CMMC Level 2 Self-Assessment Kit
110 Requirements, a Score Workbook, and a Plan to Fill the Gaps
For a supplier that handles Controlled Unclassified Information (CUI) and must complete a Level 2 self-assessment, or prepare for an assessment by a third party. The kit explains all 110 requirements of National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2 in plain language, adds the assessment objectives from NIST SP 800-171A, and includes a self-assessment and scoring workbook for the Supplier Performance Risk System (SPRS), a System Security Plan (SSP) template, a policy set, a Plan of Action and Milestones (POA&M, also written POAM) template, an SPRS and affirmation guide, and an evidence binder guide. Pay once, no subscription.
Delivered by email within minutes as individual files. Full refund within the 20 day refund window if a file will not open or the kit is not as described. This kit supports your own self-assessment and does not give you a CMMC certification.
Made for a supplier that handles Controlled Unclassified Information
Controlled Unclassified Information is information the Government creates or possesses, or that a company creates or possesses for the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls. If your contract involves it, expect Level 2 or higher. The contract or solicitation names the level. Depending on the contract, Level 2 is a self-assessment that your company affirms, or an assessment by a Certified Third-Party Assessment Organization (C3PAO). The solicitation names which one.
Owners and office managers
You are responsible for protecting information you do not fully control, and you may rely on an outside provider for information technology. You need each requirement in everyday terms and a way to track it.
Suppliers preparing for an assessment
Your contract may require an assessment by a third party. The kit helps you organize the System Security Plan, the evidence, and the score before the assessors arrive. It does not replace the assessment.
Suppliers with a score to report
You must calculate a score and enter it in SPRS. The scoring workbook applies the point values in the CMMC scoring rule (Title 32 of the Code of Federal Regulations (CFR), section 170.24), which match the Department of Defense (DoD) Assessment Methodology, so the number follows the official method.
Not the right fit: companies that handle only Federal Contract Information, who need the Level 1 Kit, and consultants or managed service providers who want to use the kit with several clients, who need a separate license for each client company. Each client license costs the same as the kit: $297 for Level 1 and $497 for Level 2. Anyone looking for legal advice should speak with qualified counsel.
The files, numbered in the order to use them
Nine files and a Source Library: six editable Word files, one Excel workbook, two guides in Portable Document Format (PDF), and a Source Library of official documents that arrives as one zip file. Every file name starts with a number, so the files sort in reading order when you save them to one folder.
- Word
01 Read Me First
Start here. The order of work, a time estimate, a 12-week plan, a map from each requirement family to the walkthrough, policy, and binder folder, and the license terms.
- Word
02 System Security Plan Template
A fill-in System Security Plan with an implementation block for each of the 110 requirements, plus system identification, boundary, Controlled Unclassified Information flow, asset categories, interconnections, roles, and approval.
- Word
03 Level 2 Policies and Procedures
Fill-in policies, one for each of the 14 requirement families, with a statement for each requirement and procedures a small office can follow, ready to edit and adopt as your own.
- Excel
04 Level 2 Self-Assessment and SPRS Workbook
Tabs for scope, all 320 assessment objectives, the SPRS score using the point values in 32 CFR 170.24 (including the partial credit rules for multifactor authentication and encryption), the POA&M, an evidence tracker, and an affirmation checklist.
- Word
05 Level 2 Requirement Walkthrough
All 110 requirements and 320 assessment objectives in plain language: the full requirement text word for word, what to check, a small-shop implementation, evidence to keep, common gaps, the points, and the POA&M rule for each.
- Word
06 POA&M Template
The Plan of Action and Milestones eligibility test from 32 CFR section 170.21, a field-by-field guide, a worked example, a blank register, a closeout record, and an explanation of the 180-day closeout.
- Word
07 SPRS Entry and Affirmation Guide
Step-by-step instructions for entering a Level 2 self-assessment and the affirmation in SPRS, the Conditional and Final statuses, the annual affirmation, the three-year reassessment, and what the senior official affirms.
- PDF
08 Level 2 Evidence Binder Guide
How to organize and label evidence by requirement family, what an assessor typically asks to see, a folder structure, and file naming rules, so you can find proof when you affirm or when an assessor asks.
- PDF
09 Level 2 Proof and Sources
Where every rule in the kit comes from. A register lists each statement a buyer may be challenged on, with the exact official wording, links to the official text and to an archived copy, and the order of authority for when someone tells you something different.
