Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.
Who's across the table
A C3PAO (Certified Third-Party Assessment Organization) is accredited by the Cyber AB to conduct CMMC assessments. At Level 2, its job is to evaluate your implementation of the 110 requirements of NIST SP 800-171 Rev. 2 using the assessment objectives in NIST SP 800-171A.
Most contractors miss that last part. The assessment works through 320 objectives, each judged MET or NOT MET. One requirement can break down into several objectives, and each of them has to stand on its own, with no partial credit at the objective level. Nothing about the questions is secret, either: the objectives are published, so your prep list has been public the whole time.
For each objective, assessors draw on three evidence methods: examine (read the artifacts: configs, policies, logs, screenshots), interview (talk to the people who run the control), and test (watch it actually work). A strong program can produce all three on demand. A weak one has a policy document and a hopeful expression.
It starts with scope and your SSP
Before anyone examines a single control, the assessment opens with scope validation against your System Security Plan. The assessors confirm that the boundary you documented matches the environment they're about to assess. If the boundary is wrong (an unlisted system that touches CUI, a diagram that doesn't match reality), everything after that moment is at risk, because every objective is evaluated against a scope that's now in question. We explain why everything depends on the SSP in No SSP, no score, and assessment week is where that dependency gets stress-tested.
The typical arc
Most engagements follow the same shape: a readiness review, then planning (scope, schedule, evidence logistics, who gets interviewed), then the assessment itself, which takes a week or more and can be virtual, onsite, or both, and finally the findings. If you finish with eligible low-weight items open, there's an optional 180-day POA&M closeout. The rules on what qualifies are strict; our POA&M explainer breaks them down.
Plan any third-party assessment around a confirmed business or contractual need and your actual readiness. The suspension memorandum directs removal of Level 2 C3PAO and Level 3 requirements from affected solicitations and contracts through amendments or modifications. Ask the contracting officer to confirm the applicable requirement; do not treat the former November 2026 transition as a booking deadline.
The week-of survival list
When the assessment is actually on the calendar, readiness comes down to five things:
- Your evidence library is mapped objective by objective, so you can answer any of the 320 in minutes instead of running a scavenger hunt.
- The people named in your SSP have been briefed and can explain what they do in their own words, instead of reciting policy language they've never operated.
- Your SSP is current, so the document the assessors anchor to matches the environment they're standing in.
- Demo environments are ready, so when the method is test you can show the control working live: MFA prompting, logs flowing, access denied where it should be.
- You know which open items are 1-point and POA&M-eligible, and which would sink the assessment if still open.
How to prepare without the panic
The best preparation mirrors the assessment itself. Build the evidence library objective by objective, run dry-run interviews with the actual control owners, and finish with a mock assessment that follows the same order a C3PAO will: scope validation first, then examine, interview, test. A structured system helps a great deal here. Our compliance system keeps evidence and ownership organized all the time, so there's no pre-assessment scramble, and a gap assessment tells you where the NOT METs are while they're still cheap to fix.
inDirectIT holds CMMC Level 2 itself. We've sat on your side of the table, produced the evidence, and taken the interviews, and we can tell you the assessment is far less frightening once you've survived a realistic rehearsal.
Want to find your NOT METs before the C3PAO does?
A practitioner who has been through the real thing will run your team through scope validation, evidence pulls, and interviews, then hand you the findings while they're still fixable. Or email rj@indirectit.com directly.