We could not find an official, public list of the most common CMMC findings, so we will not invent one. What the final rule does show is what decides a Level 2 result: an 80 percent score, every critical requirement met, a bounded plan of action, and a correct scope. Gaps tend to cluster around those four points.
What does the rule say decides the outcome?
A law firm summary of the final rule describes the mechanics. Level 2 covers controlled unclassified information and builds on NIST SP 800-171 Revision 2. Depending on the contract, the Department of Defense decides whether a self-assessment or a third-party assessment applies.
To reach conditional Level 2 status, the summary says a contractor needs a score of at least 80 percent, all critical requirements met, and any unmet non-critical requirements written into a plan of action and milestones. It also says the contractor must close that plan and reach final status within 180 days. A Level 2 assessment stays current for three years, provided compliance has not changed and an affirmation of continuous compliance was made within the past year.
If you want the exact numbers, read the text of 32 CFR Part 170 yourself. We relied on a secondary summary for these figures and the rule is the authority.
Where do teams stumble?
These are patterns that follow from how the rule works, not statistics.
Scope drawn too loosely or too tightly. Levels 2 and 3 ask contractors to identify the systems that handle controlled unclassified information, the ones that could handle it, and the nature of each asset. If you cannot show a system boundary and a data flow, an assessor cannot trust the rest.
Critical requirements treated like any other. Because a score of 80 percent is not enough when a critical requirement is unmet, a team that spreads effort evenly can still miss the cutoff. Rank the work by what the rule calls critical.
A plan of action that will not close. The 180 day clock punishes plans with no owner, no date and no budget. Anything on that list needs all three.
Cloud services with unclear status. The summary says a cloud provider that stores or processes controlled unclassified information must meet the DFARS 252.204-7012 requirements, including the FedRAMP Moderate baseline. If the provider holds that authorization the contractor is not responsible for its compliance, and otherwise the contractor must determine equivalency. Teams discover this late.
No affirmation routine. The affirming official must attest to continuous compliance each year. If nobody owns that task, a valid assessment can lapse.
Evidence that lives in heads. Access reviews, configuration baselines and patch records must exist as artifacts. Collect them as you go.
Where does software supply chain work fit?
Several 800-171 families touch software: configuration management, system and information integrity, and risk assessment. An up-to-date inventory of components, vulnerability findings with dates and a record of fixes are evidence you will want. Safeguard's compliance automation can help organize that evidence. It does not certify you, and no tool can: only an assessment under the program does that.
What to do
- Draw the boundary for controlled unclassified information and keep the diagram current.
- List every requirement the rule treats as critical and verify each has an owner.
- Score yourself against the 800-171 assessment method and record the number.
- Put every gap on a plan with an owner, a date and a budget, with the 180 day limit in mind.
- Check the status of each cloud service that touches controlled information.
- Assign the person who will make the yearly affirmation.
Quick check
Is there an official list of top CMMC findings?
We did not find one in the sources we reviewed. Treat any ranked list with caution unless it names its data source.
Does a score of 80 percent pass Level 2?
Per the summary we read, 80 percent gives conditional status only if all critical requirements are met, and the open items must close within 180 days. Check the rule text for your situation.
Sources
Last reviewed: 18 October 2026.
