Back to Knowledge Center
Assessment6 min read
What CMMC Assessors Actually Look For
Assessors use examine, interview, and test methods across all 110 controls. They're not just looking at documents — they want evidence, consistency, and proof that staff actually know the procedures.
CMMC assessors do not take your word for it. Every control determination (MET or NOT MET) must be supported by evidence gathered through examination, interview, or technical testing, as defined in NIST SP 800-171A.
What assessors examine
- ✓Your System Security Plan (SSP) — completeness, accuracy, and consistency with what they observe
- ✓Policy and procedure documents for each control family
- ✓Training records — who completed training, when, what was covered
- ✓Audit logs — are they being generated, retained, and reviewed?
- ✓System inventory and network diagrams
- ✓Incident response plans and documented exercises
- ✓Vendor contracts and MSP agreements
Who assessors interview
- ✓C-suite / senior leadership — understanding of CMMC, affirmation responsibilities
- ✓System administrators and IT staff — technical implementation knowledge
- ✓General employees — security awareness, CUI handling procedures
- ✓HR personnel — personnel security controls, offboarding procedures
- ✓Facilities managers — physical access controls, visitor management
What assessors test
- ✓MFA enforcement: they will attempt to log in without a second factor
- ✓Patch status: they will check system versions against known vulnerabilities
- ✓Encryption: verify that CUI at rest is encrypted on all in-scope devices
- ✓Audit logging: confirm logs are generated and retained appropriately
- ✓Access control: verify that privilege separation is enforced on key systems
The consistency problem
The most common assessment finding is inconsistency: the SSP says one thing, the system is configured differently, and the employee gives a third answer in the interview. All three sources must align.
Ready to start your CMMC journey?
Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.
More in Assessment