---
title: "CMMC Scoring Explained: SPRS Scores & the 110-Point System"
description: "Learn how CMMC scoring works, including SPRS scores, the 110-point methodology, score calculations, and what contractors need to pass."
canonical: "https://axipro.co/cmmc-scoring/"
language: "en-US"
modified: "2026-07-07T03:42:21+00:00"
generator: "WordPress 7.1"
---

[Home](https://axipro.co)

/ [CMMC](https://axipro.co/category/cmmc/)

/ CMMC Scoring Explained: SPRS Scores & the 110-Point System

# CMMC Scoring Explained: SPRS Scores & the 110-Point System

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

- Pedro Dias
- June 12, 2026

Copy Link

Every defense contractor that handles [Controlled Unclassified Information (CUI)](https://www.archives.gov/cui) has a number attached to its CAGE code in a DoD database.

That number ranges from -203 to a perfect 110 and most organizations that calculate it honestly for the first time land somewhere they would rather not advertise.

This guide covers how CMMC scoring works: where the number comes from, what counts as a passing score at each CMMC level, how to calculate and submit a score in SPRS, and where Plans of Action and Milestones (POA&Ms) fit in.

![CMMC Scoring Explained](https://axipro.co/wp-content/uploads/2026/06/CMMC-Scoring-Explained-1024x535.png)

## **What Is CMMC Scoring?**

[CMMC 2.0 is the Department of Defense program](https://axipro.co/what-is-cmmc-compliance/) for verifying that companies in the Defense Industrial Base (DIB) actually protect Federal Contract Information (FCI) and CUI, rather than simply attesting that they do. The program rule, [32 CFR Part 170](https://www.federalregister.gov/documents/2024/10/15/2024-21527/cybersecurity-maturity-model-certification-cmmc-program), took effect in December 2024, and the acquisition rule that inserts CMMC requirements into contracts via [DFARS 252.204-7021](https://www.acquisition.gov/dfars/252.204-7021-contractor-compliance-cybersecurity-maturity-model-certification-program.) began phasing in from November 2025. Phase 2, which makes third-party certification the default for contracts involving CUI, arrives in November 2026.

CMMC scoring is the quantitative layer underneath all of this. At Level 2, the score measures implementation of the 110 security requirements of [NIST SP 800-171](https://axipro.co/cmmc-vs-nist-800-171/), the standard that has applied to contractors handling CUI since DFARS 252.204-7012 made it mandatory. CMMC did not invent new controls at Level 2; it created a verification and scoring regime around controls contractors were already obligated to implement.

The score matters for three practical reasons. It determines contract eligibility, because solicitations now specify a required CMMC status and contracting officers check SPRS before award. It drives prime contractor flow-downs, since primes must verify subcontractor scores before passing CUI down the supply chain. And it creates legal exposure: a senior official affirms the score, and a knowingly inflated number is a [False Claims Act](https://www.justice.gov/civil/false-claims-act) problem, not a paperwork problem.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **Understanding the SPRS Scoring System**

The [Supplier Performance Risk System (SPRS)](https://www.sprs.csd.disa.mil/) is the DoD’s authoritative source for supplier risk information. For cybersecurity purposes, it stores the results of NIST SP 800-171 assessments and CMMC statuses against each contractor’s CAGE code. Contracting officers, programme offices, and DCMA personnel query it routinely; prime contractors can verify that a subcontractor has a current assessment on file.

**SPRS does not perform the assessment.** It is a reporting database. Self-assessment scores are entered directly by the contractor through the [Procurement Integrated Enterprise Environment (PIEE)](https://piee.eb.mil/). Results of third-party certification assessments are entered by the C3PAO into the CMMC instance of eMASS, which then populates SPRS automatically.

The relationship between an SPRS score and CMMC certification is straightforward: same methodology, different assessor. The self-assessment score is your own claim about your posture. A [CMMC Level 2 certification](https://axipro.co/cmmc-certification/) is the same 110 requirements scored by a [Certified Third-Party Assessment Organization (C3PAO)](https://axipro.co/cmmc-registered-practitioner/), with the result carrying formal status under the programme rule. A contractor whose self-reported 110 collapses to 60 under C3PAO scrutiny has a credibility problem on the record.

