CMMC Level 2 assessment process, step by step

How the CMMC Level 2 assessment process works, and what changes for your organization

When a prime or contract now asks for CMMC Level 2, the question is usually which path applies and what it will cost you in evidence and preparation. A Level 2 certification assessment is run by a C3PAO after preliminary proceedings, moving through four phases and ending in either Final Level 2 (C3PAO) or Conditional Level 2 (C3PAO) status. The Department of War suspended CMMC Phase II on 13 July 2026, so certification may not yet be required for your contract, but Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Confirm with your contracting officer or prime which status the solicitation actually requires before you commit budget.

What changes for your organization depends on several variables: the scope of systems that store, process or transmit CUI, how mature your evidence already is, whether external service providers sit inside that scope, and whether a plan of action and milestones is in play. Each of these shifts the effort in the pre-assessment and the evidence review. Ask any prospective partner to walk through how each variable applies to your environment, and ask which artifacts must already exist in final form. Organizations own their controls. An implementation partner can prepare systems, documentation and evidence, but only the C3PAO issues the CMMC Assessment Findings Report and any certificate.

The first practical step is a gap review against the 110 NIST SP 800-171 Rev. 2 requirements that Level 2 uses, scored the way an assessor would score them. Identify which findings are drafts, which are missing, and which depend on a provider whose responsibilities are not documented. Then check whether your System Security Plan matches the assessment scope you intend to present. Clear gaps in scope or evidence cause more delay than technical gaps, so resolve them before you contract a C3PAO. Your partner and assessor should remain separate parties, so keep preparation and assessment records distinct from the start.

What each phase of the CMMC Level 2 assessment produces

The Cyber AB's CAP v2.0 moves an assessment from preliminary proceedings through four phases, and each phase closes with a defined output that the contractor or C3PAO must hold before the next phase begins. Confirm durations and scheduling terms with your C3PAO in writing, since this page does not state them.

Complete preliminary proceedings and scoping
Before any on-site or virtual work, the contractor requests an assessment, the C3PAO scopes the entity, both parties run conflict of interest checks, and they sign a contract that includes an NDA. The contractor should expect to define the systems, assets and external service providers in scope, and to give the C3PAO its system security plan and asset documentation. The step closes when the contract is signed and the scope is agreed in writing, so ask the C3PAO to put its scoping decisions and the assessment schedule in that contract.
Prepare the pre-assessment with the Lead CCA
In Phase 1, the Lead CCA reviews the system security plan, validates the assessment scope, and confirms that evidence and External Service Provider participation will be available. The C3PAO uploads a pre-assessment form into the CMMC instance of eMASS. The contractor's output is a complete, current system security plan and a list of the people and evidence the assessors will need. The step closes with the Lead CCA's readiness decision, which determines whether the assessment proceeds.
Confirm readiness and agree the evidence plan
If the Lead CCA decides the contractor is ready, both parties agree how evidence will be provided, including which artifacts can be reviewed virtually by mutual agreement. The contractor should confirm that every artifact is in final form, since draft policies and working papers do not satisfy a requirement. Ask the C3PAO to confirm in writing which interviews, demonstrations and system tests it expects, so the team can schedule the people and systems involved. The step closes when the evidence plan is documented and accepted.
Assess conformity through examination, interviews and testing
The assessment team applies the three NIST SP 800-171A methods, examine, interview and test, to each requirement using nonstatistical sampling at the FOCUSED value. Assessors may increase the sample when evidence is questionable. The contractor supplies artifacts, answers interview questions, and demonstrates configured systems. A requirement is MET only when all applicable objectives are satisfied with final evidence, and an objective scored N/A counts as MET. The step closes when every requirement has a result, and the contractor should keep its hashed artifacts ready for upload.
Re-evaluate NOT MET requirements within the window
Where a requirement is NOT MET, the contractor may provide additional evidence during the assessment and for 10 business days after the active assessment period, provided the Assessment Findings Report has not been delivered. Other MET results are not affected by this re-evaluation. The contractor must hash its assessment artifacts with a NIST-approved algorithm, give the C3PAO the artifact names, hash values and algorithm for eMASS upload, and retain them for six years from the CMMC status date. The step closes when the re-evaluation is complete or the window has passed.
Receive the Assessment Findings Report and results
The C3PAO uploads results into the CMMC instance of eMASS, which transmits them to SPRS. The contractor receives the outcome in a CMMC Assessment Findings Report. A passing score produces Final Level 2 (C3PAO) status, while a permitted open POA&M produces Conditional Level 2 (C3PAO). If the contractor disagrees, it files an appeal with the performing C3PAO, and an unresolved appeal may be elevated to the Accreditation Body. The step closes when the contractor holds the report and the SPRS entry is confirmed.
Issue the certificate and close out the POA&M
For a passing assessment, the certificate of CMMC status is issued and the contractor's Affirming Official affirms continuing compliance in SPRS. A Conditional status requires the contractor to close the POA&M within the permitted period, after which a further assessment or affirmation is needed to reach Final status. The Affirming Official must also affirm after every assessment, including the POA&M closeout, and annually after a Final status. The step closes when the affirmation is posted and the CMMC status in SPRS matches the certificate.

