How to tell if your organization is ready for a CMMC Level 2 assessment
Readiness means final, scoped and verifiable evidence for all 110 NIST SP 800-171 Rev. 2 requirements, checked against the pre-assessment questions a C3PAO asks before it commits to a Level 2 certification assessment. Your prime or contracting office may now expect Level 2 evidence, but a plan, a draft policy or a self-declared score does not meet that expectation. The Department of War suspended CMMC Phase II on 13 July 2026, which moves the certification deadline for applicable contracts. It does not change the 110 requirements, and Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Confirm the current status of Phase II with your contracting officer and in the CMMC Program final rule before you set a date.
Before a C3PAO starts, the Lead CCA reviews your system security plan, validates scope, confirms that evidence exists and that personnel are available, and confirms whether any external service provider will take part. Your organization owns its controls and the attestation that goes with them. An implementation partner can help close gaps, organize the system security plan, build the asset inventory and prepare evidence, but it cannot issue a certificate, and only the C3PAO's assessment can produce one. Ask any partner to state in writing which tasks it performs and which remain yours, and confirm that its staff will not be barred from assessing you later under the consulting rules in 32 CFR 170.8.
Use three checks to find out where you stand. First, confirm that every in-scope asset appears in the asset inventory, the system security plan and the network diagram. Second, check that each requirement has evidence in final, approved form, since drafts and unofficial policies cannot score as MET under 32 CFR 170.24(b). Third, if an external service provider handles any requirement, obtain its service description and customer responsibility matrix and confirm its personnel will participate. A missing or incomplete system security plan blocks even a conditional status, so treat it as the first gap to close. Your readiness review should also start a mock assessment that scores against the NIST SP 800-171A objectives, targeting the 5-point and 3-point requirements first.
Readiness checks that decide whether the assessment proceeds
Before a C3PAO begins a Level 2 certification assessment, the Lead CCA decides whether the organization is ready to proceed. The checks below are the gates that decide that outcome, and most of them depend on documents, inventories and evidence being final well before the assessment team arrives. Work through them in order, because a gap in the system security plan or scope affects every check that follows.
System security plan is complete and final
The system security plan (SSP) is the first document a Lead CCA reviews, and it must describe how each requirement is implemented in the environment as it actually runs. A missing or incomplete SSP blocks even a Conditional Level 2 status, because the CA.L2-3.12.4 requirement cannot be placed on a plan of action. Check that the SSP names the current system boundary, the people responsible for each control, and the date of its last review. A draft SSP is treated as a gap, so confirm it has been approved by the Affirming Official or the accountable owner.
Every in-scope asset is documented
Under 32 CFR 170.19(c), each in-scope asset must appear in the asset inventory, be described in the SSP and be shown on the network diagram before the assessment begins. Reconcile the three sources against each other, since a server listed in the diagram but absent from the inventory is a common finding. Include endpoints, identity systems, backup systems, and any specialized assets that process, store or transmit CUI. Confirm that the diagram matches the live network, not an earlier design.
Policies and procedures are approved
Assessors score a requirement MET only when the evidence is in final form, and 32 CFR 170.24(b) excludes working papers, drafts and unofficial or unapproved policies. Each policy that supports a requirement, such as access control, incident response or media handling, needs an owner, an approval record and a version date that predates the assessment. Review whether staff follow the approved procedure in practice, because an approved policy that no one uses will still fail the requirement. Retire old versions so the assessor is not shown conflicting documents.
Control operators are available
Assessments involve interviews, and the people who run daily controls must be available to answer for them. Confirm that administrators for identity, logging, patching and backup, along with the incident response lead and the personnel security contact, can attend the scheduled sessions. CAP v2.0 expects the Lead CCA to confirm personnel availability during Phase 1, so a missing operator can delay the assessment. Plan coverage for leave, travel and staff turnover, and document who will substitute for each role.
External service provider responsibilities are documented
Any external service provider whose services help meet a requirement must be documented in the SSP, and its service description and customer responsibility matrix must show which controls the provider handles and which remain with the contractor. CAP v2.0 expects ESP personnel to take part in the assessment, and if the Lead CCA cannot confirm that the ESP is properly documented and will participate, the C3PAO discusses with the Affirming Official whether to proceed. Obtain these matrices in writing before scheduling, and confirm that the provider has agreed to attend.