## **The CMMC Scoring Methodology Explained**

The methodology comes from the [NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1](https://dodcio.defense.gov/Portals/0/Documents/CMMC/MemoAssessmentMethodologyV1.2.1.pdf), now codified for CMMC in 32 CFR 170.24. **Every organisation starts at the maximum of 110 points.** For every requirement scored NOT MET, a weighted value of 1, 3, or 5 points is subtracted.

The weighting reflects security impact. Five-point requirements are those whose absence exposes the network or CUI directly. Three-point requirements have a specific, meaningful effect on security. One-point requirements have a limited or indirect effect. Because total possible deductions add up to 313, the floor is -203. **Negative scores are common on a first honest assessment**, and they are not a clerical curiosity: a deeply negative number visible to a contracting officer signals an organisation years away from certification.

**There is no partial credit.** A requirement that is 90 percent implemented deducts its full point value, exactly like one that was never started. The only two exceptions are multi-factor authentication (3.5.3), which deducts 3 points instead of 5 if MFA covers remote and privileged users but not all users, and [FIPS-validated encryption](https://axipro.co/cmmc-encryption-requirements/) (3.13.11), which deducts 3 points instead of 5 if encryption is in place but not FIPS-validated. Everything else is binary.

One further prerequisite catches people out: a **System Security Plan (3.12.4) must exist at the time of assessment.** Without an SSP describing how each requirement is met, the assessment cannot be completed at all, and the absence is treated as non-compliance with DFARS 252.204-7012 rather than as a scoring deduction.

![CMMC Levels](https://axipro.co/wp-content/uploads/2026/06/CMMC-Levels--1024x683.jpg)

## **CMMC Score Requirements by Level**

Scoring works differently at each of the three CMMC levels, and the term passing score means something different at each.

### Level 1

[Level 1 sits apart from both](https://axipro.co/cmmc-level-1-requirements/) Level 2 and Level 3: it requires an annual self-assessment of just 15 basic safeguarding requirements, carries no numeric score, permits no POA&Ms, and requires only an annual affirmation. There is no minimum number to hit because the assessment is pass/fail on each individual requirement.

### Level 2

At **Level 2**, the 110-point methodology applies in full. A score of 110 earns Final Level 2 status. A score of at least 88, where every unmet requirement is POA&M-eligible under 32 CFR 170.21, earns Conditional Level 2 status — but only as a temporary bridge to the full 110. At

### Level 3

**Level 3**, the bar rises further: organizations must first hold Final Level 2 status from a C3PAO assessment, then undergo a DIBCAC-led assessment against the 24 enhanced requirements drawn from [NIST SP 800-172 requirements](https://axipro.co/nist-csf-certification/), each worth a single point.

**The Level 2 thresholds deserve emphasis because they are widely misread.** A score of 88 does not mean you passed. It means you are eligible for Conditional Level 2 status, and only if every unmet requirement is one the rule allows on a POA&M.

Conditional status starts a 180-day clock. Final Level 2 status requires the full 110, achieved either at the initial assessment or at the POA&M closeout assessment.

## **How to Calculate Your CMMC Score**

The most reliable way to calculate your score is to work through all 110 requirements at the assessment-objective level using [NIST SP 800-171A](https://csrc.nist.gov/pubs/sp/800/171/a/final), the companion publication assessors use. A single requirement can contain a dozen objectives, and one failed objective fails the requirement. Conducting a [NIST SP 800-171 gap assessment](https://axipro.co/services/gap-analysis/) at this level of granularity is what separates a defensible score from an optimistic one.

Once gaps are identified, map each NOT MET requirement to its point value using Annex A of the DoD Assessment Methodology. Tag every gap with its 1, 3, or 5 point weight, applying the two partial-scoring rules for 3.5.3 and 3.13.11 where relevant. Then document implementation status in the SSP: for each requirement, the SSP should state how it is implemented, where, and by what mechanism. **Requirements that are technically enforced but undocumented are routinely scored NOT MET in third-party assessments**, because the assessor scores what can be evidenced, not what exists in theory.

Finally, sum the deductions and subtract from 110. An organization missing two 5-point, three 3-point, and four 1-point requirements scores 110 minus 23, or 87, one point short of Conditional eligibility, which is exactly the kind of margin that makes the weighting worth understanding before an assessment rather than after.