How assessors test evidence during a CMMC Level 2 assessment

Assessors test each Level 2 requirement with three methods from NIST SP 800-171A: examine the documents and configurations, interview the people who run the controls, and test that the control works as described. The Cyber AB's CMMC Assessment Process (CAP) v2.0 requires the assessment team to use all three methods, so a requirement backed only by a policy document will not satisfy the team. For each requirement, the team checks every applicable assessment objective, and a requirement is MET only when all of them are satisfied with evidence in final form. Drafts, working papers and unapproved policies do not count. Before the team arrives, the organization should confirm that each control has a finished procedure, a named owner who can explain it in an interview, and a live system that can demonstrate it.

The team samples evidence rather than reviewing every system. CAP v2.0 requires nonstatistical sampling at the FOCUSED value, which sets the depth and coverage of the review, and it requires the team to increase the sample when evidence looks questionable. Practically, an inconsistent log, a configuration that differs between two similar machines, or a access review with missing approvals can widen the sample and lengthen the assessment. Organizations should run their own sampling exercise before the assessment, pulling a range of logs, tickets, access reviews and configuration exports across every in-scope asset category. Much of the evidence collection can be done virtually if both sides agree, so the organization should agree on the screen-share and document-transfer method in advance and confirm that the artifacts are already hashed as required.

The assessment team must include at least two people: a Lead CCA and at least one other CMMC Certified Assessor. CMMC Certified Professionals may also take part, but only a CCA makes the final determinations under 32 CFR 170.13. The organization should ask its C3PAO how the team is composed, who will lead the interviews, and who will decide disputed findings. Equally important, the external service providers in scope, such as a cloud host or managed service provider, must be ready to take part where the evidence depends on them. Confirm their participation and their responsibility matrices before the team arrives, because an assessor who cannot reach the provider's evidence will score the related objectives as NOT MET.

What decides a MET result and when a NOT MET finding can still be fixed

A CMMC Level 2 assessment result depends on how the assessment team scores each objective and what the contractor can still change after the fact. The cards below cover the scoring rule, the N/A treatment, the re-evaluation window, artifact hashing, retention and the limits on C3PAO commercial arrangements. Each card names what the organization should prepare before the assessment begins.

Final evidence only

A requirement is MET only when every applicable assessment objective is satisfied with evidence in final form. Working papers, drafts and policies that have not been approved do not count, even when they describe the right control. Before the assessment, the organization should confirm that each policy, plan and procedure is approved, dated and version controlled, and that the operating records that prove the control ran are complete. An assessor who finds a draft will score the objective as not satisfied.

N/A objectives count as MET

An assessment objective scored N/A counts as MET under the scoring rules. This makes the scoping decision central: if an objective is marked not applicable, the justification must hold up under review. The organization should document in the system security plan why each excluded asset, function or objective does not apply, and should not use N/A as a way to avoid evidence the assessor would expect to see.

Re-evaluation window for NOT MET results

A NOT MET requirement may be re-evaluated during the assessment and for 10 business days after the active assessment period, but only if additional evidence exists, other MET results are unaffected and the Assessment Findings Report has not been delivered. The organization should prepare evidence packages for likely gaps before the assessment and have a named owner who can deliver them quickly. Evidence produced after the report is delivered does not reopen the finding.

Hashing and naming artifacts

The contractor must hash its assessment artifacts with a NIST-approved algorithm and give the C3PAO the artifact names, hash values and the algorithm used. The C3PAO uploads this information to eMASS. The organization should build a hashing step into its evidence process, record the algorithm in the assessment file, and confirm that file names and hashes match the artifacts assessors will receive, so that changes after hashing are detected.

Six-year artifact retention

Hashed assessment artifacts must be retained for six years from the CMMC status date. This obligation outlasts the assessment and the three-year certificate cycle, so storage, access control and ownership of the archive need planning from the start. The organization should decide where the hashed artifacts live, who can retrieve them, and how they remain intact through system migrations, staff changes and changes in cloud providers.

