The CMMC Assessment Process, Step by Step: Who Does What, and the Two Steps That Raise Your Odds

The CMMC Level 2 assessment process runs in ten steps, from the kickoff and scoping meeting to your Certificate of CMMC Status. Each step has one party that leads it, either the C3PAO, the assessment team, or you, and most have others who take part. The steps follow the official CMMC Assessment Process (CAP). We've laid them out in one image so you can see who does what, and added two steps the CAP doesn't have: status checkpoints and a mock assessment. We believe those two are the keys to passing.

The short version

Ten steps, three parties. The C3PAO leads two, the assessment team leads five, and you lead three. Most steps involve more than one party.
It follows the official CAP, with two steps added that the CAP doesn't require.
Status checkpoints: the Lead CCA checks in with you as often as needed between kickoff and the mock (or Phase 1) to confirm the scoping actions got done and your documents are on track.
Mock assessment: optional, and we recommend it to everyone. You find your gaps before anything is formally recorded.

The CMMC Level 2 assessment process in ten steps, showing who leads each step and who takes part: 1, kickoff and scoping meeting, led by the C3PAO with the assessment team and the organization seeking certification. 2, status checkpoints, led by the assessment team with the organization. 3, document submission, by the organization. 4, optional mock assessment, led by the assessment team with the organization. 5, update documents and resubmit, by the organization. 6, Phase 1 pre-assessment, led by the assessment team with the organization. 7, Phase 2 assessment of conformity, led by the assessment team with the organization. 8, 10-day window, led by the organization with the assessment team. 9, Phase 3 report results, led by the assessment team with the organization and the C3PAO. 10, certification, led by the C3PAO with the organization. — The official CMMC Assessment Process in one image, with the status checkpoints and the optional mock assessment we add. Large circles show who leads a step; small circles show who takes part.

Why put the whole process in one picture?

The official CMMC Assessment Process is thorough, and it's written for assessors. If you're the organization being assessed, the question you actually have is simpler: what happens next, and what do I need to do?

So we mapped every step and every party into one picture. Three groups share the work:

The C3PAO (CMMC Third-Party Assessment Organization) owns the assessment. It runs the kickoff, oversees quality through its CCA QA, and issues your certificate.
The assessment team, led by a Lead CCA (CMMC Certified Assessor), does the assessing: checkpoints, the mock, and Phases 1 through 3.
You, the OSC (Organization Seeking Certification), submit documentation, fix what the mock turns up, and provide evidence when the team asks for it.

Very few steps belong to just one of them. Knowing where you're expected to show up, and where you're expected to lead, takes a lot of the surprise out of the process.

What are the steps in the CMMC assessment process?

Kickoff & scoping meeting · Led by the C3PAO, with the assessment team and you. The C3PAO introduces the teams, you walk through timelines, expectations, scope, and deliverables, and the Lead CCA asks questions.
Status checkpoints (our addition) · Led by the assessment team, with you. The Lead CCA meets with you to go over the actions from kickoff and where you stand, in preparation for the mock or Phase 1.
Document submission · You. You submit the requested documentation for review.
Mock assessment (our addition, optional) · Led by the assessment team, with you. The team reviews your documentation and runs interviews and tests, the same way the formal assessment will.
Update documents & resubmit · You. You update your documentation based on the mock findings and resubmit it for the formal assessment.
Phase 1: pre-assessment · Led by the assessment team, with you. The team evaluates whether you're adequately prepared for the assessment of the CMMC Level 2 requirements.
Phase 2: assess conformity · Led by the assessment team, with you. The team assesses your implementation of the Level 2 requirements and determines whether the assessment objectives are met.
The 10-day window · Led by you, with the assessment team. You provide additional evidence, and the team reviews it and determines compliance.
Phase 3: report results · Led by the assessment team, with you and the C3PAO. The team documents its findings, the CCA QA validates them, the Lead CCA holds an out-brief with you, and the results are submitted to eMASS.
Certification · Led by the C3PAO, with you. The C3PAO issues your Certificate of CMMC Status, and eMASS and SPRS are updated.