Mock assessment is scored against NIST SP 800-171A
A mock assessment walks each Level 2 requirement against the assessment objectives in NIST SP 800-171A, marks each objective as satisfied or not, and records the evidence that supports it. Score the result the way a C3PAO would, using the 5-point and 3-point weights, and treat any requirement with an unsatisfied objective as NOT MET. Work the 5-point and 3-point gaps first, because the Conditional threshold of 88 out of 110 depends on them. Keep the mock scoring workpapers, since they show the remediation trail even though they are not evidence for the real assessment.
Which documents and evidence must already be final
Evidence has to be in final form before the assessment starts, because a requirement scores MET only when its evidence is final. Under 32 CFR 170.24(b), working papers, drafts and unofficial or unapproved policies are unacceptable. A policy that was approved verbally, a procedure still marked as a draft, or a screenshot taken during the assessment week will not carry a requirement. Before the Lead CCA decides on readiness, your team should walk every governing document and record and confirm that it has an owner, an approval date, a version number and an approval record that the assessor can see. Assessors do not score intent. They score what they can sample.
Assessors sample across several categories of evidence: the system security plan and its supporting policies, the asset inventory and network diagram, configuration baselines and exported settings, account and access review records, audit log extracts and review records, change tickets, vulnerability scan reports with remediation tracking, incident response records or tabletop outcomes, training records, personnel screening records, and the customer responsibility matrices for any external service provider. Each category should exist in the form it will take on assessment day, with dates that show it is operating, not created for the occasion. Confirm with your C3PAO, before you commit to a date, which artifact types and time windows it expects, since the CMMC Assessment Process document describes how evidence is gathered and reviewed.
Plan for the re-evaluation window as the real deadline for fixing anything found late. Under 32 CFR 170.17(c)(2), a NOT MET requirement can be re-evaluated for only 10 business days after the active assessment period. That is a short time to write a missing procedure, collect a month of logs, re-run a scan, and get the approvals signed. Run an internal mock assessment against the same categories and close every gap that would produce a NOT MET before the C3PAO arrives. Treat any document that is still in review at that point as unfinished evidence, and ask your team to name an owner and a completion date for each one.
Scoping and ESP responsibility matrices to verify before the assessment
Before a C3PAO starts, the Lead CCA confirms that every in-scope asset is accounted for. Under 32 CFR 170.19, each in-scope asset must appear in the asset inventory, be described in the system security plan and be shown on the network diagram. Mismatches among those three documents are a common early problem, because assessors trace sample assets from the diagram into the SSP and then into the inventory.
- Inventory match: Each host, appliance, endpoint and cloud resource in scope should appear with the same name, owner and location used in the SSP.
- Diagram completeness: The network diagram should show boundary devices, CUI data flows and external connections, not only core servers.
- Overlooked devices: Laptops, printers and build machines that touch CUI are often missed, so confirm whether each one is in scope or excluded through a documented boundary.
- Written scope decisions: Each exclusion needs a stated reason tied to CUI handling that holds up under interview questions.
Ask your team to pick five assets at random from the diagram and trace each one through the SSP and inventory before the C3PAO does.
An enclave or virtual desktop approach can shrink the assessed footprint, but only when the boundary is real and documented. Assessors look for evidence that CUI cannot leave the enclave through paths the SSP does not describe. The team should test each boundary control and record the results in final form, so the assessment rests on observed behavior and not on the design diagram alone.
- Boundary controls: Show the firewall rules, identity controls and logging that separate the enclave from corporate networks.
- Data path evidence: Document clipboard, file transfer, printing and screen-sharing paths, and show that each one is blocked or logged.
- Administrative access: Identify who administers the virtual desktop platform and whether those administrators sit inside or outside the enclave.
- Endpoint scope: Thin clients and personal devices that can reach the enclave are in scope if they can display or move CUI.
Confirm that a test of each data path has been run, that the result is recorded, and that the record is in final form.
Operational technology, test equipment and other specialized assets can hold CUI, process it indirectly or sit on the same network segment as systems that do. The organization must decide whether each one is in scope and document the reasoning. These assets are often hard to patch, log or update, so the SSP should state the constraints and the compensating controls that apply to them.
- Inventory first: Test benches, instrument controllers, machine tool controllers and lab computers belong in the inventory even when they appear to be out of scope.
- Network placement: Show whether each device connects to the CUI network and through which segments.