No guaranteed results or incentive fees

A C3PAO may not guarantee assessment results, and it may not take incentive or bonus payments tied to issuing a Certificate of CMMC Status. Contracts with an assessor should therefore fix the scope, deliverables and fees independently of the outcome. When a consultant or other party promises a pass or charges on a success basis, the organization should treat that as a warning sign and check the conflict of interest rules before signing.

Who owns each step of the assessment: your team, a partner and the C3PAO

Your organization owns the security requirements, the system security plan and every piece of evidence the assessors review. No outside party can answer for your controls during the assessment, and the people who run and explain those controls must be your own staff or contractors working under your direction. Your team also makes the decisions that carry legal weight, from which systems fall inside scope to whether a result is appealed.

Controls and the SSP: Your team operates the Level 2 controls and keeps the system security plan accurate for the systems in scope.
Final evidence: Policies, procedures, logs, tickets and configuration records must be in final form before the assessment. Drafts and working papers do not count as MET.
Artifact hashing: Your team hashes assessment artifacts with a NIST-approved algorithm, gives the C3PAO the artifact names, hash values and algorithm for eMASS, and retains the hashed artifacts for six years from the CMMC status date.
Interviews: Staff who run the controls must be ready to explain them accurately to assessors.
Affirming Official: A senior representative must affirm continuing compliance in SPRS after every assessment, including a POA&M closeout, and annually after a Final status.

Before the assessment, confirm which of these tasks your staff can perform and which, if any, you plan to hand to a partner.

Level 2 self-assessment versus C3PAO certification assessment

This table compares the Level 2 self-assessment with the C3PAO certification assessment across who performs it, how results are posted, what status results, and what the Affirming Official must do. Both paths use the same NIST SP 800-171A objectives, scoping rules and scoring methodology, so the difference lies mainly in who assesses and who records the result. Confirm the required path in each contract before you plan the work.

Comparison point	Level 2 self-assessment	Level 2 C3PAO certification assessment
Who performs the assessment	The contractor, using its own staff or an outside consultant for support	A C3PAO assessment team led by a Lead CCA, with at least one other CMMC Certified Assessor
Standard and objectives	NIST SP 800-171A objectives, scoping rules and scoring methodology	The same NIST SP 800-171A objectives, scoping rules and scoring methodology
Who posts the score to SPRS	The contractor posts its own score, such as 105 out of 110	The C3PAO uploads results through eMASS, which transmits them to SPRS
Upload path	Contractor enters the score directly in SPRS	C3PAO uploads results to the CMMC instance of eMASS
Resulting status or document	A self-posted score in SPRS with no third-party status	Final Level 2 (C3PAO) or Conditional Level 2 (C3PAO), reported in a CMMC Assessment Findings Report
Affirming Official obligations	Affirms continuing compliance in SPRS after the self-assessment and annually thereafter	Affirms continuing compliance in SPRS after every assessment, including POA&M closeout, and annually after a Final status
Current status	Remains in place: self-assessments, SPRS postings and annual affirmations continue after the 13 July 2026 Phase II suspension	Phase II certification requirements are suspended as of 13 July 2026, so confirm whether any contract currently requires it
What to confirm	Whether the contract accepts a self-assessment at Level 2 and the SPRS score it expects	Whether the contract requires a C3PAO certification and the assessment window it sets

How results reach eMASS, SPRS and the Affirming Official

After a Level 2 certification assessment, the C3PAO uploads its results into the CMMC instance of eMASS, and eMASS transmits them to SPRS. The outcome is Final Level 2 (C3PAO) when the score passes, or Conditional Level 2 (C3PAO) when a permitted POA&M remains open. The contractor learns the result from the CMMC Assessment Findings Report, which the C3PAO delivers. Read the report closely before anything is posted, because the findings in it determine whether the status is Final or Conditional and which items need closeout. Confirm with your C3PAO who will upload results, when the report will be delivered, and how any disagreement about a finding will be raised before the report is final.

Before the assessment starts, confirm two accounts. First, the organization needs access to SPRS and to the CMMC instance of eMASS, and it should know who controls the credentials and how they are reset. Second, the organization must name its Affirming Official, a senior representative who has authority to attest on the company's behalf. Under 32 CFR 170.22, that person must affirm continuing compliance in SPRS after every assessment, including the POA&M closeout, and again annually once the status is Final. Check that the Affirming Official understands the attestation and can complete it on time, because a missed or delayed affirmation can affect the company's standing even when the assessment itself was passed.

