A spreadsheet can carry a small CMMC Level 2 self assessment: one tab for scope, one for each requirement with status and evidence, one for the plan of action. It breaks when evidence goes stale, owners multiply, or the annual affirmation comes due. Automate evidence collection and reminders first.
What does the rule require at Level 2 (Self)?
From the text of 32 CFR 170.16 as we fetched it on 18 October 2026: the organization runs the assessment using NIST SP 800-171A, scopes it per the scoping section and scores it per the scoring section. To reach Level 2 (Self) it needs a MET result on all security requirements. Results go into SPRS, with the CMMC level, status date, scope, CAGE codes, overall score (the page's example is 105 out of 110) and plan of action information.
Two status types matter. Conditional Level 2 (Self) is granted when the assessment leaves a plan of action that meets the rule's conditions. Final status comes with a passing score, either at first or after closeout. The closeout has to be completed and posted to SPRS within 180 days of the conditional status date, or the conditional status expires.
An affirmation is required at each assessment and annually afterward. Reassessment is due every three years, and assessment artifacts are kept for six years from the status date. Some contracts require a third party assessment instead of a self assessment. Your contract states which level and type apply, so read it first. This guide covers the self assessment text we could fetch.
What does a workable spreadsheet look like?
Scope tab. List the systems, people, facilities and external providers that process, store or transmit the in scope information. For cloud service providers, the rule text says they must be FedRAMP Moderate (or higher) authorized or meet equivalent requirements, and the on premises pieces that connect to them are in scope. Document these responsibilities in your system security plan.
Requirements tab. One row per requirement: ID, plain language statement, how you meet it, owner, evidence link, test date, status (MET, NOT MET, not applicable with reason), and points if not met.
Plan of action tab. Each NOT MET row gets a task, owner, due date and the 180 day clock date. Do not let this tab sit.
Evidence folder. One folder per requirement, named with the ID, containing exports with dates in the file name.
Affirmation tab. Who signs, the date, and what they reviewed.
Where do spreadsheets fail?
They fail at freshness. A row marked MET in March tells you nothing about October. Evidence links break. Two people edit different copies. The score in the sheet drifts from the SPRS entry.
They also fail at scale. With a few dozen people and one environment, a sheet works. With several enclaves, many external providers and weekly changes, nobody can keep it current by hand.
When should you automate?
Automate when any of these is true: you have more than one environment in scope, you miss more than one evidence date a quarter, your plan of action has items nearing the 180 day limit, or a prime contractor asks you for proof on short notice. Start with the parts that are mechanical: collecting configuration evidence on a schedule, alerting when a setting changes, and reminding owners.
Do not automate the judgment: scope decisions, interpreting a requirement and signing the affirmation stay with people.
What to do
- Read your contract or solicitation to confirm the level and assessment type.
- Define scope with a data flow diagram, and record every external provider.
- Build the requirements tab and assess each row honestly against NIST SP 800-171A objectives.
- Put every NOT MET row on the plan of action with a date well inside 180 days.
- Store dated evidence and a retention rule for six years.
- Calendar the annual affirmation and the three year reassessment.
- Decide which evidence to collect automatically once the sheet takes more than a day a month.
Quick check
Can we claim Level 2 with open items?
The rule text describes Conditional Level 2 (Self) when a plan of action meets its conditions, with closeout within 180 days of the status date.
Is the SPRS score the same as certification?
No. It is the posted result of your assessment, together with status and scope. The rule defines the statuses.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. Evidence is collected from connected systems and code instead of screenshots, and monitoring runs continuously between assessments so a drifting setting is visible before the annual affirmation. Technical evidence, including scans and SBOMs, comes from your real code and dependencies. Autonomous remediation can open tested fix pull requests for vulnerable dependencies, but it is off by default, every category starts on Manual and you choose what runs automatically. Safeguard helps you prepare and keep evidence ready. It does not certify you or replace an assessor. Book a call.
Sources
- 32 CFR 170.16, CMMC Level 2 self assessment, fetched 18 October 2026. The DoD CMMC site and the eCFR returned access errors, so Level 1, Level 3 and third party assessment details are not covered here.
Last reviewed: 18 October 2026.
