NIST 800-171 & CMMC Level 2 Control Explorer

All 110 controls · 14 families · NIST SP 800-171 Rev 2 · with SPRS weights

⏱ CMMC Level 2 third-party certification (Phase 2) begins November 10, 2026.

NIST SP 800-171 Rev 2 defines 110 security requirements for protecting Controlled Unclassified Information (CUI). CMMC Level 2 is assessed against these same 110 controls, and your SPRS score — starting at 110 — is reduced by the weighted value of each control you have not implemented.

Browse any family below to see its controls, each control's SPRS point weight, and how it affects your score. When you're ready, estimate your score with the free quick calculator.

Estimate your SPRS score in 2 minutes

15 quick questions across the highest-impact controls — instant estimate, no signup.

Estimate my SPRS score →

The 14 control families

3.1Access Control

22 controls · 7 weighted 5 pts

3.2Awareness and Training

3 controls · 2 weighted 5 pts

3.3Audit and Accountability

9 controls · 2 weighted 5 pts

3.4Configuration Management

9 controls · 6 weighted 5 pts

3.5Identification and Authentication

11 controls · 4 weighted 5 pts

3.6Incident Response

3 controls · 2 weighted 5 pts

3.7Maintenance

6 controls · 2 weighted 5 pts

3.8Media Protection

9 controls · 2 weighted 5 pts

3.9Personnel Security

2 controls · 1 weighted 5 pts

3.10Physical Protection

6 controls · 2 weighted 5 pts

3.11Risk Assessment

3 controls · 1 weighted 5 pts

3.12Security Assessment

4 controls · 2 weighted 5 pts

3.13System and Communications Protection

16 controls · 6 weighted 5 pts

3.14System and Information Integrity

7 controls · 5 weighted 5 pts

Source: NIST SP 800-171 Rev 2 (public domain) · SPRS weighting per the DoD Assessment Methodology · Reference information, not an official assessment.