What evidence will a CMMC assessor ask for?

If your architecture, engineering or construction firm handles CUI on defense work, your SPRS score and the affirmation your principal signs rest on evidence. This article covers the CMMC assessment evidence a Level 2 assessor will ask for, why drafts do not count, and how long you have to keep it.

What evidence does a CMMC assessment require?

CMMC assessment evidence comes from three places: documents, people and systems. Every CMMC Level 2 assessment, whether you run it yourself or a C3PAO runs it, follows NIST SP 800-171A, which uses three methods: examine, interview and test. 32 CFR 170.16(c)(1) applies that standard to self-assessments, and 32 CFR 170.17(c)(1) applies it to certification assessments.

DoD's CMMC Assessment Guide for Level 2 defines each method. Examine is "the process of reviewing, inspecting, observing, studying, or analyzing assessment objects." Interview is "the process of holding discussions with individuals or groups of individuals." Test is "the process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions." The guide also states that "Most objectives will require testing," so a binder of policies is rarely enough on its own.

The guide leaves the final call to the assessor, who decides when "sufficient and adequate evidence has been presented to make an assessment finding." Each of the 110 requirements in NIST SP 800-171 Rev 2 breaks into one or more assessment objectives, and the guide treats a requirement as NOT MET if any one objective is not satisfied. A policy with no matching configuration, or a configuration no one on staff can explain, can sink a requirement on its own.

Which documents should be ready first?

The system security plan and the policies and procedures it points to. NIST SP 800-171 Rev 2 requirement 3.12.4 requires a system security plan that describes the system boundary, the environment of operation, how each requirement is implemented, and how the systems connect to others. Assessors use it as the map for everything else.

The Assessment Guide shows how this works for a single requirement. For AC.L2-3.1.1 (authorized access control), the examine sources it lists include the "access control policy; procedures addressing account management; system security plan," along with system configuration settings and related documentation. Most requirements follow the same pattern: a written rule, a written procedure, and proof the system is set up to match.

For a design firm, the foundational set usually includes:

• The system security plan, with a clear description of where CUI lives and the boundary around it. Our guide to writing a system security plan an assessor can follow covers the structure.
• A network diagram and an asset inventory that sorts each asset into the categories defined in 32 CFR 170.19.
• Approved policies and procedures for each of the 14 requirement families.
• Any plan of action and milestones, with owners and dates for open items.

What counts as a valid artifact?

A final, approved document or a record produced by the system itself. The Assessment Guide states that "All evidence must be in final form and not draft," and lists "working papers, drafts, and unofficial or unapproved policies" as unacceptable evidence.

That rule catches many firms. A policy that sits in a shared folder marked "v3 DRAFT," or one that was written but never approved by leadership, does not count. Neither does an onboarding checklist that exists only in an office manager's head.

System-generated records carry the most weight because they show a control operating day to day. In an architecture or engineering office, useful artifacts include:

• Configuration exports or screenshots showing settings such as multifactor authentication, session lock and audit logging.
• Account records showing that a departing project architect's access was removed, tied to the HR or ticket record of the departure.
• Completed access reviews for project file shares that hold CUI, with the reviewer and date.
• Security awareness training completion records for everyone who handles CUI, including field and project staff.
• Log review records, backup and restore test results, and vulnerability scan reports.

Interviews matter as much as paper. The people an assessor may want to talk with at a design firm include the principal who signs the affirmation, the IT lead or MSP, the BIM or CAD manager who controls project data, and the person who handles onboarding and offboarding. Each should be able to describe their part of the process in their own words, consistent with what the documents say.

How long do you have to keep the evidence?

Six years. 32 CFR 170.16(c)(4) says the artifacts used as evidence for a Level 2 self-assessment "must be retained by the OSA for six (6) years from the CMMC Status Date." 32 CFR 170.17(c)(4) sets the same six-year period for certification assessments.

Certification assessments add a hashing step. Under 170.17(c)(4), the contractor must "hash the artifact files using a NIST-approved hashing algorithm" and give the C3PAO the artifact names, the hash values and the algorithm used, which the C3PAO records in eMASS. DoD's CMMC Artifact Hashing Tool User Guide (Version 2.14, September 2025) provides a PowerShell script that uses SHA-256 and produces a single integrity hash for the full set. The guide states that "The only documentation that is passed to the assessor is the integrity hash," and that "Hashing is only required for assessments by C3PAOs and DCMA DIBCAC."

Two practical points follow. First, once the set is hashed, any later edit to a file breaks the match, so the archive has to stay untouched for the full six years. Second, the guide notes that hashing "does not provide confidentiality for the artifacts." An evidence archive describes how your CUI environment is protected, so it needs access controls and encryption of its own.

Does the Phase 2 suspension change any of this?

No. The suspension changed who checks your evidence. The need for that evidence is the same. On July 13, 2026, the Department of War suspended Phase 2, which would have added Level 2 (C3PAO) certification as a condition of award in applicable solicitations. DoD has not announced a new start date.

Level 2 (Self) still applies where CUI is involved. Your SPRS score is a representation to the government, and an official at your firm affirms it annually. The six-year retention rule in 170.16(c)(4) applies to that self-assessment today. DoD can also conduct its own Medium or High assessment of a contractor under DFARS 252.204-7020, and that review would look for the same kind of evidence. Our summary of what still applies after the Phase 2 suspension covers the rest.

Firms that decide to pursue a voluntary C3PAO assessment will find the evidence work is the same, plus the hashing step. Our walkthrough of what happens during a CMMC Level 2 C3PAO assessment explains the sequence.

What should an AEC firm do this quarter?

Build an evidence index and fill the gaps before anyone asks. Six steps cover most of the work:

• Create a spreadsheet with one row per requirement, listing the artifacts that prove it, where each one is stored, and who owns it.
• Find every policy or procedure still in draft. Finalize it, have leadership approve it, and record the approval date.
• Set a calendar for recurring evidence: quarterly access reviews, monthly log reviews, annual training, and periodic restore tests. Evidence collected on a schedule is easier to defend than evidence assembled the week before an assessment.
• Compare your SSP against how the office actually works today, including project file shares, plotters, jobsite laptops and file transfers to subconsultants.
• Walk each interviewee through their part of the process and confirm their answers match the documents.
• Store the evidence set in a protected location with limited access. If a C3PAO assessment is on your roadmap, run DoD's hashing script on a test folder so the process is familiar.

How does s90 help?

s90 runs IT for architecture, engineering and construction firms in Los Angeles and Orange County, including firms that handle CUI on defense projects. We maintain the NIST SP 800-171 controls behind a Level 2 assessment and produce much of the system-generated evidence on a schedule, so your team is not rebuilding it before each affirmation. If you would like a second look at your evidence index or your SSP, we are glad to talk it through.