What Actually Happens During CMMC Interview Week

“Interview week” is what most people call Phase 2 of a CMMC Level 2 assessment, the part where the assessment team works through your environment objective by objective. It has a reputation it doesn’t quite deserve. It isn’t an interrogation, and it isn’t mostly interviews either. It’s a structured week of looking, asking and testing, run to a written process, and the organizations that do well are the ones that know that process before it starts.

The process is the CMMC Assessment Process (CAP) v2.0, which every C3PAO follows. Here’s what it says happens, and what we see in practice.

It opens with an in-brief

Phase 2 starts with an in-brief meeting, so that everyone has “a common understanding of the assessment objectives, procedures, roles and responsibilities, and schedule” (CAP 2.1). Your Affirming Official, your point of contact and the assessment team attend. The agenda covers the scope, the schedule, conflict-of-interest disclosures and your appeal rights.

Your point of contact matters more than the meeting does. The CAP defines that person as the one who “provides daily coordination and liaison support,” and for the rest of the week they’re the one finding people, opening screens and producing documents on request.

Then the same loop, every day

The CAP requires all three assessment methods: “examine, interview, and test” (CAP 2.6). NIST defines them plainly. Examine is “reviewing, inspecting, observing, studying, or analyzing assessment objects.” Interview is “holding discussions with individuals or groups of individuals to facilitate understanding, achieve clarification, or obtain evidence.” Test is “exercising assessment objects… under specified conditions to compare actual with expected behavior” (NIST SP 800-171A).

The DoD’s Assessment Guide explains why all three matter: “Interviews provide information about what the OSA staff believe to be true… testing demonstrates what has or has not been done.” It also notes that “most objectives will require testing.” An answer in an interview is a lead the assessor will follow. A screen showing the setting in force is the evidence.

Who gets interviewed

Not just IT. The guide describes interviewing “applicable staff (possibly at different organizational levels),” and in practice that means administrators, the people who own each policy, managers who approve access, and sometimes the people who just use the system day to day. If an MSP runs part of your environment, its people take part too: the CAP says an ESP’s respondent “must demonstrate sufficient knowledge and credible ‘ownership’” of what it holds (CAP 2.18).

The best preparation is unglamorous. Know who owns each requirement, make sure they’ll be available that week, and make sure what they describe matches what your SSP says.

How sampling works

Assessors don’t check every laptop and every account. The CAP has them use “a nonstatistical sampling approach” (CAP 2.9), and it says the team “should increase the sample for evaluation once it encounters questionable, insufficient, or inadequate evidence” (CAP 2.10). Every CAGE code in scope has to be covered.

That’s the practical reason clean evidence speeds things up. A first sample that holds up tends to stay small. One that doesn’t makes the next one bigger.

The daily checkpoint

Each day ends with a checkpoint meeting “to summarize progress, identify any challenges, and discuss additional items for coordination” (CAP 2.23). It’s where you find out that tomorrow the team needs the change records for a system, or a second administrator, or access to a site.

What the checkpoint isn’t is a running score. The CAP bars the team from making “any preliminary determination of the OSC’s likelihood of a successful assessment outcome” (CAP 1.11).

What the assessors won’t do

• They won’t tell you how to fix things. Remedial advice would conflict the C3PAO, and the CAP keeps “any recommended or suggested remedial actions” out of the final briefing too (CAP 3.15).
• They won’t predict your result. Not at the checkpoint, and not before the out-brief.
• They won’t keep your evidence. “Assessors and C3PAOs do not retain OSC artifacts, they only retain the hash value captured during the assessment process” (89 FR 83131). You keep the hashed artifacts for six years.
• They won’t accept drafts. Evidence “must be in final form and not draft” (32 CFR § 170.24(b)(1)).

How long it takes

The CAP doesn’t fix a length. The C3PAO and you agree on “an estimate for the approximate duration and timing” up front. In our experience the assessment week itself typically runs three to five days for all 320 objectives, depending mostly on the size of the environment and how quickly evidence appears when it’s asked for.

After the last day

Each requirement is scored MET, NOT MET or not applicable (32 CFR § 170.24). A NOT MET can be re-evaluated during the assessment and for 10 business days after it, but only if additional evidence shows the requirement was met, it doesn’t affect requirements already scored MET, and the findings report hasn’t been delivered (§ 170.17(c)(2)). Treat it as a window for evidence you already have, not time to build a control. Then comes the out-brief, where you hear the result for each requirement.

The surest way to make the real week feel familiar is to have been through one already. That’s what a mock assessment is, and it’s why we recommend one before every Level 2 assessment, as part of the full assessment process.

Sources: Cyber AB, CMMC Assessment Process v2.0 (December 2024), 1.11, 2.1–2.23 and 3.15; NIST SP 800-171A (June 2018), chapter 2; DoD CMMC Assessment Guide, Level 2, version 2.13; 32 CFR Part 170, § 170.17(c)(2) and § 170.24; CMMC Program final rule, 89 FR 83092 (October 15, 2024), preamble at 83131.