- Zip file
Source Library
The 38 official public documents the kit cites, including 32 CFR Part 170, the clauses in the Federal Acquisition Regulation (FAR) and the Defense Federal Acquisition Regulation Supplement (DFARS), NIST SP 800-171 Revision 2 and 800-171A, the DoD Assessment Methodology, the guides from the DoD Chief Information Officer (CIO), and the SPRS guides, with an index of official links, archived links, and a fingerprint for each file.
Every rule in the kit links to its official source, so you can check the text yourself. CMMC Level 2 is based on NIST SP 800-171 Revision 2, and the kit follows that revision. The kit supports a self-assessment and helps you prepare for a third-party assessment, and it does not replace an assessment that your contract requires.
Three steps, from free to hands-on
Start where it costs nothing, and move up only when you need to.
Free: the Level 1 starter
Use the free Level 1 starter to see which requirements you can already mark as met.
The kit: $497
Work through the requirements, complete the workbook and the System Security Plan, and track any open items in the POA&M template.
Review or assisted help
Add a credentialed review call for $997, or move to a Guided Level 2 Package for $4,500 or a Hands-on Assessment from $9,000. The $497 you paid for the kit is credited in full.
See what the kit files look like · Compare every tier and price
This kit is do-it-yourself, and the price you pay counts toward help
The kit is a product for your company to complete on its own with the files provided. Plan for several weeks. If it becomes too confusing, you can move to our assisted service. Upgrade credit: the full amount you paid for this kit ($497) is credited toward a Guided Level 2 Package ($4,500, remote and document based, with no system access or testing), which leaves $4,003 to pay. The same credit applies to a Hands-on Assessment, where we test your actual systems (quoted per company in a written proposal, from $9,000). If you bought the kit with a review call, the full amount you paid is credited. One credit for each kit purchase. The credit is valid for 12 months from the kit purchase date and is void if the kit is refunded.
Where we work. On-site Hands-on Assessments are available in San Diego County and Orange County, and in Los Angeles County by arrangement. Outside that area, the Guided packages are available remotely. See the Guided and Hands-on page.
Published prices, one company, no subscription
CMMC Level 2 Self-Assessment Kit
All kit files, delivered by email within minutes of payment.
- Every file listed above
- Email support on using the files
- 20 day refund window described in the kit terms
Level 2 Kit + CMMC Certified Professional Review Call
The kit plus one review session of your completed workbook with Thabiti Adams, a CMMC Certified Professional. The review portion is $500 on top of the kit price. Review call: 45 minutes, with the first available time within 5 business days of purchase. The call is valid for 60 days from purchase. If the review call is not held within 60 days of purchase, and we did not cause the delay, we refund the call portion ($500) minus card processing fees.
- Everything in the kit
- One review session of your completed workbook
- Written notes of what to fix before you affirm
Purchases are processed by Stripe. See our privacy policy.
- License. One license covers one company, meaning one legal entity and all of its locations. You may adapt the templates, adopt them as your own policies, and remove the Adams Cloud and Cybersecurity header and footer from documents you adopt. The files are not stamped with your name. You may not resell or redistribute the kit. Consultants and managed service providers need a separate license for each client company. Each client license costs the same as the kit: $297 for Level 1 and $497 for Level 2. Please contact us to set one up.
- Refund. If a file will not open or the kit is not as described on this page, email thabiti@adamscloudcyber.com within 20 days of purchase for a full refund. If you have not downloaded any file, you may ask for a refund within 20 days for any reason. Because downloaded files cannot be returned, a change of mind after download does not qualify for a refund. See the kit terms.
- Review call terms. If you bought the kit with a review call and are not satisfied with the session, ask within 7 days for a free second session of up to 30 minutes. If you are still not satisfied, we refund the call portion ($500). This is not tied to a score, a pass, or a contract award. See the kit terms.
- Support. Questions about using the kit files are answered by email. Support does not include legal advice or a review of your answers, except in the call tiers.
- Seller. Adams Cloud and Cybersecurity LLC, 10006 Three Oaks Way, Santee, CA 92071. Telephone (619) 289-8064.
