# Contractors Prepare for CMMC Level 2 Assessments

A post about preparing for CMMC Level 2 asks whether contractors should map requirements to NIST SP 800-171 with a checklist or use an SSP/GRC platform; it provides no substantive replies comparing those approaches. The post promotes Defense Cybersecurity Group’s free workbook for an initial review of all 110 controls and notes that evaluating all 320 assessment objectives is a separate gap-assessment engagement. For contractors pursuing or supporting DoD work, the distinction matters when planning the effort and evidence needed for CMMC readiness.

- Contractors can use the workbook as an initial control-level self-assessment, but it does not assess all 320 objectives.
- Companies should distinguish that preliminary review from a full gap assessment and from maintaining an SSP or using a GRC platform; the post does not establish which approach is preferable.
- The quoted guidance identifies a separate engagement for assessing the 320 objectives, a scope distinction contractors can use when evaluating readiness support.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 08, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Vendors
- Defense Cybersecurity Group (DCG) (CMMC compliance consultant)

### Key Quotes
> The self-assessment tool evaluates against the 110 controls, not the 320 assessment objectives. A real gap assessment against the 320 is a separate engagement.
> — Original poster

### Sources
- [for those who are preparing for cmmc level 2 are you guys using any checklist to map each requirement against the nist 800-171?or you are using ssp/grc platform??](https://www.reddit.com/r/CMMC/comments/1x0z24r/for_those_who_are_preparing_for_cmmc_level_2_are) - reddit-cmmc