CMMC Readiness Review
What to Finish Before Hiring a C3PAO — and What Delays Assessments
A CMMC Level 2 certification assessment follows a structured process governed by the Cyber AB CMMC Assessment Process (CAP). Before the evaluation phase begins, there is a pre-assessment phase where the assessor determines whether your organization is actually ready — and an assessor who finds you unprepared can issue an adverse determination that postpones the entire engagement, at your cost.
Under the Cyber AB CAP, the assessment process opens with a pre-assessment phase (Phase 1) that includes a Certification Assessment Readiness Review (CARR). The lead assessor evaluates whether the organization has stable documentation, a defined scope, and interview-ready control owners before committing to the formal evaluation phase. If the lead assessor determines those conditions are not met, the assessment does not proceed — it stops while the billable clock continues.
Readiness means three things simultaneously: Examine — your documents are complete, current, and mapped to specific assessment objectives. Interview — your control owners know what they own, how it is implemented, and how to answer questions without opening new threads of scrutiny. Test — your live systems actually perform what your documentation claims they do.
What Happens in the Pre-Assessment Phase
The Cyber AB CAP structures the Level 2 certification process into four phases. Phase 1 — the pre-assessment — is the gate that determines whether your organization is ready to enter Phase 2. Understanding what each phase requires, and what causes Phase 1 to produce an adverse determination, is the starting point for readiness planning.
Core Artifacts That Must Be Stable Before Engaging a C3PAO
An assessor conducting the CARR is looking for a specific corpus of core readiness documents. These are not deliverables you produce during the assessment — they are prerequisites the assessor evaluates before agreeing to proceed. If any are missing, incomplete, or contradicted by the live environment, the adverse determination becomes the probable outcome.
Evidence Mapping: How to Point Assessors to the Exact Proof
The difference between a three-week assessment and a three-month assessment is often not the number of gaps in your controls — it is how long it takes the assessor to locate evidence for objectives where the control is actually implemented. Document dumping is the most expensive preparation mistake an organization can make, and it is entirely preventable.
| Practice | Obj. | Evidence Location |
|---|---|---|
| AC.L2-3.1.1 | [a] | Access Policy §3.2 ¶1 |
| AC.L2-3.1.1 | [d] | AD Group Policy export + screenshot |
| AU.L2-3.3.1 | [e] | SIEM config → log review record Jan 2025 |
| IA.L2-3.5.3 | [a] | MFA Config doc p.7 + live demo |
| SC.L2-3.13.11 | [a] | FIPS CMVP Cert #4127 |
| CA.L2-3.12.4 | [a] | SSP §2.1 + Network Diagram Rev B |
| CM.L2-3.4.1 | [b] | Baseline Config doc + firewall export |
Mock Interviews: How to Prepare Control Owners and Protect Your Assessment
The Interview method is not a security awareness conversation. Assessors identify the specific control practice owner from your organizational chart and ask that person — specifically — to explain how their controls are implemented. A control that is correctly documented but owned by someone who cannot explain it is a sufficiency gap on the day it matters most.
Conduct and Document Mock Interviews
Run formal mock interviews with each control owner 90+ days before the assessment. Document the specific questions asked and the answers given — the questions the assessor will ask, matched to the controls each person owns.
Record Corrections and Procedure Gaps
Where a control owner's answer is incomplete or inconsistent with the SSP, document the correction. This surfaces training gaps before the assessor does — and turns pre-assessment preparation into a genuine gap-closure exercise.
Control Owner Leaves Before the Assessment
Without mock interview documentation, a control owner departure leaves a replacement with no context for what the assessor will ask, what the correct answers are, or which controls they are responsible for explaining.
Replacement Reviews Notes, Assessment Continues
With documented mock interviews, the replacement can review the questions, answers, and procedures before the assessment date. The assessor interviews someone who is prepared — not someone who is guessing.
Unprepared replacement. Inconsistent answers. Assessor cannot confirm the control is understood. Sufficiency gap. Not Met finding or expanded testing to resolve the discrepancy.
Replacement walks in prepared. Consistent answers that match the SSP. Assessor confirms control understanding. Met. Assessment continues on schedule.
Answer the question and nothing but the question. A control owner who volunteers that they recently completed a major firewall upgrade, migrated to a new SIEM, or are halfway through deploying MFA gives the assessor new threads to pull — change management logs, configuration documentation, implementation status — that were not in scope until that moment. Every unrequested detail is a potential extension of the assessment. Brief every control owner on this rule individually, and document that the briefing occurred.
