Government, Defense & Trade · Audits cleared · Hours back · sample run · 63 ms

CMMC Level 2 Gap Matrix

SPRS score 87 of 110: Conditional Level 2 status is not available because the score is below 88 and 5 open requirements cannot go on a POA&M.

Evidence · Self-assessment

AU.L2-3.3.5,Audit Correlation,Not Met,IT Operations (R. Delgado),Logs are kept per server; there is no SIEM to correlate audit records.

Working

The self-assessment marks 3.3.5 'Not Met', so 5 points are deducted. Only 1-point requirements may go on the POA&M (32 CFR 170.21(a)(2)(ii)), so this 5-point item must be met first.

Method

1Scoring follows the NIST SP 800-171 DoD Assessment Methodology v1.2.1: start at 110 and subtract the Annex A point value (5, 3 or 1) of every requirement that is not implemented.

2Not Applicable counts as implemented. Partially Met scores as not implemented, except 3.5.3 (3 points when MFA covers remote and privileged users only) and 3.13.11 (3 points when encryption is not FIPS-validated).

Photo: Terence Burke, Unsplash

87 / 110

SPRS score · Minimum 88 for conditional status

Requirement	Practice	Title
3.3.5	AU.L2-3.3.5	Audit Correlation
3.11.2	RA.L2-3.11.2	Vulnerability Scan
3.5.3	IA.L2-3.5.3	Multifactor Authentication

Reads

Control implementation status for the 110 NIST SP 800-171 requirements

Produces

SPRS score, POA&M eligibility and a POA&M file (POA&M (12 items), SPRS score summary, Open requirements (CSV))

Price

$3,500 / month, 30% to the referring partner

Your files

Read in memory for the session, never stored, never used to train a model.

Open on sample data Start the 14-day trial

Not a legal opinion on government contract compliance. Confirm results with contracts counsel. Screening is not clearance. Classification and sanctions decisions remain yours and your licensed trade counsel's or customs broker's.