### Pro Tip: Score Yourself

Score yourself against the assessment objectives in NIST SP 800-171A, not the requirement text in 800-171. Self-assessments done at the requirement level run optimistic because a control that is "mostly there" feels met. Assessors work objective by objective, and the CMMC Level 2 Assessment Guide shows precisely how they will score you. Using the same lens removes the gap between your number and theirs.

## **How to Submit Your CMMC Score in SPRS**

Submission runs through PIEE. Register an account, request the SPRS Cyber Vendor role for your CAGE code, and wait for your Contractor Administrator to approve it. Once inside SPRS, the NIST SP 800-171 assessment entry asks for a defined set of fields: the assessment date, the summary score, the [scope (enterprise, enclave, or contract-specific)](https://axipro.co/cmmc-enclave-guide/), the CAGE codes covered, the SSP name and version the assessment was performed against, and a planned date by which a score below 110 will reach 110.

**The supporting documentation does not get uploaded.** The SSP, the assessment workpapers, and the POA&M stay with you, but they must exist and they must reconcile with the submitted number — because they are exactly what DIBCAC reviews if your score is ever checked under a medium or high assessment.

Keep the record current. A score must be refreshed at least every three years to remain valid, the senior official’s affirmation of continuing compliance recurs annually under 32 CFR 170.22, and a material change to the environment — such as a cloud migration or a new system handling CUI — means recalculating and resubmitting rather than waiting for the cycle.

Reach SOC 2 Compliance in 6 Weeks or Less

Schedule Your Free SOC 2 Assessment Today

[Schedule](https://axipro.co/free-assessment/)

## **The Role of POA&Ms in CMMC Scoring**

A Plan of Action and Milestones is a time-bound remediation plan for requirements scored NOT MET: what the deficiency is, what will fix it, who owns it, and by when. Under CMMC, its use is far narrower than most contractors assume. 32 CFR 170.21 permits POA&Ms only to reach Conditional status, and only when all of the following hold: **the assessment score is at least 88, every POA&M item is a 1-point requirement**, and none of the specifically prohibited requirements appear on the plan.

The 180-day window is rigid. The clock starts on the Conditional status date, and every POA&M item must be closed and verified through a POA&M closeout assessment within it. For a certification assessment, the closeout is performed by a C3PAO. If items remain open at day 180, the Conditional status expires, the organisation becomes ineligible for awards requiring that status, and the entire assessment must be repeated.

**Insider note:** *There is exactly one situation in which something heavier than a 1-point item can sit on a POA&M — [FIPS-validated encryption](https://axipro.co/cmmc-encryption-requirements/) (3.13.11), and only in its partial state. If encryption is deployed but not FIPS-validated, the 3-point deduction is POA&M-eligible. If no encryption is in place at all, the full 5-point deduction applies, and the requirement cannot be deferred. In practice, this makes cryptographic module validation the single most consequential procurement question in a Level 2 readiness project.*

## **Common CMMC Scoring Mistakes to Avoid**

**Overstating the self-assessment.** When DIBCAC has reviewed self-reported scores under medium and high assessments, independently verified numbers have frequently come in dramatically below what contractors submitted. The gap is rarely fraud; it is requirement-level scoring, charitable interpretation, and confusing planned with implemented. The POA&M trap sits here too: a requirement on a plan of action is still NOT MET and still deducts its full point value.

**An SSP that does not match reality.** Assessors triangulate the submitted score, the SSP, and observable evidence. When the SSP describes controls that interviews and technical testing cannot confirm, the requirement fails — and the credibility of every other claim in the document drops with it.

**Arithmetic and weighting errors.** Treating partially implemented requirements as met, missing the two partial-scoring exceptions, or working from an outdated copy of the methodology all produce a number that will not survive verification.

**Letting the POA&M go stale.** Milestones without owners and dates, or items that quietly slip past their completion dates, convert a Conditional status into an expired one. The 180-day closeout is not extendable.

### Pro Tip: The annual affirmation under 32 CFR 170.22

The annual affirmation under 32 CFR 170.22 is signed by a named senior official, and the Department of Justice has pursued False Claims Act cases against contractors over misrepresented cybersecurity compliance through its Civil Cyber-Fraud Initiative. An optimistic score is no longer a private estimate; it is a federal representation with a signature on it.

