What happens during a CMMC Level 2 C3PAO assessment?

If a prime has asked your firm for a CMMC Level 2 certificate, or your principals have decided to certify before the next solicitation cycle, the CMMC assessment process is where your preparation gets tested. For an architecture, engineering, or construction firm, one NOT MET on the wrong requirement can mean no certificate for the prime that is waiting on it, or a Conditional status with a 180-day clock to close.

Can you still get a C3PAO assessment in late 2026?

Yes. The Department of War suspended CMMC Phase 2 on July 13, 2026, and its implementing memo says program managers "may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments" while the program is under review. That stopped DoD from requiring a certificate. It did not stop the assessments.

Two days later, the Cyber AB stated that "all CMMC program elements remain operational and available, to include C3PAO Level 2 certification assessments." The 60-day review window closed in September, and as of mid-October 2026 we have not seen a new Phase 2 start date published.

So the firms booking assessments now are doing it by choice, usually because a prime still asks for a certificate or because their preparation is done. If you are still deciding, start with whether to book a C3PAO assessment during the pause. This article covers what happens once you do.

What rules govern the CMMC assessment process?

A federal regulation and two guidance documents. 32 CFR 170.17 requires the C3PAO to assess against NIST SP 800-171A (June 2018), scope the assessment under 170.19, and score it under 170.24. DoD's CMMC Assessment Guide for Level 2, version 2.13 from September 2024, explains the assessment objectives and methods requirement by requirement.

The Cyber AB's CMMC Assessment Process document sets out the steps C3PAOs follow to plan, conduct, and report an assessment. Ask your C3PAO which version it works from and request its schedule and evidence expectations in writing before you sign.

What has to be ready before assessors arrive?

A defined scope, a current system security plan, and final evidence. The scope covers the systems that process, store, or transmit CUI and the assets that protect them. For an architecture or engineering firm, that usually means project file storage, email, the workstations and laptops of staff on defense projects, plotters and scanners, and any collaboration platform used with primes and subconsultants.

Four preparation points come straight from the rule and the guide:

• The system security plan must exist. Under 32 CFR 170.21, CA.L2-3.12.4 (System Security Plan) is one of six requirements that can never go on a plan of action and milestones.
• Cloud services that hold CUI must be FedRAMP Authorized at the Moderate baseline or meet equivalent requirements, with the customer responsibility matrix documented or referenced in the SSP, under 170.17(c)(5).
• External service providers, including a managed IT provider, must be documented in the SSP, and the services they provide to meet requirements are assessed within your scope, under 170.17(c)(6).
• Evidence must be final. The Assessment Guide says "Unacceptable forms of evidence include working papers, drafts, and unofficial or unapproved policies."

The rule also requires your firm to hash its evidence artifacts with a NIST-approved algorithm, give the C3PAO a list of artifact names, hash values, and the algorithm, and keep the hashed artifacts for six years from the CMMC Status Date. DoD publishes a hashing guide for this step. Set it up before the assessment, not during it.

What do assessors actually do during the assessment?

They examine, interview, and test. The Assessment Guide, drawing on NIST SP 800-171A, defines the three methods:

• Examine: "the process of reviewing, inspecting, observing, studying, or analyzing assessment objects," such as policies, diagrams, and configuration settings.
• Interview: "the process of holding discussions with individuals or groups of individuals" to build understanding or obtain evidence.
• Test: "the process of exercising assessment objects (i.e., activities, mechanisms) under specified conditions to compare actual with expected behavior."

The guide expects most objectives to require testing. In practice, that means assessors ask your administrator to show things working rather than describe them: an account being disabled, a multi-factor prompt on remote access, an audit log being searched, a laptop's encryption status. They may walk the office to check visitor escort, physical access logs, and how drawings with CUI markings are handled at the plotter.

Interviews reach beyond IT. Expect conversations with an office manager, a project manager who handles CUI, and whoever approves access. The guide notes that interviews show what staff believe is true, documentation shows what policy says, and testing shows what is actually done. Assessors look for those three to agree.

How is a CMMC Level 2 assessment scored?

Each of the 110 requirements is scored MET, NOT MET, or NOT APPLICABLE. The guide defines MET as "All applicable assessment objectives for the security requirement are satisfied based on evidence." A single objective that is not satisfied makes the whole requirement NOT MET.

32 CFR 170.24 then converts the results to a score. The maximum is 110, each requirement carries a value of 1, 3, or 5 points, and each NOT MET subtracts its value. The rule allows partial credit for only two requirements, 3.5.3 (multifactor authentication) and 3.13.11 (CUI encryption).

Can you fix a finding during the assessment?

Only within narrow limits. Under 170.17(c)(2), a NOT MET requirement can be re-evaluated during the assessment and for 10 business days after the active assessment period, but only if new evidence shows the requirement is met, the change does not affect other requirements already scored MET, and the C3PAO has not delivered the findings report.

That window suits a missing screenshot or a setting that was fixed and can be shown. It will not cover a program that was never built.

What happens after the assessment?

The C3PAO uploads the results to eMASS, which passes them to SPRS, and your firm receives a CMMC Assessment Findings Report. The upload includes the assessment date, the assessors, your CAGE codes, the SSP name, date, and version, the result for each objective, and the artifact hash list.

There are two possible statuses:

• Final Level 2 (C3PAO): every applicable requirement is MET, either at the assessment or after a POA&M closeout assessment.
• Conditional Level 2 (C3PAO): open items are on a POA&M that meets 170.21. The score must be at least 0.8 of the maximum (88 of 110), no POA&M item may be worth more than 1 point except 3.13.11 where encryption is not FIPS-validated, and six named requirements cannot be deferred. A C3PAO must close out the POA&M within 180 days of the Conditional status date, or the status expires.

After that, an affirming official affirms compliance at the time of the assessment and annually, and a new certification assessment is due within three years. DoD can still run its own DIBCAC assessment, and under 170.17(a)(1)(iv) its results override the existing status if they find noncompliance.

How should an AEC firm prepare for a CMMC assessment this quarter?

Work backward from the evidence the assessors will ask for:

• Confirm in writing with each prime whether it still requires a C3PAO certificate, and keep the answers.
• Freeze the scope. Map every place CUI lives today, and update the SSP and network diagrams to match.
• Run a mock assessment against the 800-171A objectives, using the examine, interview, and test methods rather than a document review alone.
• Finalize, date, and approve every policy and procedure. Drafts do not count.
• Get the shared responsibility documentation from your cloud providers and your managed IT provider, and reference it in the SSP.
• Check the six requirements that cannot go on a POA&M: external connections, public information, the SSP, visitor escort, physical access logs, and physical access management.
• Brief the staff likely to be interviewed. They should describe what they actually do, in their own words.

For a refresher on which gaps to close first if your SPRS score is low, see which NIST 800-171 gaps to close during the pause, and for the obligations that never paused, see what still applies after the Phase 2 suspension.

How s90 helps

s90 runs IT for architecture, engineering, and construction firms in Los Angeles and Orange County. We maintain the NIST SP 800-171 controls behind a Level 2 assessment and keep the evidence organized and current between affirmations. If you have a C3PAO date on the calendar, we are glad to help you get ready.