What a Mock CMMC Assessment Covers, and How to Get the Most From One

A mock CMMC assessment is a rehearsal of your Level 2 assessment: real assessors, real methods, your real evidence, and nothing recorded against you. It's optional, it isn't part of the official process, and it's the best look you'll get at your readiness before it counts.

What most people don't realize is that "mock assessment" covers two different things. One tells you how to fix what it finds. The other can't, and that limit is exactly what lets your C3PAO certify you afterward.

A mock has no official standing

The CMMC rule never mentions mock assessments, and neither does the CMMC Assessment Process (CAP) that C3PAOs follow. The only official definition is in the Cyber AB's Code of Professional Conduct, which calls them "non-certification assessments" that "are often referred to as 'mock assessments,' 'gap assessments,' or 'dry-run assessments'" (CoPC v2.0, § 3.4).

The same section draws the line. Mocks are "conducted outside the purview of the CMMC Program," they "are not reported to the CMMC instantiation of eMASS," and they don't "convey any standing within the CMMC Program." A strong result tells you a lot. It isn't a certificate.

Two kinds of mock, at two points on the road

The dividing line is independence. The CMMC rule bars anyone from a certification assessment where they "previously served as a consultant to prepare the organization for any CMMC assessment within 3 years" (32 CFR § 170.8(b)(17)(ii)(G)). The Code applies that bar to the C3PAO as an organization and to every assessment team member, covering "any preparatory, advisory, or consulting activities" (§ 3.3). Advice on how to fix a gap is exactly that.

So an advisory mock earns its place earlier, while you still need help deciding how to close gaps. A formal mock belongs close to the assessment, once your remediation is done and what you need is an honest preview.

What keeps a formal mock from becoming consulting

The Code says a C3PAO can run a mock without creating a conflict when three things hold. It's "conducted in a formal fashion and in accordance with the assessment procedures established in 32 CFR Part 170" and the CAP. The C3PAO doesn't "provide any recommendations, advice, or consultative information as to how the OSA might remediate any discrepancies or improve their security posture." And the organization receives "a deliverable documenting the official results" (§ 3.4).

That's why we recommend having your formal mock performed by the same C3PAO, Lead CCA and CCA who will assess you, as we explain in the CMMC assessment process, step by step. You get the closest preview there is, and the gray areas get settled before the assessment starts.

What a mock actually covers

A well-run mock works through the same ground as the formal assessment. It reviews your system security plan (SSP), policies, procedures, artifacts and asset categorization against what assessors expect. It checks your system boundaries, any enclaves, and how Controlled Unclassified Information (CUI) moves and is protected. It interviews the people who run your controls, the way an assessor will.

And it tests. The assessment uses three methods, examine, interview and test, and the DoD's Assessment Guide notes that "most objectives will require testing." A mock that only reads your documents isn't a rehearsal.

The result scores each objective as MET, NOT MET or not applicable, and that tells you more than pass or fail. Under 32 CFR § 170.21, you can reach a Conditional status with open items only with a score of 88 or higher (80 percent), only if every open item is worth 1 point (with one encryption exception), and only if none of six specific requirements is open. A mock shows you which side of each line you're on while you can still move. (More on that in CMMC POA&Ms and the 180-day closeout.)

Why Phase 1 is the expensive place to find out

The formal assessment opens with a readiness review, and under the CAP, "the Lead CCA shall make the determination as to the readiness of the OSC to proceed" (CAP v2.0, 1.10). If you aren't ready, the Lead CCA recommends suspending the assessment and explains why in writing, "without providing any remedial advice" (1.22), because advice at that point would conflict the C3PAO from resuming it (1.23).

Getting the most from one

Pick the kind on purpose: advisory while you still need help with the fixes, formal once they're done. Then run it like the real thing.

1. Bring final evidence. The Assessment Guide is explicit that "unacceptable forms of evidence include working papers, drafts, and unofficial or unapproved policies." A mock run on drafts measures the wrong thing.
2. Put the right people in the room. Your system administrators, your MSP, and whoever owns each control should answer for it, as they will in the assessment.
3. Leave time to fix what it finds. Schedule it early enough to remediate, update your documents and resubmit before Phase 1.
4. Don't read a good mock as a pass. It has no standing in the program, and the CAP bars the assessment team from predicting your outcome.
5. Don't count on the 10-day window. After the assessment, a NOT MET requirement can be re-evaluated only on additional evidence that it was already met (§ 170.17(c)(2)). It isn't time to fix a control.

Our own mock assessment is the advisory kind, run by experienced CCAs: documents and evidence, scope and data flows, assessor-style interviews, and findings with recommendations to close the gaps. Because it includes recommendations, the CCAs who run it can't take part in your certification assessment for three years, which is how the independence rule is meant to work.

Sources: Cyber AB, CMMC Code of Professional Conduct v2.0 (December 2024), §§ 3.3 and 3.4; Cyber AB, CMMC Assessment Process v2.0 (December 2024), 1.10, 1.22 and 1.23; 32 CFR Part 170, § 170.8(b)(17)(ii)(G), § 170.17(c)(2), § 170.21(a)(2) and § 170.24; DoD CMMC Assessment Guide, Level 2, version 2.13.