Seven of the ten steps come straight from the official process. Steps 2 and 4 are ours, and step 5 follows from the mock. The CAP doesn't require either one, and they're the two we recommend to every C3PAO we work with.

There are no week numbers here on purpose. Every assessment is different, and the timeline depends mostly on how ready you are, how quickly you respond, and who's available on your side.

Why are status checkpoints the key to passing?

Kickoff and scoping always end with a to-do list. The boundary moved. An asset belongs in scope that wasn't on the inventory. A CUI flow needs to be drawn differently. Those decisions only matter if they make it into your documents and your environment before an assessor looks. Without checkpoints, the first time anyone checks is the mock, or worse, Phase 1.

FROM THE ASSESSMENT ROOM

During a kickoff and scoping call, the IT Director mentioned printers, paper, and USBs were in scope, but they weren’t on their diagrams or in their SSP. We also noticed their SSP was written at the 110 Security Requirements level and not at the 320 Assessment Objective level, which is how we assess. The IT Director stated they would update the diagrams and SSP.

We met again several weeks later and reviewed again. The diagrams and SSP were better, but he still needed to make additional clarifications. They were also behind schedule, so we moved the mock out a week. We held one more checkpoint before the mock, where they showed us how they sorted all their documents and evidence so we could prepare. They stated the checkpoints were extremely helpful in understanding what it took to be ready for the mock and then pass the assessment.

Mark DeBryLEAD CCA · CLIENT DETAILS WITHHELD FOR CONFIDENTIALITY

Status checkpoints are short meetings between you and the Lead CCA, held as often as needed from kickoff until the mock, or until Phase 1 if you skip the mock. Each one answers three questions:

Did the scoping changes get made? The updates from kickoff and scoping are reflected in the system security plan (SSP), the asset inventory, the network and data-flow diagrams, and the environment itself.
Does the assessment team have what it needs? Access to the document repository and evidence locations, and time with the people it will need to interview.
Are your documents on track? Real progress toward a complete package for the mock or Phase 1, with any slip found early enough to recover from.

FROM THE ASSESSMENT ROOM

I’ve met with dozens of organizations in kickoff and scoping calls, and they all end great. The OSC is excited about the discussion and ready to update their documentation and finish preparing for the mock or Level 2 assessment. However, too many times we get to the mock or L2 and they didn’t get everything done as planned. We assumed they were on track. They assumed they were fine. The missing piece was the checkpoints. As Lead CCA, I’m adamant about frequent checkpoints to ensure everyone is still on the same page and the OSC is ready for the assessment. Recently, we had an OSC back out three days before their assessment because they weren’t ready. They hadn’t shown up to the checkpoints. If there are two things I recommend to everyone, it’s frequent checkpoints and mock assessments.

Mark DeBryLEAD CCA · CLIENT DETAILS WITHHELD FOR CONFIDENTIALITY

A checkpoint verifies. It doesn't advise. The Lead CCA confirms what's done and what's still open, and leaves the how-to-fix to you and whoever supports your readiness.

We assumed they were on track. They assumed they were fine. Checkpoints replace both assumptions with an answer.

Why do we recommend a mock assessment?

The mock is optional, and it isn't part of the official CAP. It's also the single best investment you can make before a Level 2 assessment.

A mock is a rehearsal run by the assessment team. They review your documentation and run interviews and tests the way they will in the formal assessment, before anything is formally recorded. You find out where you stand while there's still time to act on it.

We recommend having the mock performed by the same C3PAO, Lead CCA, and CCA who will perform your formal assessment. It saves time, and you and your Lead CCA are already on the same page about the gray areas before the assessment starts.

