How a C3PAO Assessment Works: Step by Step

A CMMC Level 2 assessment by an accredited C3PAO follows a structured process defined by DoD and the Cyber AB. Understanding what each phase involves helps you prepare effectively.

Phase 1: Pre-assessment and scoping (2–4 weeks)

• ✓Sign a contract with an accredited C3PAO and assign a Certified CMMC Assessor (CCA)
• ✓Define the assessment boundary: which systems, networks, and locations handle CUI
• ✓Review your System Security Plan (SSP) for completeness and consistency
• ✓Identify key personnel for interviews (IT staff, executives, facilities, HR)
• ✓Establish evidence collection priorities and documentation packages

Phase 2: Document examination

Assessors examine your documentation. Key documents reviewed include:

• ✓System Security Plan (SSP)
• ✓Plan of Action and Milestones (POA&M)
• ✓Information system policies and procedures for each control family
• ✓Network diagrams and system inventory
• ✓Training records, audit logs, and configuration baselines

Phase 3: Personnel interviews

Assessors interview personnel across multiple roles — not just IT staff. Expect interviews with system administrators, security personnel, executives, HR representatives, and facilities managers.

Phase 4: Technical testing and observation

• ✓Verifying MFA enforcement on all accounts with CUI access
• ✓Confirming CUI encryption at rest and in transit
• ✓Validating audit logging configuration and log retention
• ✓Reviewing access control lists and privilege separation
• ✓Checking patch currency on systems in the assessment boundary

Phase 5: Report and certification decision

The C3PAO submits assessment findings to the Cyber AB. If all 110 controls are met, a full CMMC Level 2 certificate is issued. If there are open findings that are POA&M-eligible, a conditional certificate is issued with a 180-day remediation window.