## **How to Improve Your CMMC Score**

**Sequence remediation by weight, not by ease.** Closing five 1-point documentation gaps moves the score five points; closing one 5-point technical control moves it the same distance and removes a requirement that can never sit on a POA&M. The 5-point population — which includes boundary protection, access control enforcement, flaw remediation, and audit logging — is where both the score and the actual security risk concentrate.

Next, close the documentation layer. A meaningful share of NOT MET findings in otherwise capable organisations are evidence failures: the control runs, but no policy requires it, no procedure describes it, and no artefact proves it. Fixing this is cheap relative to its scoring impact.

Finally, **treat the score as a maintained asset.**Configuration drift, expired FIPS certificates after patching, and new systems entering scope all erode a score between assessments. Continuous monitoring tied to the SSP, with the score recalculated whenever the environment changes materially, keeps the SPRS record defensible and avoids a scramble before the next triennial cycle.

## **Self-Assessment vs. Third-Party Assessment Scoring**

The methodology is identical in both paths; what changes is who applies it, how evidence is tested, and what the result is worth contractually.

In a **self-assessment**, the contractor scores its own environment, enters the result in SPRS, and a senior official affirms it. This satisfies the requirement for contracts that specify only the basic DFARS 252.204-7012 reporting obligation or a CMMC Level 1 or Level 2 self-assessment status. The score is the contractor’s own claim, and it carries the legal weight of that affirmation.

In a **third-party assessment**, a [Certified Third-Party Assessment Organization (C3PAO)](https://axipro.co/cmmc-registered-practitioner/) applies the same 110-requirement methodology with independent evidence testing — document review, interviews, and technical observation — across the defined assessment scope. The result is entered into eMASS and flows to SPRS as a formal certification status rather than a self-reported number. For Level 3, the assessor is DIBCAC rather than a C3PAO, and the additional 24 requirements from [NIST SP 800-172](https://axipro.co/nist-csf-certification/) are scored on top of a confirmed Final Level 2 foundation.

[Level 1 sits apart from both](https://axipro.co/cmmc-level-1-requirements/): a simple annual self-assessment of 15 requirements with no numeric score, no POA&Ms, and an annual affirmation. Organisations that completed a Joint Surveillance Voluntary Assessment (JSVA) with DIBCAC before the rule took effect were able to convert a perfect result into early certification standing, which is why JSVA alumni dominate the first wave of certified companies.

CMMC scoring rewards organizations that measure themselves the way an assessor would: objective by objective, evidence first, weighted gaps prioritized, and a POA&M used as a short runway rather than a parking lot.

***The contractors who struggle are almost never the ones with the worst security; they are the ones whose number was built on assumptions instead of assessment.***

## Frequently Asked Questions

What is the minimum SPRS score for CMMC Level 2?

Final Level 2 status requires 110. A score of at least 88 can earn Conditional Level 2 status, but only if every unmet requirement is POA&M-eligible under 32 CFR 170.21 and all items close within 180 days.

How often do I need to submit my SPRS score?

A score is valid for three years, but the senior official’s affirmation of continuing compliance is annual, and any material change to the assessed environment requires recalculating and resubmitting before the cycle ends.

What happens if my SPRS score is negative?

Nothing automatic, but it is visible to contracting officers and primes as a clear signal of non-implementation, and it places Conditional eligibility (88) far out of reach. First honest assessments commonly land negative; the response is a weighted remediation plan, not a resubmission.

Can I bid on DoD contracts with a low SPRS score?

Where only the self-assessment reporting requirement applies, a current score of any value can satisfy the letter of the rule. Once a solicitation specifies a CMMC status under DFARS 252.204-7021, the required status is an eligibility condition, and a low score means no award.

How long is my SPRS score valid?

Three years from the assessment date, subject to the annual affirmation and to resubmission if the environment changes materially.

What is the difference between an SPRS score and a CMMC certification?

The SPRS score is a self-reported number under the DoD Assessment Methodology. A [CMMC Level 2 certification](https://axipro.co/cmmc-certification/) is a formal status — Conditional or Final — resulting from an assessment by a C3PAO at Level 2 or DIBCAC at Level 3, using the same scoring rules. The first is a claim; the second is a verified credential.

