Notes From the Assessment Room
Practical answers on CMMC readiness, assessments, ongoing compliance, and training, written by the people who do this work.
LATEST INSIGHTS
Latest insights
Words Matter: Defining the Intention of Verbs in CMMC's Objectives
CMMC Level 2's 320 assessment objectives each end in a verb, and the verb tells you what evidence an assessor looks for. What defined, identified, performed, monitored, controlled, and prevented actually ask for.
GETTING CERTIFIEDThe CMMC Assessment Process, Step by Step: Who Does What, and the Two Steps That Raise Your Odds
The CMMC Level 2 assessment process in ten steps, who leads each one and who takes part, and the two steps the official process doesn't include that raise your odds of passing: checkpoints and a mock assessment.
COST & READINESS PLANNINGHow to Use Brilliant at the Basics in Your CMMC Level 2 Program
The DoW CIO's Brilliant at the Basics campaign lists ten IT and ten OT practices. How they map to CMMC Level 2, which ones go beyond it, and how to use the OT list to document your Specialized Assets.
TRAINING & CREDENTIALINGCMMC CCA Training Cost: What You're Paying For
What it costs to become a CMMC Certified Assessor in 2026: the ISACA application, exam and renewal fees, what a CCA course should include, and the costs that don't show up on any price list.
CONTINUOUS COMPLIANCENIST SP 800-171 Rev 3 and CMMC: What Changes If You're Already Compliant
NIST published SP 800-171 Revision 3 in May 2024, but CMMC Level 2 and DFARS 252.204-7012 still point to Revision 2. What Rev 3 changed, why it doesn't apply to your assessment yet, and what to do now.
TRAINING & CREDENTIALINGCMMC CCP vs. CCA: Which Certification, in What Order, and What It Takes
The CMMC Certified Professional (CCP) and CMMC Certified Assessor (CCA) are two steps on one path. What each lets you do, what the CCA and Lead CCA require, and which one fits your role.
CMMC FUNDAMENTALSCMMC for Subcontractors: How Flow-Down Works, Tier by Tier
CMMC reaches every tier of the supply chain that handles FCI or CUI. Which level a subcontractor needs, what the prime has to check before award, and what to do when a prime just says “be CMMC compliant.”
CONTINUOUS COMPLIANCEHow to Do a CMMC Level 1 Self-Assessment, Step by Step
A Level 1 self-assessment checks 59 assessment objectives across 15 requirements, and one miss fails a requirement. How to scope it, what an assessor looks for in each requirement, and how to enter the result in SPRS.
CONTINUOUS COMPLIANCECMMC POA&Ms: What You Can Put on One, and the 180-Day Closeout
Level 1 allows no POA&Ms. Level 2 allows them only for a few low-value requirements, only with a score of 88 or more, and only for 180 days. The rules from 32 CFR 170.21, and how to plan a POA&M you can actually close.
CMMC FUNDAMENTALSCUI vs. FCI: Real Examples, Not Definitions
FCI decides whether you need CMMC Level 1; CUI decides Level 2. What each one looks like in a defense contractor's inbox, what doesn't count, and five checks to tell which you're holding.
CONTINUOUS COMPLIANCEThe Annual CMMC Affirmation: What Your Affirming Official Is Actually Signing
Every CMMC Level 1 and Level 2 contractor affirms compliance in SPRS every year. Who the Affirming Official is, what the affirmation says, when it's due, and what should stand behind the signature.
ASSESSOR CAPACITYBorrow the Bench: Assessor Staff Augmentation for C3PAOs
How C3PAOs add Lead CCAs and CCAs on contract, under their own authority, to take on more Level 2 work without full-time hires, and why that matters while Phase 2 is suspended.
CMMC FUNDAMENTALSCMMC Phase 2 Suspended: What Still Applies
Phase 2 paused the C3PAO certification requirement, not CMMC. What's still required (NIST SP 800-171, SPRS, self-assessments, affirmations), what's on hold, and what to do now.
NEXT STEP
Have a question we haven’t written about yet?
Talk to a Certified Assessor about where you stand.
Thirty minutes. No obligation.