CMMC Level 2 Assessment Tool

• Download the Self-Assessment Excel workbook here.
• Save in a secure folder.
• When you open the file, you will see this protected view message.
  
  Click Enable Editing.
• On the home tab, enter the name of your company in the green field.
• You can see the navigational links to the assessment questions organized by CMMC Domain.
• The dashboard will be populated as you start to answer the questions.

• Select one of the CMMC domains by clicking on the appropriate link on the home tab. You may also go to the tab directly.
• Each tab has a two-letter abbreviation for the domain. For example, AC = Access Control. On each tab, you will see a way to update your CMMC Practice Readiness.
• CMMC Practice Readiness:
  • The number of each practice is listed on the left.
  • In the white box, you will see the practice number and summary. The format of the practice number is the following:
    • For example, AC.1.001
    • The first two letters are for the practice abbreviation (AC is for "Access Control")
    • Next, there is a single digit for the level -- for example, "1" is for Level 1.
    • Then there is a 3-digit number.
• You will also enter the readiness status of your two different types of "Objective Evidence" that the CMMC assessor may want to review for each practice.
• SPECIAL NOTE: The practice number and summary description are hyperlinked to our online reference guide. If you want more information about any practice, simply click on this link.

You can indicate the status of the practice implementation in the green boxes.

As you complete the answers, the answers in the Dashboard will start to change!

When you click on the green answer box, you will see a pull-down option to the bottom right of the cell.

You can select from the following options:

• Yes - You have completely implemented this practice.
• It does not apply - You feel that this practice does not apply to your company or your system configuration.
• Partially - You have partially implemented this practice.
• I've done an alternative approach - You have implemented a workaround ("compensating controls") for this practice.
• No - You have not done any implementation work for this practice.
• No Answer - You have not answered the question. This is the default answer.

The home page has links to both Practice Implementation Dashboards and Objective Evidence Dashboards

Practice Answers Dashboard: This is a pie chart that shows the distribution of your answers (Yes, It Does Not Apply, Partially, I have done an alternative approach, No, No Answer) for all of the domains. Underneath is a horizontal bar chart that shows the breakdown by domain.

• There is a pie chart for a practice score for all domains, followed by a horizontal bar chart for a breakout of process readiness by domain.
  

Objective Evidence (OE) Answer Dashboard: This will show a distribution of your OE answers (Completed, Partially Completed, Not Yet Started, No answer) in a pie chart for all domains and a horizontal bar chart for a break out by domain.

Composite Dashboard: We are in the process of creating a composite dashboard that will be available for suppliers who decide to upload a summary of the self-assessment information to the CMMC Academy.

On the Home tab and at the top of each of the domain tabs, there are links where you can see details of practices or Objective Evidence based on completion level.

This is a new mechanism that we are excited about. We believe it can be beneficial to individual suppliers as well as to communities. Overview:

• Suppliers can upload summary information from their CMMC self-assessment to the CMMC Academy. This will not upload details of individual practices or processes. It is an ability to share the statistics of your practice, and OE results only.
• Defense Supplier Views: Defense suppliers will be able to upload their summary information and indicate their country. As a result, they will be able to see:
  • A basic dashboard of results (initially, this will be similar to what you can see in the spreadsheet)
  • Future dashboard functions of composite scores and historical views
  • Future Global Readiness Views – based on data from all suppliers (anonymous)
  • Future Benchmarking views.

We want to encourage defense suppliers to periodically upload and update their summary information so we can track the evolving state of global CMMC readiness. You will be able to see uploaded global readiness information when you update your data.

• Future: Multi-Department, Business Unit Reports. This is an area we are researching to provide suppliers with aggregate reporting across multiple departments or business units. Because of the extra cost we would incur and the reporting technology we would use, this would be a fee-based solution from Celerium. In the feedback form, you can let us know if this function would be of interest or not.

• Industry Views: The CMMC Academy may also make some of the global high-level views available on a public basis or to selected government organizations.

Sharing your data with others: To understand the details of data sharing, you should review the Celerium “Privacy Policy” here: https://www.celerium.com/privacy

How to share information:

Give us feedback on what you like, and don't like about the solution as well as any problems or ideas here: support@celerium.com

This Self-Assessment Solution includes questions and/or notes published by the DOD as of the date set forth. Where no assessment questions or notes are yet published, Celerium has included some based on our interpretation of the requirements at the time, which may or may not be accurate and are subject to change. Registered CMMC Academy Members may use and modify this Self-Assessment Tool as you deem appropriate solely for your internal CMMC compliance self-assessment. This tool is not intended to replace legal or compliance advice or review.

USE OF THIS SELF-ASSESSMENT TOOL IS AT YOUR OWN RISK. NEITHER CELERIUM, ITS AFFILIATED COMPANIES, NOR ANY PERSON ASSOCIATED WITH CELERIUM MAKES ANY WARRANTY, GUARANTY, OR REPRESENTATION WITH RESPECT TO THE ACCURACY, COMPLETENESS, RELIABILITY, OR VALIDITY OF THIS TOOL OR ANY OF ITS CONTENT.

CELERIUM DOES NOT WARRANT OR GUARANTY THE TOOL IS UP TO DATE WITH RESPECT TO THE CURRENT STATUS OF THE CMMC CERTIFICATION REGULATIONS OR GUIDELINES. CELERIUM SHALL HAVE NO RESPONSIBILITY OR LIABILITY FOR YOUR USE OF OR RELIANCE ON THIS SELF-ASSESSMENT TOOL.