guide, and a POA&M template, in one PDF sent by email.

**Q: Does completing the checklist make us CMMC compliant?**
A: No. It organizes the requirements. CMMC Level 2 certification assessments are performed by a C3PAO against all 110 requirements; PolicyCortex is not a C3PAO and does not certify anything.

From a checklist to a record you can verify. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | CONTROL FAMILIES | 2cbf775204c3 | 5ac0b879f165 |
| REC 0001 | WHAT THE DOCUMENT CONTAINS | f8e860e5736a | 2cbf775204c3 |
| REC 0002 | THE SAME 110, AS EVIDENCE | f5e39cb809ed | f8e860e5736a |
| REC 0003 | FAQ | 560a3f362b6e | f5e39cb809ed |

Head sha3:560a3f362b6e2526905b3ef5534b700e726d0b2ab71a6e0e30be3c5544750a66. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.