CMMC Level 2 Assessment — Process, Evidence & Timeline

What the assessment actually tests

An assessment is not a review of your policy binder. It is evidence that the 110 NIST SP 800-171 requirements are in place, operating, and documented for the system boundary on the contract. If you need the requirements themselves, start with CMMC Level 2; this page covers the assessment process and the evidence an assessor will ask for.

The three paths to a Level 2 result

Path	Who runs it	What you get	When it applies
Self-assessment	You	An SPRS score you submit yourself	Some contracts, and as a prerequisite step before a C3PAO assessment
C3PAO assessment	Certified third-party assessor	Certification, valid for three years	Contracts that require Level 2 certification
Government-led assessment	DoD assessors	Assessment result	Selected contracts, typically larger or higher-risk

The self-assessment is not a lighter version of certification — it is a different mechanism. Doing it well is what makes a C3PAO assessment survivable.

What an assessor reads first

Your system security plan (3.12.4). It defines scope, boundary, data flows and how each requirement is met. Without it, the assessment does not start.
Your POA&M. Every unmet requirement with an owner, a date and a remediation plan. A POA&M with vague dates is a finding waiting to happen.
Evidence per requirement. Screenshots age badly. Configuration exports, policy documents with revision history, and tickets that show the control operating are worth more than a folder of PNGs.
Consistency. The most common failure is not a missing control — it is a control that exists in the SSP, is described one way in the policy, and is configured another way in production.

Realistic timeline for a small contractor

Stage	Typical duration	What happens
Scoping	1–3 weeks	Define the boundary, find where CUI actually lives, decide what is in scope
Gap assessment	2–4 weeks	Score all 110, build the POA&M, cost the remediation
Remediation	3–9 months	Technical controls, policy writing, SSP, evidence collection
C3PAO assessment	4–8 weeks	Document review, interviews, technical testing, findings
Close-out	2–6 weeks	Fix findings, submit, receive certification

Remediation is the long pole. Almost every contractor underestimates it — the assessment itself is the short part.

The five requirements that sink first-time assessments

Requirement	What assessors find
3.5.3 MFA	Enabled on email, missing on VPN, admin consoles or cloud tenants
3.13.11 FIPS-validated crypto	Encryption exists but is not a FIPS-validated module
3.3.1 / 3.3.5 Audit logging & review	Logs collected, never reviewed; retention shorter than required
3.12.3 Continuous monitoring	Controls assessed once, then not revisited
3.4.1 / 3.4.2 Baselines & settings	No documented baseline, no evidence of enforcement

Start with the number

Before any of this, you need to know how far you are from 110. The calculator takes about 15 minutes and gives you a point gap by family.

Calculate my SPRS score