- Documented constraints: If a device cannot run an agent or accept patches, record the reason and the compensating control in the SSP.
- Vendor access records: Keep maintenance records and vendor remote access terms, since they bear on the maintenance and access requirements.
Confirm with your team that each specialized asset has an owner, a written scope decision and a reason that a reviewer outside engineering can follow.
An external service provider whose services help meet a requirement must be documented in the SSP and described in the provider's service description and customer responsibility matrix, as required by 32 CFR 170.16(c)(3) and 170.17(c)(6). The CMMC Assessment Process v2.0 also expects ESP personnel to take part in the assessment. If the Lead CCA cannot confirm that the ESP is properly documented and will participate, the C3PAO discusses with the Affirming Official whether to proceed.
- SSP entries: Name each ESP, the services it provides and the requirements those services help meet.
- Service description: Obtain the provider's written description of what it does and what it does not do.
- Responsibility matrix: Confirm line by line which obligations stay with your organization, such as account management, log review or key custody.
- Participation plan: Name the ESP contact who will answer assessor questions and provide evidence during the assessment.
- Decision risk: If participation cannot be confirmed, the Affirming Official may need to decide whether the assessment proceeds.
Check that every requirement the SSP attributes to an ESP has a matching line in both the provider's service description and the responsibility matrix.
How to score a mock assessment against 110 requirements
This sequence turns the 110 Level 2 requirements into an internal score that shows where the environment stands against the assessment objectives. It also produces a ranked gap list so remediation starts with the requirements that move the score most.
Fix the assessment scope first
Before any requirement is scored, the team confirms which assets fall in scope, using the asset inventory, the system security plan and the network diagram. Every in-scope asset must appear in all three, and any external service provider whose services meet a requirement must be identified. The output is a signed scope statement that the mock assessment team uses for every later step. If scope changes after scoring starts, the affected requirements are rescored.
Map each requirement to its 800-171A objectives
Each of the 110 requirements is broken into the assessment objectives defined in NIST SP 800-171A, which is the method assessors use. The team lists every objective that applies to the in-scope assets, so that no requirement is judged on a general impression. The output is a worksheet with one row per objective, showing the requirement ID, the objective text in the team's own words, and the evidence expected for it.
Sample evidence against each objective
A reviewer who did not build the controls checks the evidence for each objective on a sample of in-scope assets and users. Samples should cover the asset types that carry the most risk, such as remote access paths, administrator accounts and CUI repositories. The reviewer records the artifact name, the date it was produced and whether it shows the control operating, not only designed. The output is an evidence log that links each objective to the artifacts reviewed.
Mark requirements MET only when every objective passes
A requirement is marked MET only when all applicable objectives are satisfied with evidence in final form. Drafts, working papers, unapproved policies and screenshots without dates or context do not count. Where any objective fails or lacks evidence, the requirement is marked NOT MET, even if most of its objectives pass. The output is a status for all 110 requirements, with a one-line reason for every NOT MET entry.
Record NOT MET items with root causes
Each NOT MET requirement gets a short root cause, such as a missing procedure, an unconfigured setting, an unreviewed log or an ESP responsibility that is not documented. The team also notes whether the gap is a documentation problem or a technical one, because the two need different owners and different lead times. The output is a gap register that the mock assessment owner signs off on before scoring.
Compute the score and test the Conditional threshold
The score is calculated by subtracting the point value of each NOT MET requirement from 110, using the 5-point, 3-point and 1-point weights that apply under the scoring method in 32 CFR 170.24. Conditional status under 32 CFR 170.21 requires a score of at least 88, and only 1-point items, plus the encryption requirement SC.L2-3.13.11 when it is not FIPS-validated, may be deferred. The team confirms that CA.L2-3.12.4, the system security plan, is complete, because it cannot be placed on a POA&M. The output is a score with a clear statement of whether the threshold is met.
Sort gaps by point value and plan remediation
Gaps are sorted so that 5-point requirements come first, then 3-point requirements, then 1-point items. This order matters because the conditional threshold leaves little room for unresolved high-value gaps, and re-evaluation of NOT MET items in an official assessment is limited to a short window. The output is a remediation plan with owners, dependencies and evidence to be produced. The team labels the result internal, since it is not an official SPRS score or CMMC status, and only an authorized assessor can issue one.
