CMMC Level 2 Practice Assessment (NIST SP 800-171)
The requirement set
Level 2 is the 110 security requirements of NIST SP 800-171 across 14 families (AC, AT, AU, CM, IA, IR, MA, MP, PE, PS, RA, CA, SC, SI). Each requirement has assessment objectives in NIST SP 800-171A. A practice is MET only when every objective is satisfied - there is no partial credit at the practice level.
Scoring
Under the DoD Assessment Methodology each requirement carries a weight of 1, 3, or 5. Met requirements earn full weight. A requirement not met but covered by an acceptable POA&M deducts 1 point; a requirement not met with no POA&M deducts its full weight. The maximum is 110, and conditional status depends on meeting the score threshold with eligible open items (generally not 5-point requirements) closed within 180 days.
Traps
Do not answer from the requirement title - read the 800-171A objectives. For example, 3.1.1 is not simply "have an access control policy"; it requires approved logical access authorizations documented and enforced for each account type. Second, inheritance: cloud and external service providers earn credit only where the responsibility matrix shows the provider covers the objective and the OSC covers the remainder. Third, physical (PE) and maintenance (MA) practices apply to in-scope facilities and assets, not the whole company. Fourth, an FCI-only fact pattern cannot justify a Level 2 conclusion.
Rule of thumb: quote the objective first, then require evidence that it is true today and has been operating.