What a mock is not

During a mock, the assessment team can’t provide consulting or recommendations. They assess and report what they find, exactly as they would in the formal assessment. Deciding how to fix a gap stays with you and your readiness support. That independence is what makes the mock an honest preview of the real assessment, and it protects the integrity of your certificate.

What you get out of it:

You find and fix gaps early. No surprises in the formal assessment, because the problems surfaced while fixing them was still cheap and nothing had been formally recorded.
You build confidence and readiness. Your team has already answered assessor questions once, and your documents have had a full round of real assessor review.
You reduce the risk of delays. Fewer surprises means fewer follow-ups, less riding on the 10-day window, and a more efficient formal assessment.

FROM THE ASSESSMENT ROOM

I was going to be the Lead Assessor for a large university. They had previously done a mock with a consultant and learned a lot, but had received some incorrect advice. We met and I explained the value of doing a mock assessment before the official Level 2, and they agreed. The mock went well, but some issues were identified that would have prevented them from passing. They were able to resolve the issues and pass the official assessment relatively easily.

I’ve been assessing a large defense contractor for the past year. They have many divisions and departments that all have their own System Security Plan. We emphasized mock assessments from the beginning, and they saw the value and agreed. So each one goes through a mock where issues are identified. They resolve them, and then we re-assess for the official Level 2 assessments, which have all gone smoothly.

Mark DeBryLEAD CCA · CLIENT DETAILS WITHHELD FOR CONFIDENTIALITY

Step 5 is where the mock pays for itself: you update your documentation based on the findings and resubmit it for the formal assessment.

Skip the mock, and the checkpoints are your only structured look at readiness before Phase 1. They carry more weight, and you carry more risk into it.

What happens in Phases 1 through 3?

Phase 1 is the pre-assessment. The team evaluates whether you're adequately prepared for the Level 2 assessment. If you aren't, the assessment doesn't go ahead as planned, and that costs you time and money. Checkpoints and a mock exist so that by Phase 1 there are no major roadblocks left to discover.

Phase 2 is the assessment itself: interviews, evidence review, and testing against the Level 2 requirements. Interview week typically runs three to five days and covers all 320 assessment objectives.

The 10-day window follows. A requirement scored NOT MET can be re-evaluated during the assessment and for 10 business days after it, if you have additional evidence that it was met, the change doesn't affect requirements already scored MET, and the findings report hasn't been delivered (32 CFR § 170.17(c)(2)). It's a window for evidence you already have, not time to fix a control.

Phase 3 reports the results. The team documents its findings, and the CCA QA validates them. That's the C3PAO's quality assurance role: a CCA who oversees quality on your assessment by attending calls and reviewing the assessors' documentation, and who gives final approval of the documents submitted into eMASS. Then the Lead CCA walks you through the results in an out-brief, and they go into eMASS.

Phase 4: certification closes it out. The C3PAO issues your Certificate of CMMC Status (32 CFR § 170.9), and eMASS passes the results to SPRS.

If a few low-value requirements are still open, your status may be Conditional, with 180 days to close them. See what can go on a CMMC POA&M and how the 180-day closeout works. And certification isn't the finish line: your Affirming Official affirms every year.

Two things we recommend to everyone

The official process gets you assessed. Checkpoints and a mock get you ready for it. When you're scheduling a Level 2 assessment, ask your C3PAO how they handle the time between kickoff and Phase 1, and whether a mock is on the table.

Our Lead CCAs run Level 2 assessments with our C3PAO partners using this process, and a mock assessment is the place to start if you want to know where you stand before it counts.

Why put the whole process in one picture?

What are the steps in the CMMC assessment process?

Why are status checkpoints the key to passing?

Why do we recommend a mock assessment?

What happens in Phases 1 through 3?

Two things we recommend to everyone

MORE ON GETTING CERTIFIED

Words Matter: Defining the Intention of Verbs in CMMC's Objectives

Want an assessor’s read on your situation?