Artifact hashing and six-year retention before you are assessed
Build the hashing and retention routine during readiness, not during the assessment. Under 32 CFR 170.17(c)(4), assessment artifacts must be hashed with a NIST-approved algorithm and kept for six years from the CMMC status date. Those two obligations touch every policy, procedure, configuration export, log extract, ticket and screenshot that you will hand to a C3PAO. If the hashing step is improvised in the final weeks, teams often discover that files were edited after they were collected, that filenames do not match the evidence index, or that nobody can say which version was the approved one. Each of those problems can undermine evidence that otherwise satisfies a requirement.
Start by deciding where the authoritative copy of each artifact lives, who may change it, and how a changed file is versioned rather than overwritten. Then define the hashing step as a repeatable procedure: which algorithm you use, which tool computes the digest, where the digest is recorded alongside the file, and who signs off that the file in the evidence folder matches the approved version. Confirm the approved algorithm list with your C3PAO and check the current rule text in the eCFR before you commit to a tool, because the list of acceptable algorithms is a fact you should verify rather than assume.
For retention, set the six-year clock from the CMMC status date, not from the date a file was created, and make sure your storage, backup and access controls keep older artifacts readable and protected for that full period. Ask your implementation partner to test a restore of a sample evidence set during readiness, and ask your assessor which format they prefer for the evidence index. Treat the hashing and retention routine as part of your system itself, with its own owner, its own records and its own entries in the system security plan where it touches in-scope assets.
Who may help you prepare without being barred from assessing
Your organization owns its controls, its System Security Plan and its evidence, and no outside party can take that ownership away. Your internal team is the only group that can decide how a requirement is implemented in daily operations, who approves policy, and who answers for the environment during the assessment. Internal staff can also be the people who make the assessment go well, because they know the systems and can produce evidence on demand.
- Ownership of controls: Named owners should be accountable for each requirement family, including the policies they approve and the operations they run.
- Ownership of the SSP: The organization must maintain the System Security Plan, asset inventory and network diagram so they match the live environment.
- Evidence in final form: Internal approvals, signatures and dates must be in place on policies, since drafts do not score as MET.
- Availability during the assessment: Staff who run the systems, and the Affirming Official, must be reachable for interviews and demonstrations.
- Documentation of ESP responsibilities: Your team should confirm each external service provider's customer responsibility matrix matches what you actually configure.
Confirm with your C3PAO which roles must be present during the assessment and which artifacts must be final before the Lead CCA reviews them.
An outside implementation partner or CMMC Certified Professional may advise and consult on preparation under 32 CFR 170.13. They can gap-assess your environment, help draft the SSP, configure controls, and prepare evidence packages that your team then owns and approves. This help is valuable, but it creates a conflict that the rule addresses directly: the same party cannot prepare you and then assess you.
- What the adviser may do: Gap analysis, remediation planning, configuration support, documentation drafting and mock assessments run for your benefit.
- What the adviser may not do: Issue the certification assessment result or act as the assessor on your Level 2 certification.
- The 3-year bar: Under 32 CFR 170.8(b)(17)(i)(G), anyone who consulted on an organization's preparation in the previous 3 years is barred from performing that organization's Level 2 certification assessment.
- Scope of the bar: Confirm with the C3PAO and the adviser how the bar applies to affiliates, subcontractors and individual staff who worked on your preparation.
- Fixed-scope work: A written scope that names deliverables, exclusions and handover of artifacts makes the boundary easier to defend.
Before signing, ask the adviser to confirm in writing whether they will be barred from assessing you and whether any staff member has a conflict.
A C3PAO authorized or accredited by The Cyber AB performs the Level 2 certification assessment, and only it can issue the assessment result that feeds your CMMC status. Its independence is the reason the assessment carries weight, so the C3PAO should not have prepared the environment it is testing. Before the assessment starts, the Lead CCA decides whether you are ready, and the C3PAO's role is limited to assessing, not designing your controls.
- Readiness decision: The Lead CCA reviews the SSP, validates scope, confirms evidence and personnel availability, and confirms any ESP's participation before proceeding.
- ESP participation: If the Lead CCA cannot confirm that an ESP is documented and will take part, the C3PAO should discuss with the Affirming Official whether to proceed.
- Independence checks: Ask the C3PAO to confirm in writing that it has no preparation role for your organization in the prior 3 years.
- Contract separation: Keep the assessment agreement and the readiness agreement as separate contracts with separate scopes and staff.