Treat the Affirming Official role as an ongoing responsibility, not a one-time form. Decide who will track affirmation dates, who will gather the evidence the Affirming Official relies on, and how changes to the system or scope will be reported before the next affirmation. The assessor does not sign or maintain these records for you. If your consultant or implementation partner helps prepare the environment, keep the attestation decisions with your own officers so the company, not a vendor, makes the statement of compliance.

What usually delays a Level 2 assessment and how to avoid each delay

Most delayed CMMC Level 2 assessments trace back to a small set of preparation gaps rather than missing technology. The cards below cover what assessors reject, who owns each fix, and what to check before a C3PAO is engaged.

Drafts presented as final evidence

Under 32 CFR 170.24(b), a requirement is MET only when the evidence is in final form. Working papers, drafts and unapproved policies do not count, so a policy still in review can fail an objective that the technology fully meets. Check that every policy, procedure and plan has an approved version, a date and an owner before the assessment window opens. Owner: the compliance lead, with executive approval of each policy.

SSP that does not match scope

The system security plan is the first document the Lead CCA reviews during pre-assessment. If it omits assets, lists systems that no longer exist, or describes a boundary different from the one in the network diagrams, the assessment starts with questions instead of testing. Reconcile the SSP against the asset inventory, data flow diagrams and current network configuration. Owner: the system owner, verified by the security lead.

ESP responsibility gaps

Cloud providers and managed service providers that store, process or transmit CUI are part of the assessed environment, and each control they support must be assigned clearly. Gaps appear when the contractor assumes the provider covers a control the provider only supports in part. Obtain each provider's responsibility matrix and confirm which party owns each requirement, along with evidence the provider can supply. Owner: the contract manager, with the provider's security contact.

Unhashed or inconsistently named artifacts

Under 32 CFR 170.17(c)(4), the contractor must hash its assessment artifacts with a NIST-approved algorithm and give the C3PAO the artifact names, hash values and algorithm for upload to eMASS. Files renamed after hashing, or evidence stored in several locations with different names, cause mismatches and rework. Set a naming convention, hash each artifact when it is finalized, and keep a manifest that matches the repository. Owner: the GRC or evidence manager.

Unclear Affirming Official ownership

Under 32 CFR 170.22, the Affirming Official must be a senior representative of the contractor who affirms continuing compliance in SPRS after every assessment, including a POA&M closeout, and annually after a Final status. If nobody has been named, or the person lacks authority over the systems being affirmed, the result can be delayed or invalid. Confirm the individual, document their authority and calendar each affirmation date. Owner: the executive sponsor, usually the CEO or a delegated officer.

C3PAO booked before readiness

Contracting a C3PAO before the environment is ready often leads to a failed or conditional outcome and a second assessment cost. A readiness review should confirm that policies are approved, the SSP matches scope, evidence exists for each objective and a mock assessment has been scored. Ask any assessor or consultant to show their readiness checklist before signing. Owner: the executive sponsor, with an independent readiness review that stays separate from the assessor.

Questions buyers ask about the CMMC Level 2 assessment process

Can we run a CMMC Level 2 assessment ourselves?

Yes, if you only need a self-assessment. A Level 2 self-assessment uses the same NIST SP 800-171A objectives, scoping rules and scoring methodology as a certification assessment, but your organization performs it and posts the score, for example 105 out of 110, to SPRS itself. A Level 2 certification assessment is different: only a C3PAO can perform it, and the C3PAO's assessment team must include at least two people, including a Lead CCA. Your staff can prepare for either assessment, but the organization owns its controls and the Affirming Official must affirm continuing compliance in SPRS after every assessment.

How long does a CMMC Level 2 certification assessment take?

No duration is fixed in the sources we rely on, so confirm the timeline with each C3PAO in writing before you sign. The Cyber AB's CMMC Assessment Process (CAP) v2.0 structures the work in four phases after preliminary steps such as scoping, conflict of interest checks and an NDA: pre-assessment, assessment of conformity, reporting, and certificate issuance with POA&M closeout. The length of each phase depends on your scope, the number of assets, how many evidence artifacts are final, and whether the C3PAO can collect evidence virtually by mutual agreement. Ask for a schedule that lists each phase and the dependencies on your side.

What does our internal team have to provide for the assessment?

