Requirements
The 110 NIST SP 800-171 requirements
NIST SP 800-171 Rev 2 sets out 110 security requirements for protecting controlled unclassified information (CUI) in a contractor's own systems, in 14 families. DFARS 252.204-7012 makes them the standard a defense supplier implements, and CMMC Level 2 scores them by the method in 32 CFR 170.24: start at 110, and each requirement not met takes away its 5, 3 or 1 points. Each family's page gives every requirement in NIST's words, its points, the assessment objectives of NIST SP 800-171A, and how to meet it.
To mark each requirement and see the score, use the free SPRS score calculator. How the score works and what a good one is: SPRS score explained. Which gaps a plan of action may hold: POA&M rules.
Points are what a family can cost when none of it is met. 3.12.4, the system security plan, has no points of its own: without one there is no score at all.
Family by family
3.1 Access Control
22 requirements, 54 points when none is met (7 worth 5, 2 worth 3, 13 worth 1). Two of them, 3.1.20 and 3.1.22, may never be on a POA&M: a CMMC Level 2 status needs them met.
3.2 Awareness and Training
3 requirements, 11 points when none is met (2 worth 5, 1 worth 1).
3.3 Audit and Accountability
9 requirements, 19 points when none is met (2 worth 5, 1 worth 3, 6 worth 1).
3.4 Configuration Management
9 requirements, 33 points when none is met (6 worth 5, 3 worth 1).
3.5 Identification and Authentication
11 requirements, 27 points when none is met (4 worth 5, 7 worth 1).
3.6 Incident Response
3 requirements, 11 points when none is met (2 worth 5, 1 worth 1).
3.7 Maintenance
6 requirements, 18 points when none is met (2 worth 5, 2 worth 3, 2 worth 1).
3.8 Media Protection
9 requirements, 23 points when none is met (2 worth 5, 3 worth 3, 4 worth 1).
3.9 Personnel Security
2 requirements, 8 points when none is met (1 worth 5, 1 worth 3).
3.10 Physical Protection
6 requirements, 14 points when none is met (2 worth 5, 4 worth 1). Three of them, 3.10.3, 3.10.4 and 3.10.5, may never be on a POA&M: a CMMC Level 2 status needs them met.
3.11 Risk Assessment
3 requirements, 9 points when none is met (1 worth 5, 1 worth 3, 1 worth 1).
3.12 Security Assessment
4 requirements, 13 points when none is met (2 worth 5, 1 worth 3; 3.12.4, the system security plan, has no points of its own). One of them, 3.12.4, may never be on a POA&M: a CMMC Level 2 status needs it met.
3.13 System and Communications Protection
16 requirements, 42 points when none is met (6 worth 5, 1 worth 3, 9 worth 1).
3.14 System and Information Integrity
7 requirements, 31 points when none is met (5 worth 5, 2 worth 3).