- Verification: Confirm the C3PAO's authorization on The Cyber AB Marketplace before you sign anything.
Check that the assessor you choose has no advisory engagement with you, and that your readiness contract names what it does not cover.
Common readiness gaps that delay or fail an assessment
Most CMMC readiness problems are not technical failures. They are documents that were written late, inventories that stop at the data center door, and evidence that cannot be shown in final form. Each card below names one gap, why an assessor treats it as serious, and what to check before the Lead CCA reviews your package.
SSP written after the fact
A system security plan drafted in the weeks before an assessment usually describes the environment as it was meant to be, not as it runs. Assessors compare the SSP with configurations, logs and interviews, and any mismatch weakens every requirement it touches. Under the rule, a missing or incomplete SSP also blocks Conditional status because CA.L2-3.12.4 cannot be placed on a POA&M. Check that each control statement names the system, the owner and the evidence location, and that the plan was reviewed against live settings.
Asset inventory missing cloud or ESP assets
Inventories built from on-premises scans often omit SaaS tenants, cloud workloads, managed endpoints and devices run by an external provider. Every in-scope asset must appear in the asset inventory, be described in the SSP and be shown on the network diagram before assessment. Reconcile the inventory against cloud account listings, identity directory exports and the provider's service boundary, then trace each entry to a diagram and an SSP section.
Policies approved informally
Policies circulated by email, stored as unsigned drafts or adopted by a manager without authority do not count as evidence. Assessors score a requirement MET only when the evidence is in final form, so a procedure that has never been approved by the accountable executive is treated as unofficial. Confirm that each policy has a version, an approver, an effective date and a review record, and that staff can show they follow the approved version.
Evidence captured without hashing
Screenshots, log exports and scan reports collected during preparation are often saved without integrity records, which leaves the assessment team unable to show the artifact has not changed. Artifacts used in a certification assessment must be hashed with a NIST-approved algorithm and kept for six years from the CMMC status date. Set up a hashing step in the evidence intake process, record hash values in an index, and store originals in write-protected repositories with retention rules applied from day one.
ESP not documented
When a cloud provider, managed service provider or other external service provider supports a requirement, the contractor still answers for it. The SSP must describe that service, and the provider's service description and customer responsibility matrix must show which party does what. If the Lead CCA cannot confirm the provider is documented and will take part in the assessment, the C3PAO is expected to discuss with the Affirming Official whether to proceed. Obtain the provider's written matrix early and confirm its personnel availability.
POA&M used for SSP gaps
Teams sometimes plan to close a missing SSP, a weak policy or an undocumented ESP after the assessment and list them on a plan of action. The rule bars CA.L2-3.12.4 from any POA&M, and a POA&M cannot close gaps that depend on documents that never existed. Deferred items are limited to specific 1-point requirements, so spend readiness time on the 5-point and 3-point items first, and treat any SSP gap as a blocker to fix before scoring begins.
CMMC readiness assessment questions
How much effort does CMMC readiness take, and what drives it?
Readiness effort depends mostly on how many assets fall inside scope, how mature the evidence already is, and how many external service providers you rely on. Each in-scope asset must appear in the asset inventory, be described in the system security plan and be shown on the network diagram before assessment, so a large, undocumented environment takes far longer to prepare than a small, documented one. Evidence maturity matters just as much: a requirement only scores MET when its evidence is in final form, not drafts, so policies that exist only as working copies add weeks of rework. The Lead CCA's readiness review also covers personnel availability, so staffing gaps belong in the effort estimate. Ask any provider to break its quote into scope definition, documentation, technical remediation and evidence collection so you can compare like with like.
Can our own team run CMMC readiness without outside help?
Yes, an organization can prepare its own systems, documents and evidence without an outside firm, and many do. The constraint is independence: a company that helped prepare its environment may later be barred from performing the Level 2 certification assessment by that same organization, so the people who advised you cannot be the people who assess you. Internal teams usually struggle with three areas: writing a system security plan that matches the real configuration, keeping evidence final and hashed, and documenting ESP responsibilities. Decide early who owns each control, who signs off on evidence and who will act as the Affirming Official's technical contact. Your readiness plan should state which parts you will do internally and which you will buy, in writing, before work starts.
Is a mock CMMC assessment required before the real one?