- Adams Cloud and Cybersecurity LLC is not affiliated with, endorsed by, or authorized by the Department of Defense, The Cyber AB, or ISACA. CMMC Certified Professional (CCP) is a credential issued to an individual by ISACA. These products are not a CMMC assessment and do not provide or imply any CMMC Status.
- Payment. Checkout is handled by Stripe. Your payment receipt comes from Stripe, and your download links come from us by email.
What the kit does and does not do
This kit does not certify you, and it is not legal advice.
No kit, review call, Guided package, or Hands-on Assessment from Adams Cloud and Cybersecurity LLC gives your company a CMMC certification, and none of them confers a CMMC Status. A self-assessment status comes only from your own completed self-assessment and affirmation, entered by your company in SPRS. Nothing here is legal advice. Ask qualified counsel about your contract and your legal exposure.
A senior official of your company affirms the result under the CMMC rule (32 CFR Part 170) and affirms continuing compliance every year. That official is responsible for the accuracy of the statement, and a false or inaccurate affirmation can create liability under the False Claims Act (Title 31 of the United States Code, sections 3729 to 3733). We cannot make the affirmation for you, and we do not enter your results in SPRS.
We do not guarantee any score or any assessment outcome. You still do the work: you answer honestly, collect the proof, and sign. Please do not send us Controlled Unclassified Information, contract documents marked for protection, or passwords.
Before you buy
What do I receive, and how?
An email with a download link for each file. The links expire after 7 days, and you can reply to that email for fresh links. Files arrive as individual Word, Excel, and PDF files.
Will this make my company CMMC certified?
No. A Level 2 self-assessment is your company's own assessment. If your contract requires an assessment by a Certified Third-Party Assessment Organization, only that official process produces the result. No kit or review from Adams Cloud and Cybersecurity LLC gives you a certification or confers a CMMC Status. A self-assessment status comes only from your own completed self-assessment and affirmation, entered by your company in SPRS.
Who signs the affirmation?
A senior official of your company affirms the result and affirms continuing compliance every year. A false or inaccurate affirmation can create liability under the False Claims Act. The kit explains the steps. The affirmation is your company's responsibility.
Will the score workbook give me a correct score?
The workbook applies the official point values to the answers you enter, so the score is only as accurate as those answers. We do not guarantee your score. The accuracy of your answers and evidence, and therefore of your score, is your company's responsibility.
What does the review call add?
For $997 instead of $497, you also get one session with Thabiti Adams to review your completed workbook, score, and System Security Plan before the senior official affirms. It is a review, not an assessment. See the kit terms.
Can I use it for more than one office?
Yes, if the offices belong to the same legal entity. One license covers one company and all of its locations.
What if it is not what I expected?
If a file will not open or the kit is not as described on this page, email thabiti@adamscloudcyber.com within 20 days of purchase for a full refund. If you have not downloaded any file, you may ask for a refund within 20 days for any reason. A change of mind after download does not qualify. See the kit terms and the example of what the files look like.
What if the kit becomes too confusing?
You can move to our assisted service. The full amount you paid for the kit ($497) is credited toward a Guided Level 2 Package ($4,500), which leaves $4,003 to pay, or toward a Hands-on Assessment, which is quoted per company from $9,000. One credit for each kit purchase. The credit is valid for 12 months from the kit purchase date and is void if the kit is refunded. On-site Hands-on Assessments are available in San Diego County and Orange County, and in Los Angeles County by arrangement. See the Guided and Hands-on page.
Built by a credentialed professional, priced in the open
A credentialed person wrote it
Thabiti Adams holds the Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), CMMC Certified Professional (CCP), and CompTIA Security+ credentials and has more than 18 years in information technology and cybersecurity, much of it on the Department of Defense side. He wrote this kit and answers your questions. You do not reach a call center.
Published prices
Every tier and price is on the kit comparison page. There is no sales call to find out what it costs.
One-time pricing
The kit is a one-time purchase. The only planned yearly item is the optional Annual Refresh, which is planned and not yet available. When it opens, it is one payment each year, with a reminder email 14 days before your renewal date. Nothing renews automatically.
Veteran-owned
Based in Santee, California. A Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by the Small Business Administration (SBA), and a California Disabled Veteran Business Enterprise (DVBE).
Thabiti Adams
Build Your Level 2 Self-Assessment
One company license, one price, no subscription. Full refund within the 20 day refund window if a file will not open or the kit is not as described.