CMMC Level 2 — weighted assessment points by domain

DoD Assessment Methodology 1/3/5-point weighting, aggregated across all 14 NIST SP 800-171 Rev 2 domains (110 controls, 313 max weighted points). Green segments mark the points that also fall under CMMC Level 1's 17 practices (FAR 52.204-21 basic safeguarding).

Also a CMMC Level 1 objective Level 2 only
Weighted points by domain, Level 1 overlap in parentheses: AC 54 (12), SC 42 (10), CM 33 (0), SI 31 (18), IA 27 (10), MP 23 (5), AU 19 (0), MA 18 (0), PE 14 (8), CA 13 (0), AT 11 (0), IR 11 (0), RA 9 (0), PS 8 (0).

CMMC Level 2 — points barred from a POA&M by domain

Red segments mark points that can never appear on a CMMC Level 2 POA&M under 32 CFR 170.21(a)(2) — every requirement worth more than 1 point, plus six named 1-point/NA requirements that are barred regardless of weight.

Not allowed on a POA&M POA&M-eligible
Weighted points by domain, points barred from POA&M in parentheses: AC 54 (43), SC 42 (28), CM 33 (30), SI 31 (31), IA 27 (20), MP 23 (19), AU 19 (13), MA 18 (16), PE 14 (13), CA 13 (13), AT 11 (10), IR 11 (10), RA 9 (8), PS 8 (8).