A mock assessment is not a formal requirement, but it is good practice before a certification assessment. Scoring your own environment against the NIST SP 800-171A assessment objectives shows where requirements would fail, which gives you time to fix them. Score each requirement the way an assessor would: MET only when every applicable objective has evidence in final form, and NOT MET otherwise. Pay close attention to the 5-point and 3-point requirements, because the Conditional status threshold of 88 out of 110 means readiness work should target those first. Treat the mock as a rehearsal of evidence retrieval as well as a score, since assessors need artifacts quickly and in the form they were defined. The independent assessor is not bound by your mock result, so use it as an internal diagnostic only.
Does the 2026 Phase II suspension change CMMC readiness work?
The suspension changes timing and sequencing more than the underlying security work. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, so the controls, system security plan and evidence still matter today. Readiness for a certification assessment may move later depending on the outcome of the 60-day review by the CMMC Reform Task Force. Confirm your contract's current requirement with your contracting officer and the official DoW pages, and avoid building a schedule around a date that may change.
Who pays for what during CMMC readiness?
You pay for your own controls, documentation and evidence, and the assessor is paid separately for the assessment itself. Readiness costs typically fall into four groups: internal staff time, technical changes to systems, documentation work, and outside help such as a consultant or implementation partner. An implementation partner prepares systems and evidence under a written scope, but it does not issue a certification. Only an independent C3PAO, authorized or accredited through The Cyber AB, performs the Level 2 certification assessment and issues the outcome. Your external service providers may charge you for their own compliance evidence, such as service descriptions and customer responsibility matrices, so ask them to include it in their quote. For figures and quote checklists, see the CMMC Level 2 cost page and the Choosing a C3PAO page.
What must our company provide before a C3PAO starts the readiness review?
Before the Lead CCA decides whether you are ready, your company must provide a complete system security plan, a validated scope, an asset inventory, a network diagram and evidence that is final and available. The assessor also confirms that personnel can take part during the assessment window. If you use an external service provider to meet any requirement, its services must be documented in your system security plan and described in the provider's service description and customer responsibility matrix, and the provider's personnel are expected to participate. If the assessor cannot confirm that an ESP is properly documented and will take part, it should discuss with your Affirming Official whether to proceed. Gather these items, name an internal owner for each, and check them against the readiness checklist before you request an assessment.
What happens if gaps are found during a CMMC readiness review?
Gaps found during the active assessment have very little time to be fixed, so most of the remediation must happen before the assessment begins. A requirement scored NOT MET can be re-evaluated only within 10 business days after the active assessment period. Plan for this window by fixing known gaps early and keeping a short list of evidence items that can be produced quickly if needed. Missing or incomplete system security plan content cannot be placed on a plan of action at all, so that document must be complete before you start. Use the POA&M rules only for the limited requirements that allow deferral, and confirm the details with the CMMC POA&M rules page and your assessor before relying on them.
How DeployOpen prepares systems and evidence ahead of your assessment
DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, so the systems, SSP inputs and evidence a C3PAO reviews are in place before the assessment starts. DeployOpen prepares the environment and records; your organization owns its controls, and only an independent C3PAO issues the assessment result.
How we scope
- Confirm in-scope assets, enclaves and external service providers against the asset inventory and network diagram before work begins.
- Set out in the written scope which CMMC Level 2 requirements DeployOpen will prepare and which remain with your team.
- Identify ESP services that must appear in the system security plan and in each provider's customer responsibility matrix.
How we build
- Configure and harden the self-hosted platforms in your cloud accounts, data centers or air-gapped networks to match the SSP.
- Run internal checks against the assessment objectives in NIST SP 800-171A and record results for each requirement.
- Finalize policies, procedures and the system security plan as approved versions, since draft material cannot score a requirement MET.
How we hand over
- Deliver the SSP, asset inventory, network diagram and evidence index in final form, with an owner and approval date for each item.
- Hash assessment artifacts with a NIST-approved algorithm and document the retention process for six years from the CMMC status date.
- Walk your team through the evidence so staff can answer assessor questions and show artifacts during the assessment.
How we support
- Support remediation of gaps found in a mock assessment, prioritizing 5-point and 3-point requirements, within the written scope.
- Offer ongoing support, upgrades and continuous testing as a retainer after the assessment, if your organization wants it.
- Confirm with your C3PAO and Affirming Official which parts of the preparation are documented and how the ESP will take part.
