Reviewed October 6, 2026: the planned November 10, 2026 Phase II expansion is suspended. Phase I self-assessment requirements and DFARS safeguarding duties remain. Check your solicitation, contract, and amendments before choosing an assessment path. Sources: official CMMC status and implementation memorandum.
Who's across the table
A C3PAO — Certified Third-Party Assessment Organization — is accredited by the Cyber AB to conduct CMMC assessments. For Level 2, their job is specific: evaluate your implementation of the 110 requirements of NIST SP 800-171 Rev. 2 using the assessment objectives of NIST SP 800-171A.
That last part is the piece most contractors miss. The assessment isn't 110 judgment calls — it's 320 objectives, each judged MET or NOT MET. One requirement can decompose into several objectives, and every one of them has to stand on its own. There's no partial credit at the objective level, and there's no mystery about what will be asked: the objectives are published. Your prep list has been public the whole time.
For each objective, assessors draw on three evidence methods: examine (read the artifacts — configs, policies, logs, screenshots), interview (talk to the people who run the control), and test (watch it actually work). Strong programs can produce all three on demand. Weak ones have a policy document and a hopeful expression.
It starts with scope — and your SSP
Before anyone examines a single control, the assessment opens with scope validation against your System Security Plan. The assessors confirm that the boundary you documented matches the environment they're about to assess. Get the boundary wrong — an unlisted system that touches CUI, a diagram that doesn't match reality — and everything after that moment is at risk, because every objective is evaluated against a scope that's now in question. We've written about why the SSP gates everything in No SSP, no score; assessment week is where that gate gets stress-tested.
The typical arc
Most engagements follow the same shape: a readiness review, then planning (scope, schedule, evidence logistics, who gets interviewed), then the assessment week or weeks themselves — virtual, onsite, or both — followed by findings. If you finish with eligible low-weight items open, there's an optional 180-day POA&M closeout; the rules on what qualifies are strict, and we've broken them down in our POA&M explainer.
Plan any third-party assessment around a confirmed business or contractual need and your actual readiness. The suspension memorandum directs removal of Level 2 C3PAO and Level 3 requirements from affected solicitations and contracts through amendments or modifications. Ask the contracting officer to confirm the applicable requirement; do not treat the former November 2026 transition as a booking deadline.
The week-of survival list
When the assessment is actually on the calendar, readiness comes down to five things:
- Evidence indexed to objectives. A library mapped objective-by-objective, so any of the 320 can be answered in minutes, not with a scavenger hunt.
- Interviewees briefed on their controls. The people named in your SSP can explain what they do in their own words — not recite policy language they've never operated.
- SSP current. The document the assessors anchor to actually matches the environment they're standing in.
- Demo environments ready. When the method is test, you can show the control working live — MFA prompting, logs flowing, access denied where it should be.
- POA&M-eligible leftovers understood. You know exactly which open items are 1-point and eligible, and which would sink the assessment if still open.
How to prepare without the panic
The best preparation mirrors the assessment itself: build the evidence library mapped objective-by-objective, run dry-run interviews with the actual control owners, and finish with a mock assessment that walks the same arc a C3PAO will — scope validation first, then examine, interview, test. A structured system helps enormously here; our compliance system keeps evidence and ownership organized continuously instead of in a pre-assessment scramble, and a gap assessment tells you where the NOT METs are hiding while they're still cheap to fix.
We say this as practitioners, not spectators: inDirectIT holds CMMC Level 2 itself. We've sat on your side of the table, produced the evidence, and taken the interviews. We hold the certification we help you earn — and the assessment is far less frightening when you've already survived a realistic rehearsal.
Want to find your NOT METs before the C3PAO does?
A practitioner who has been through the real thing will run your team through scope validation, evidence pulls, and interviews — and hand you the findings while they're still fixable. Or email rj@indirectit.com directly.