Who has access to my SPRS score?

SPRS is not public. DoD personnel — including contracting officers, program offices, and DCMA/DIBCAC — can view it, and prime contractors can confirm whether a subcontractor holds a current assessment when verifying flow-down compliance.

Axipro Author

![Picture of Pedro Dias](https://axipro.co/wp-content/uploads/2026/05/pedro-passport-picture-scaled.jpg)

### Pedro Dias

Pedro has been writing online for over 10 years. With experience in all things programming, cyber security, and compliance, he is our editor-in-chief at Axipro.

- June 12, 2026
- [CMMC](https://axipro.co/category/cmmc/)

Copy Link

## Blog Highlights

## Explore More Articles

[Read More Blogs](https://axipro.co/blog/)

- [GDPR](https://axipro.co/category/gdpr/)

- September 15, 2026

#### [KVKK vs GDPR: Key Compliance Gaps for Turkish Exporters](https://axipro.co/kvkk-vs-gdpr-turkish-exporters/)

The EU buys more from Türkiye than anyone else. According to the European Commission’s trade profile for Türkiye, about 41% of Turkish goods exports went to the EU in 2024, and the share keeps climbing. Nearly every company behind those shipments holds some EU personal data: a buyer’s name in the CRM, a webshop account, a logistics contact, a support ticket. That data puts the exporter inside the GDPR, and a KVKK compliance file won’t answer the questions an EU customer’s procurement team is going to ask. KVKK and GDPR look alike, and the 2024 amendments brought them closer. They’re still two laws with two regulators, two sets of paperwork and very different fine ceilings. This article walks through the eight places where a KVKK-compliant Turkish exporter falls short of GDPR, covers both directions of data flow, and ends with a roadmap that reflects how long this stuff actually takes. Why KVKK Compliance Doesn’t Make a Turkish Exporter GDPR-Ready Law No. 6698 was written to line Türkiye up with the EU’s 1995 Data Protection Directive. It came into force in April 2016, a few weeks before the EU adopted the GDPR. That timing explains most of what follows. KVKK inherited the Directive’s structure and then developed on its own track under the Personal Data Protection Board, while the GDPR added accountability tools, extraterritorial reach and turnover-based fines that the Directive never had. So a Turkish company can be fully KVKK compliant, registered in VERBİS, privacy notices in place, and still have no records of processing, no DPIA method, no EU representative, and no answer for an EU customer asking which Article 46 mechanism covers the data they’re about to send to Istanbul. When GDPR Applies to a Turkish Company Article 3(2) of the GDPR catches companies with no EU establishment in two situations: offering goods or services to people in the EU, and monitoring their behavior. The European Data Protection Board’s guidelines on territorial scope treat euro pricing, shipping to EU addresses, EU-language storefronts and EU-targeted marketing as “offering.” Analytics, retargeting pixels and personalization count as “monitoring.” There’s a third route that’s easy to miss. A Turkish software house or contract manufacturer that processes EU personal data for an EU customer is a processor under Article 28. The customer will want a data processing agreement, security commitments and help meeting its own GDPR obligations, even if the Turkish company never markets to the EU at all. Important: Selling only B2B to EU companies doesn’t get you out of this. Business contacts are data subjects. The names, emails and phone numbers of a German