Your team owns the evidence that the assessors examine, interview and test. The main items are a system security plan that matches the scope, policies and procedures that are approved and in final form, and evidence for each in-scope asset. Under 32 CFR 170.24(b), drafts, working papers and unapproved policies do not count, so a requirement is MET only when all applicable objectives are satisfied with final evidence. Your staff must also be available for interviews, hash the assessment artifacts with a NIST-approved algorithm, give the C3PAO the artifact names, hash values and algorithm, retain the hashed artifacts for six years from the CMMC status date, and provide an Affirming Official for SPRS.

Can a partner help us prepare, and can the same partner also assess us?

A partner can help you prepare, but it cannot assess you. DeployOpen prepares systems, controls and evidence for compliance assessments, including hardening, documentation and evidence collection for self-hosted open-source platforms in your own environment. DeployOpen does not issue audit reports or certifications. Only a C3PAO can issue a certification assessment result, and the CMMC rules and CAP v2.0 keep consultants separate from the assessors who score your environment, so confirm the conflict of interest position with any C3PAO before you engage a preparation partner. Agree the division of work in a written, fixed scope.

What happens if the assessment marks a requirement NOT MET?

A NOT MET requirement can be re-evaluated during the assessment and for 10 business days after the active assessment period, under 32 CFR 170.17(c)(2). This is only possible if additional evidence exists, other MET results are unaffected, and the Assessment Findings Report has not been delivered. If the remaining gaps fall within the permitted POA&M rules, the result can be Conditional Level 2 (C3PAO) rather than a passing score. Before the window closes, review which objectives failed and whether the evidence was missing, drafted or inconsistent with the system security plan. Confirm the POA&M thresholds and closeout rules with your C3PAO and the CMMC POA&M guidance before relying on them.

Does the 2026 suspension stop our assessment work?

The suspension pauses Phase II, not your existing obligations. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Whether a particular contract requires a certification assessment now depends on its clause and the contracting officer, so ask the prime or contracting officer which level applies before you schedule a C3PAO.

What should we ask a C3PAO for in a quote?

Ask for a written quote tied to a defined scope, because the quote depends on what is assessed. Request a breakdown of the preliminary steps, the four CAP phases, the number of assessors and their roles, the virtual and onsite evidence collection plan, and the sampling approach at the FOCUSED value. Also ask how the C3PAO handles re-evaluation, what happens if evidence is questionable and sampling increases, how appeals are managed, and whether any part of the fee is contingent on the outcome. CAP v2.0 bars C3PAOs from guaranteeing results or taking incentive payments contingent on a Certificate of CMMC Status, so treat any such offer as a warning sign.

What is the appeal path if we disagree with the result?

You file the appeal first with the C3PAO that performed the assessment, under 32 CFR 170.9(b)(19). Either party can elevate an unresolved appeal to the Accreditation Body, which is currently The Cyber AB, for a final determination. CAP v2.0 requires that the appeal be managed by a quality assurance CCA who was not on the assessment team. Keep your artifacts, hash records and the Assessment Findings Report organized during this period, because the appeal will turn on the evidence in final form. Confirm the appeal timelines and steps in the current CAP and the C3PAO's written procedures.

How DeployOpen prepares systems and evidence before a CMMC Level 2 assessment

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the systems and evidence an assessor reviews are ready before a C3PAO starts. Your organization owns its controls and its assessment decisions, and only an independent C3PAO issues a CMMC status.

How we scope

We agree a written scope that names the in-scope systems, users, enclaves and external service providers for your Level 2 environment.
We map which NIST SP 800-171 Rev. 2 requirements each in-scope platform supports, and which remain with your people and processes.
Engagements are fixed-scope, so deliverables and timelines are agreed in writing before any work starts.

How we build

We deploy and harden self-hosted open-source platforms in your cloud accounts, data centers or air-gapped networks against the Level 2 requirements in scope.
We configure logging, access control, encryption and boundary protections so the settings an assessor will examine are in place and documented.
We run internal testing of the configured controls and record the results, so gaps are found and tracked before the assessor arrives.

How we hand over

We deliver the system security plan, configuration baselines, network diagrams and policy drafts for your review and approval in final form.
We organize evidence by requirement so your staff can show which artifacts support each NIST SP 800-171A objective.
We document the hashing and retention process for assessment artifacts, so your team can give the C3PAO artifact names, hash values and algorithm.

How we support

Ongoing support, upgrades and continuous security testing are available as retainers after the assessment.
We can help keep configurations, evidence and documentation current between assessments, so status reviews do not start from scratch.
Confirm with your C3PAO and your sponsor which preparation activities they accept, since assessor independence limits what the same firm may do.

CMMC Level 2 assessment process