Plan a CMMC Level 2 gap assessment that produces actionable work

Level 2 control context — captured from the supplied CMMC Pulsar walkthrough — Illustrative CMMC Pulsar product view. The workflow suggestions in this guide must be adapted to your actual environment.

Confirm the baseline and assessment path

Read the applicable contract requirements and current implementation guidance before planning around a deadline or assessment type. The official CMMC implementation notice reports a suspension of Phase II while Phase I requirements remain in place. That notice does not justify ignoring other applicable contract or safeguarding obligations.

For the CMMC Level 2 baseline, consult 32 CFR 170.14 and the incorporated NIST requirements. NIST’s publication status and a contract’s incorporated baseline are different questions. Record the basis for the baseline you use so the team does not silently mix objectives from different revisions.

Build the scope and review plan together

Apply the Level 2 asset categories and provider provisions in 32 CFR 170.19. Connect the inventory, SSP, diagram, and provider relationships before distributing a control questionnaire. Identify the people who can explain each part of the implementation and the records needed for the review.

Plan examination, interviews, and testing around the objectives rather than asking only whether a policy exists. If one person cannot answer every technical question, involve the relevant owner. A finding based on missing information should remain distinguishable from a verified implementation deficiency until the investigation resolves it.

Write findings that someone can act on

Describe the requirement, observed condition, affected systems, supporting basis, and practical consequence. Then assign the action, owner, dependencies, target milestone, and closure method. Separate a missing document from a missing technical implementation because their corrective actions differ.

A fictional organization may have a documented review process that no one performs. Rewriting the document does not address the operating gap. Conversely, a working safeguard may need a clearer explanation and supporting record. Keep those distinctions visible so the remediation plan directs effort to the actual problem.

Verify closure before updating the conclusion

After the change, recheck the affected implementation and evidence. Review whether the SSP, diagram, procedure, or responsibility matrix also needs revision. Keep the original finding and closure basis traceable in the controlled project record.

Prioritize work by the applicable requirements, dependencies, and risk, then confirm any formal assessment or POA&M rules separately. Avoid treating an internal readiness percentage as an official CMMC result. Use the evidence index and responsibility matrix to keep the work understandable across the team.

Sources & further reading

Published October 24, 2026. Government and company references were checked while preparing this page. General information and practical workflow suggestions; confirm the requirements and services that apply to your organization.

Plan a CMMC Level 2 gap assessment that produces actionable work

Confirm the baseline and assessment path

Build the scope and review plan together

Write findings that someone can act on

Verify closure before updating the conclusion

Sources & further reading

Another useful perspective.

CMMC evidence, SSPs, and POA&Ms: how to keep the story consistent

Build a CMMC network diagram that explains the real environment

Create an evidence index that answers the reviewer’s next question

Make the work easier to follow.