buyer’s purchasing staff are personal data under both laws, and the exporter is the controller of them. KVKK vs GDPR at a Glance Obligation KVKK (Law No. 6698, as amended 2024) GDPR (Regulation (EU) 2016/679) Default legal basis Explicit consent, with listed exceptions including legitimate interest Six equal lawful bases; consent is one of them Registry Mandatory VERBİS registration for most controllers No public registry; internal Article 30 records Impact assessment No statutory DPIA Mandatory DPIA for high-risk processing DPO Not required Required in defined cases (Article 37) Representative abroad Foreign controllers appoint a Türkiye representative Non-EU controllers appoint an EU representative (Article 27) Data portability Not granted Granted (Article 20) Breach notice Board within 72 hours Supervisory authority within 72 hours Transfers Adequacy, Turkish standard contracts, BCRs; 5-business-day filing Adequacy, EU SCCs, BCRs; transfer impact assessment Maximum fine ₺17,092,242 in 2026 €20 million or 4% of global turnover Gap 1: Lawful Bases and Consent KVKK’s Article 5 puts explicit consent at the top and lists everything else as an exception. Turkish privacy notices reflect that, and most of them lean on consent for almost everything. The GDPR treats consent as one option among six, and in practice it’s the weakest one for core business processing. Regulators expect contract performance for order fulfillment, legal obligation for tax records, and legitimate interest for fraud prevention and B2B marketing. Consent also has a cost that exporters don’t always price in. Under Article 7 it has to be as easy to withdraw as it was to give, and once it’s withdrawn the processing has to stop. An exporter that collects EU customer data “with consent” and then keeps invoicing records for ten years has written a contradiction into its own notice. Law No. 7499 closed one part of this gap in 2024. Health and sexual-life data lost their special carve-out and the list of grounds for processing sensitive data got longer, so KVKK Article 6 now tracks GDPR Article 9 fairly closely. An exporter’s KVKK approach to sensitive data can be reused for GDPR with light editing. Cookies are another point of convergence. The Board’s cookie guidance already asks for opt-in consent for anything beyond strictly necessary cookies, a reject button as visible as the accept one, and no pre-ticked boxes. A banner built to that standard will pass with most EU supervisory authorities too. Gap 2: Accountability Documentation KVKK asks controllers to register in VERBİS, the public Data Controllers’ Registry, and to keep a processing inventory behind that registration. The GDPR has no registry. What it has instead is Article 30: an internal record of processing activities that a supervisory authority can demand at any time, covering purposes, data categories, recipients, transfers, retention periods, and security measures. The VERBİS inventory gets you roughly 70% of the way to an Article 30 record. What’s usually missing is the lawful basis for each purpose (VERBİS doesn’t push for it at the same level of detail), the transfer mechanism per recipient, and the Article 28 processor list. The bigger gap is the Data Protection Impact Assessment. KVKK has nothing like it. GDPR Article 35 makes a DPIA mandatory before high-risk processing starts, and an EU customer may ask to see one before signing. Building the method takes a few weeks. Retrofitting DPIAs onto processing that’s already live takes longer, and it tends to turn up things nobody wanted to find. Insider

