CMMC Level 2 scoring starts from the maximum, which is the total number of Level 2 requirements (110), and subtracts a point value for every requirement that is NOT MET. Values are 1, 3 or 5. Scores can go below zero, because deductions are not capped.
The scoring method
Under 32 CFR 170.24, an organization that meets every Level 2 requirement gets the maximum score. For each NOT MET requirement, its value is subtracted. Value depends on impact:
- 5 points for basic and derived requirements that, if not implemented, could lead to significant network exploitation or CUI exfiltration.
- 3 points for requirements with a specific, confined effect on network security, and certain partially effective requirements.
- 1 point for the remaining derived requirements with a limited or indirect effect.
The partial credit cases
Two requirements have graduated deductions.
Multifactor authentication (IA.L2-3.5.3). Five points come off if MFA is not implemented for any users. If it covers only remote and privileged users, the deduction is 3 points.
FIPS validated encryption (SC.L2-3.13.11). If encryption is used but is not FIPS validated, 3 points are deducted. If no encryption is used, 5 points are deducted.
How the score connects to a POA&M
The score alone does not pass you. A final status needs every requirement MET, and a conditional status needs a ratio of at least 0.8 with only eligible items on the POA&M. Read our POA&M rules post for the limits. The text we read for 170.24 does not state a minimum passing score on its own.
Where the score is recorded
For a self-assessment, the overall score goes into SPRS with the level, status date, scope and CAGE codes. An example in the rule shows a result written as 105 out of 110.
Practical tips
- Run a full self-assessment, not a spot check.
- Fix the 5 point items first, since they cost the most.
- Check MFA coverage for every user, not only admins.
- Confirm that your encryption modules are FIPS validated, and keep proof.
- Re-score after each fix and keep the dated results.
Tooling note
Safeguard's compliance and evidence automation can keep the evidence behind each requirement so rescoring is quicker. It does not compute an official score or grant a status.
Quick check
Can the score be negative?
Yes. Deductions are not capped, so the result can drop below zero.
What is deducted if MFA covers only remote and privileged users?
Three points.
Sources
Last reviewed: 19 October 2026.
