The CMMC Assessment Process
The 4 Phases, Required Outputs, and What Happens in Each Step
The CMMC Assessment Process (CAP), defined by the Cyber AB, is the standardized process that organizes a Level 2 certification assessment into four sequential phases and defines the required activities, outputs, and roles at each step. The four phases are: Pre-Assessment, Assess Conformity, Complete and Report Results, and Issue Certificate and Close Out POA&M. Every C3PAO must follow this process; the forms and sequence are identical regardless of the organization being assessed.
The CMMC Assessment Process (CAP) is the Cyber AB's standardized four-phase procedure that governs how a C3PAO conducts a CMMC Level 2 certification assessment — from initial readiness review through certificate issuance. Defined under 32 CFR Part 170 and the Cyber AB CAP v2.0, the process evaluates all 110 NIST SP 800-171 controls across 320 assessment objectives using NIST SP 800-171A methods. Sequence is jurisdictional — a C3PAO cannot move to Phase 2 without completing Phase 1. An interim certificate cannot be issued without a qualifying SPRS score and the absence of open 5-point deficiencies. A POA&M closeout cannot succeed unless all items are remediated within 180 days and re-verified by an assessor. Each phase is a gate, and each gate has a defined consequence for failure.
What Are the Four Phases of a CMMC Assessment?
What Happens During CMMC Pre-Assessment (Phase 1)?
Phase 1 begins when an organization contacts a C3PAO and executes an engagement agreement. The phase has two primary objectives: confirm the scope of the assessment, and determine whether the OSC is actually ready to proceed to Phase 2. The second objective — the Certification Assessment Readiness Review (CARR) — is where most premature assessment engagements fail.
How Does Phase 2 Evaluate CMMC Controls?
Phase 2 is the active assessment — typically executed over five to ten business days on-site, in a hybrid format, or remotely depending on the engagement agreement. The assessment team applies the three NIST SP 800-171A assessment methods to each of the 320 assessment objectives across all 110 control practices, recording a Met or Not Met determination for each.
Document Review
The assessor reviews specifications (policies, procedures, SSP implementation statements), mechanisms (configuration exports, screenshots, system outputs), and activities (dated records of execution — log reviews, scan results, training logs).
Evidence that exists but cannot be located quickly will not be found. The evidence mapping file exists to prevent this outcome.
Control Owner Interviews
The assessor interviews the specific individual named as control owner for each practice — not a designated spokesperson. The interview verifies that the control owner understands what they own and can describe how it is implemented consistently with the SSP.
Answers that contradict documentation, or control owners who cannot describe their own controls, produce sufficiency gaps regardless of what the SSP says.
Live System Verification
The assessor tests whether live systems perform as documented — triggering an alert to verify SIEM response, observing a vulnerability scan, reviewing firewall ACL enforcement, or confirming MFA is active on CUI accounts.
Systems that perform differently from their documented configuration produce findings — even when the documentation is otherwise complete and correct.
Assessment objectives are evaluated individually. A control practice with four objectives is Met only when all four are independently verified as Met. A single Not Met objective fails the entire practice — there is no partial credit and no averaging across objectives within a practice.
What Gets Submitted to eMASS After Phase 2?
When Phase 2 concludes, the lead assessor compiles all findings into the Assessment Results Package. This package must pass a quality review before being uploaded to the government's CMMC eMASS system, where the certification determination is made.
The original evidence artifacts are retained by the OSC in secure, controlled storage for a minimum of three years. If DIBCAC audits the OSC later, they will re-hash the archived documents to verify they are the same files evaluated during the original assessment. Any tampering with the archive is detectable.
What Happens After the CMMC Assessment Is Complete?
Phase 4 has two distinct paths. An OSC that achieves a perfect score — all 110 practices Met, all 320 objectives Met — receives a Final CMMC Status and the certification is issued. An OSC that falls short of perfection but meets the minimum threshold may receive a Conditional CMMC Status, which initiates the POA&M closeout process with strict deadlines.
Conditional status under DFARS 252.204-7021 requires the contractor to meet an 88/110 threshold (no 5-point controls open on the POA&M) and remediate all remaining deficiencies within 180 calendar days. The conditional status is the certification of record during that window — it allows continued contract performance. Failure to close out within 180 days is not a deferral; it is a revocation.
Who Is Responsible for What During a CMMC Assessment?
The CAP assigns specific responsibilities to each participant role. Understanding who owns what — and what the boundaries of each role's authority are — prevents the coordination failures that stall assessments at phase transitions.
| Role | Authorization | Phase Responsibilities | Key Limits |
|---|---|---|---|
| OSC Point of Contact | Designated by the organization | Primary liaison with the lead assessor across all phases. Coordinates document delivery, schedules control owner interviews, tracks daily checkpoint action items, manages POA&M remediation timeline. | Cannot approve scope changes or negotiate assessment findings. All scope and finding disputes go through the lead assessor. |
| Lead Assessor (CCA) | Certified CMMC Assessor — Level 2 qualified | Manages the entire CAP engagement. Makes the final scope approval in Phase 1. Directs the assessment team in Phase 2. Reviews all team member findings. Signs off on the assessment results package. Issues the readiness determination and final findings. | Cannot delegate final finding authority to CCPs for Level 2 practices. All Level 2 objective findings must be approved by the lead assessor regardless of who conducted the initial review. |
| Assessment Team (CCA / CCP) | CCAs: full Level 1 and Level 2 authority. CCPs: Level 1 only. | Execute the Examine, Interview, and Test methods under the lead assessor's direction. Document findings per CAP procedures. CCPs may assist with Level 2 evidence review but cannot make Level 2 findings independently — the lead assessor must review and sign off on any Level 2 objective a CCP evaluated. | CCPs cannot independently determine findings for any Level 2 practice objective. Any CCP-reviewed Level 2 objective requires lead assessor review and approval before the finding is recorded. |
| CQAP | Certified Quality Assessor Professional at the C3PAO | Reviews the complete assessment results package for accuracy, completeness, and CAP compliance before submission to eMASS. The CQAP is the final internal check — if the package has errors or omissions, the CQAP returns it to the lead assessor for correction before submission. | The CQAP does not make or change finding determinations. Their role is quality review of the package, not re-assessment of the findings. |
The Bottom Line
The CAP is not a flexible framework — it is a structured process with defined gates, mandatory outputs, and consequences for non-compliance at every phase transition under DFARS 252.204-7021.
Plan your assessment by working backward from your target certification date: (1) Schedule the C3PAO engagement only after all Phase 1 prerequisites are complete — SSP signed, scope defined, evidence mapped to all 320 objectives. (2) Block the full Phase 2 assessment window (5-10 business days) on every control owner's calendar and confirm no conflicts. (3) Build a Phase 4 remediation timeline from Day 1 of conditional status — not from the week the closeout assessment is scheduled — and allocate budget for a closeout C3PAO visit no later than Day 150 to leave margin for any remaining gaps. (4) Post your annual affirmation and SPRS score update on the schedule required by DFARS 252.204-7020 in Years 2 and 3 of the triennial cycle. Each surprise in a CAP engagement is measured in assessor hours, timeline extensions, and contract eligibility risk.
The 180-day closeout deadline is not a soft target — it is the boundary between a certification and a failed certification. Plan the POA&M remediation timeline from Day 1 of conditional status, not from the week the closeout assessment is scheduled. The difference between the two approaches is the difference between a successful certification cycle and a full reassessment at full cost.