[Read more](https://axipro.co/kvkk-vs-gdpr-turkish-exporters/)

- [ISO 42001](https://axipro.co/category/iso-42001/)

- September 11, 2026

#### [The ISO 42001 Gap Analysis Checklist Consultants Actually Use](https://axipro.co/iso-42001-gap-analysis-checklist/)

A consultant-grade ISO 42001 gap analysis checklist has 38 Annex A controls, roughly 80 clause-level “shall” statements, and one question attached to every line: where is the evidence, and would a certification body accept it? That last question is what separates the checklists consultants use from the free self-assessment spreadsheets that rank for the same search. This article lays out the checklist itself: what a consultant checks before the engagement starts, the clause-by-clause and control-by-control checkpoints, how evidence gets sampled, how gaps get scored, what the deliverables look like, and what fails most often. Use it to run your own assessment, or to check whether the consultant you’re about to hire is doing the job properly. What Makes a Consultant-Grade ISO 42001 Gap Analysis Checklist Different​ Depth of Evidence Review vs. Self-Assessment Tools A self-assessment tool asks whether you have an AI policy. A consultant asks to see it, checks the approval date and version, reads clause 5.2 against it, and then asks three people in engineering whether they’ve read it. The checklist item is the same. The evidence standard is not. Consultants score every item on three levels: documented, implemented, and effective. A policy that exists but nobody follows scores as “ad hoc,” not “defined.” A control that runs but produces no record scores as unverifiable, which for audit purposes is the same as absent. Self-assessment tools collapse those three levels into a single yes/no, which is why companies that score 85% on a free tool routinely receive major nonconformities at Stage 2. Alignment with Certification Body Expectations Certification bodies auditing against ISO/IEC 42001:2023 now work under ISO/IEC 42006:2025, which sets competence, audit-time, and impartiality requirements for AIMS auditors and builds on ISO/IEC 17021-1. A consultant-grade checklist is written with 42006 in mind: it organizes findings by clause and control identifier, because that’s how the auditor works, and it records evidence locations, because that’s what the auditor will sample. The practical difference shows up in the report. A gap register that says “AI governance needs improvement” is useless in front of an auditor. One that says “A.5.2 not conformant: no documented impact assessment process; two of four in-scope systems have no assessment on file” maps directly to the audit plan. Risk-Weighted Scoring Methodology Self-assessments count gaps. Consultants weight them. A missing AI policy under clause 5.2 and an incomplete competence matrix under 7.2 are both gaps, but the first will block certification and the second will earn you a minor finding. A consultant-grade checklist carries two scores per line: a maturity rating (how far the control is from working) and a certification criticality (what happens at audit if it stays this way). Effort estimates live in the remediation plan, never in the gap score, because mixing them produces a roadmap that fixes easy things first rather than important ones. Insider Note: The fastest tell that a checklist is consultant-grade rather than a marketing download is whether it has a column for evidence location. Auditors don’t accept “yes” as evidence. If the checklist has nowhere to record where the proof lives, it wasn’t built by someone who has sat through a Stage 2. Pre-Engagement Preparation Consultants Complete Before the Gap Analysis Client AI Inventory and Use Case Cataloging Nothing in the checklist works without a complete AI inventory, and it’s the input clients get wrong most often. The inventory records every AI system in use: purpose, the role you play (developer, provider, deployer, or user), data consumed, outputs produced, whether a human sits between the output and the decision, and which third-party model or API it depends on. Consultants push hard on shadow AI here: SaaS tools that added AI features, agents running under employee credentials, and internal scripts calling model APIs. Every one of those is in scope until you document why it isn’t. Defining AIMS Scope Boundaries Clause 4.3 requires a scope statement naming which AI systems, business units, locations, and lifecycle stages the AIMS covers. Consultants draft this from the inventory, not before it. Scope discipline matters commercially too: certification bodies price audits by audit days, and audit days scale with scope. A narrow, well-justified first scope (the customer-facing AI product, say, rather than every internal tool) is usually the right call for a first certification. Stakeholder Interview Planning The checklist needs answers from people who don’t write policies. A typical interview plan covers the executive sponsor (clause 5), the AI or product lead (clauses 6 and 8), data engineering (A.7), procurement or vendor management (A.10), legal or privacy (A.5, A.8), and at least one front-line user of the AI system (A.9). Consultants interview the doers separately from the document owners, because the distance from what the procedure says to what actually happens is the finding. Document Request List (DRL) Consultants Send Clients The DRL goes out one to two weeks before fieldwork. A standard ISO 42001 DRL asks for the AI inventory; existing AI, security, and data policies; org chart with AI governance roles; any AI risk assessments or impact assessments; model documentation (model cards, system cards, or whatever exists); training-data provenance and data quality records; supplier contracts for third-party models; incident and change logs; training records; any ISO 27001 ISMS documentation; and the last internal audit and management review minutes if they exist. Missing items become findings rather than delays. Pro Tip: Return an Honest DRL Return the DRL with a column that says “does not exist” wherever that’s true. Consultants would rather know on day one than discover it in a workshop. An honest DRL shortens fieldwork by days and makes the maturity scores more accurate, which makes the remediation plan cheaper. Clause-by-Clause Checklist Consultants Use (ISO 42001 Clauses 4 to 10) ISO 42001 follows the Harmonized Structure shared with ISO 27001 and ISO 9001, so clauses 4 to 10 will look familiar to anyone who has run an ISMS. What’s different is the content each clause demands. Clause 4 – Context of the Organization Checkpoints Consultants check for a documented analysis of

[Read more](https://axipro.co/iso-42001-gap-analysis-checklist/)

- [All Blog](https://axipro.co/category/blog/), [Customer Stories](https://axipro.co/category/stories/), [ISO-27001](https://axipro.co/category/iso-27001/), [SOC-2](https://axipro.co/category/soc-2-2/)

- September 10, 2026

#### [How Scigeniq Passed Its First SOC 2 Type 2 and ISO 27001 Audits in Three Months](https://axipro.co/scigeniq-soc-2-iso-27001/)

Scigeniq, a UAE life sciences software vendor, completed SOC 2 Type 2 and ISO 27001 in one three-month engagement with Axipro and Vamu.

[Read more](https://axipro.co/scigeniq-soc-2-iso-27001/)

WhatsApp us