What to Expect During a CMMC Level 2 Assessment

What to Expect During a CMMC Level 2 Assessment

Most contractors know what Level 2 requires. Far fewer know what the assessment itself looks like, who sits across the table, and how a finding turns into a score. Here is the process from the first scoping call to the final status, in plain terms.

Who Does What in a C3PAO Assessment

A C3PAO is a Third-Party Assessment Organization authorized by the Cyber AB to run Level 2 certification assessments. The assessment team usually has three kinds of people.

Your side needs people too. Expect to name a main point of contact, your IT and security staff, and anyone who performs a control day to day, such as HR for onboarding or facilities for physical access.

Assessors verify what you have done. They do not advise on fixes during the evaluation, and the CMMC rule requires every C3PAO to keep a conflict of interest policy. That is why many contractors bring in a separate partner before the assessment starts.

The Stages of an Assessment

Providers label the stages a little differently, but the flow is the same.

If the team decides you are not ready in stage 1, it can pause or reschedule the assessment. That costs less than a failed assessment, which is one reason a readiness assessment beforehand pays off.

How Assessors Check Each Requirement

The 110 Level 2 requirements are broken into smaller assessment objectives. NIST SP 800-171A lists 320 of them, and each objective is checked with one or more of three methods.

The three methods are meant to agree. If your policy says one thing, your staff describe another, and the system is set up a third way, the objective is in trouble. Evidence is sampled rather than reviewed in full, so the examples you hand over need to be typical of how you really work.

MET, NOT MET, and N/A

Under 32 CFR 170.24, every requirement ends with one of three findings.

Two details catch people. Evidence has to be in final form and not draft, so a policy that is still in review does not count. And there is no partial credit, because a requirement with one failed objective is NOT MET. An N/A also needs a reason you can explain, since an assessor will ask why the requirement does not apply.

Scoring and Conditional Status

Level 2 has 110 requirements, and each one carries a point value in the DoD scoring method. A perfect score is 110. Conditional status is available only when your score divided by 110 is at least 0.8, which is 88 points. The rules for what can stay open are in 32 CFR 170.21.

• Only requirements worth 1 point can go on a POA&M, with one exception for SC.L2-3.13.11 when encryption is used but is not FIPS-validated.
• Six requirements can never go on a POA&M. Two of them are external connections (3.1.20) and the system security plan (3.12.4).
• You have 180 days from the Conditional CMMC Status Date to close every open item.
• A closeout assessment reviews only the items that were open. For Level 2 certification, an authorized or accredited C3PAO has to perform it.
• If the items are not closed in time, the conditional status expires.

A score of 88 is not a safe target. A single failure on a requirement that cannot go on a POA&M can end the conditional path, whatever your total. Our post on SSP, POA&M, and SPRS explains how those three documents fit together.

What Evidence to Have Ready

• A final system security plan that matches your real environment. See our SSP guide.
• A clear scope, with network and data flow diagrams showing where CUI lives.
• Final policies and procedures with owners and dates.
• Customer responsibility matrices and authorization records for any cloud or managed service provider in scope. If you use Microsoft’s government cloud, see GCC High for CMMC.
• Configuration screenshots, exports, and logs that show controls running.
• Training records, access reviews, and incident response test results.
• An SPRS score that reflects what is really in place.

Label the evidence by requirement before the team arrives. An assessor who can find an item in one click spends the interview time on questions instead of searching.

Gaps That Tend to Cause Trouble

• An SSP that describes the plan for the environment and not the environment itself.
• A scope that leaves out a system or provider that handles CUI.
• Policies that exist but that staff cannot describe.
• Evidence still in draft, or evidence that does not cover the full period.
• Unmet items placed on a POA&M that the rule does not allow there.
• Cloud and managed service providers with no documented responsibility split.
• An SPRS score entered once and never revisited.

How Long It Takes

The assessment runs on its own schedule, and your scope sets most of it. Industry guidance often cites about four to six weeks for a full engagement, counting the pre-assessment review, evidence work, interviews, and reporting. A small, well-documented scope can move faster. Several locations or a hybrid cloud setup take longer. Ask your C3PAO for a calendar before you commit, and book early, since assessor time is limited.

After the Assessment

Level 2 status lasts three years from the CMMC Status Date. Each year your Affirming Official has to affirm continued compliance in SPRS, so the work continues after the report. Keep your SSP current, review access on a schedule, and keep a record of changes. Our Level 2 guide covers the full set of obligations.

How to Prepare

1. Confirm your scopeList every system, person, location, and provider that touches CUI, and draw the boundary.
2. Finish the SSPWrite every requirement as it is done today, with the owner and the evidence.
3. Score yourself honestlyMark an objective NOT MET if you cannot show it. Check each open item against the POA&M rules.
4. Collect final evidenceReplace drafts, label each item by requirement, and fill gaps in the record.
5. Prepare your peopleWalk staff through the process so they can describe their own work in plain words.
6. Run a readiness assessmentHave someone independent test the plan before the real team does. Our preparation guide has more detail.