Pre-Assessment Failure Modes That Derail Engagements
Submitting an unorganized folder of several hundred documents and expecting the assessor to locate evidence for 320 objectives is the fastest path to an extended, expensive assessment. Assessors are not paid to do your evidence organization. If they are forced to search for the sentence that proves a control is implemented, they will mark the objective Not Met and move on — or expand sampling across all similar controls to compensate for the uncertainty your organization's disorganization created.
Evidence from prior compliance programs frequently addresses the right topics with the wrong vocabulary. CMMC assessors are not permitted to interpret, translate, or infer equivalence between different compliance frameworks. If your access control policy uses ISO vocabulary and the assessment objective uses CMMC vocabulary, the assessor cannot mark the objective Met — regardless of how semantically similar the concepts are.
A 5-point control on your internal POA&M — FIPS-validated cryptography not deployed, multifactor authentication not fully implemented, incident response capability not established — is not a deferrable deficiency under CMMC. Five-point controls cannot be placed on a POA&M. They must be fully implemented before Phase 1 begins. An assessor who identifies a 5-point control as Not Met during the CARR can issue an adverse determination and halt the assessment immediately.
A CMMC assessment is a snapshot — typically conducted over five to ten business days. If a critical control owner is on vacation, on parental leave, or traveling during the assessment window, the assessor cannot complete the Interview method for the controls that person owns. An absence during assessment week produces Not Met findings that a present, prepared control owner would have prevented entirely.
An SSP that describes a scope boundary the network diagram contradicts, or an asset inventory that lists 40 devices while the network shows 80, is an immediate signal to the assessor that the organization does not have confident control over its own environment. Scope inconsistencies during Phase 1 force the assessor to resolve the discrepancy before proceeding — and the resolution always defaults toward the broader interpretation, expanding what must be assessed.
Timing, Staging, and When to Actually Call the C3PAO
Engaging a C3PAO is not the first step in a CMMC compliance program — it is the last step before certification. Every hour of C3PAO time that is spent on work the organization should have completed internally is waste. The sequence that minimizes cost and maximizes the probability of a clean Phase 2 follows a consistent pattern.
- 01Complete a full internal gap analysis against all 110 controls and all 320 assessment objectives. Document every gap with its point value and its remediation status. This is your internal pre-assessment — it is what prevents surprises in Phase 1.
- 02Remediate all 5-point control gaps. These cannot proceed to Phase 2 as open items. If FIPS-validated cryptography, MFA, or incident response capability is not fully implemented, stop the assessment planning clock until it is.
- 03Verify your SPRS score reflects your actual posture. The score you submit before engaging a C3PAO must be defensible against the same assessment the C3PAO will conduct. DIBCAC data consistently shows that self-assessed scores are higher than C3PAO-assessed scores — and a large gap between the two is evidence of misrepresentation.
- 04Finalize all core documents and run the evidence mapping file to completion. Every objective must have a pointer before you schedule Phase 1. Finalizing the mapping file will surface missing evidence gaps that need to be closed before the engagement begins.
- 05Run mock interviews and confirm control owner availability. Document the mock interviews. Confirm that every named control owner will be present and reachable for the full assessment window. Build in a named backup for each critical role.
- 06Then schedule the C3PAO. At this point you have a complete SSP, a defined scope, a current asset inventory and network diagram, an evidence mapping file, prepared control owners, and no open 5-point gaps. Phase 1 should be a confirmation, not a discovery process.
The Bottom Line
A C3PAO engagement is an expensive validation exercise, not a consulting engagement. The assessor's job is to verify that your controls are implemented — not to help you implement them, organize your evidence, or explain your scope to you. Every gap the assessor must resolve on your behalf, every document they must search for, and every control owner they cannot interview because you did not confirm availability adds billable time to an engagement that was always within your control to scope correctly.
Readiness — complete documents, defined scope, mapped evidence, prepared people — is not a courtesy to the assessor. It is the most cost-effective thing your organization can do before the assessment begins.
The question is not "are we close enough to try?" It is "can we put an assessor in front of every control, point them to the evidence, and have a control owner explain it — without any of those three things failing?" If the answer is yes, you are ready. If the answer is "mostly," you are not.