# The CMMC Level 2 Assessment, Step by Step > The Cybersecurity Maturity Model Certification stopped being a slide deck in December 2024: the program's final rule (32 CFR Part 170) put real requirements behind real contracts, and official Level 2 assessments now run through Cyber AB-authorized C3PAOs with results filed in eMASS. If your company handles Controlled Unclassified Information for the Department of Defense, here is the assessment as it actually unfolds: what you must have ready before booking, what the C3PAO does on the clock, what a passing score is, and what happens after the certificate lands. - **Published**: 2026-10-28 - **URL**: https://vendorquals.com/blog/cmmc-level-2-assessment --- # The CMMC Level 2 Assessment, Step by Step *The Cybersecurity Maturity Model Certification stopped being a slide deck in December 2024: the program's final rule (32 CFR Part 170) put real requirements behind real contracts, and official Level 2 assessments now run through Cyber AB-authorized C3PAOs with results filed in eMASS. If your company handles Controlled Unclassified Information for the Department of Defense, here is the assessment as it actually unfolds: what you must have ready before booking, what the C3PAO does on the clock, what a passing score is, and what happens after the certificate lands.* ## Key takeaways - **Level 2 means CUI, and the rule splits who assesses.** Level 1 covers Federal Contract Information with an annual self-assessment. Level 2 covers Controlled Unclassified Information under the 110 practices that carry over from NIST 800-171, and depending on the contract, it is either a triennial C3PAO assessment or an annual self-assessment. Check the contract language, not the internet, for which one reaches you. - **Scoping is the whole game.** The assessment boundary (the enclave) decides what the 110 practices apply to. A company that scopes its CUI into a small, well-built enclave faces a fraction of the work of one that lets CUI touch everything. This is decided before the assessment, not during it. - **88 of 110 is the conditional-pass threshold.** Under the final rule, a score of 88 points (80 percent) with no unassessable practices allows a conditional certification with a POA&M; the POA&M items must close within 120 days. A full 110 is a clean pass with no POA&M conditions. - **Only a C3PAO can run the official assessment.** The Certified Third-Party Assessment Organization role is authorized by the Cyber AB; its results go into eMASS, the system where DoD sees your assessment. The [documented C3PAO directory here](/firms/cmmc-services) lists every authorized firm on the roster with its evidence attached. - **The certificate is valid three years** for a C3PAO assessment, with the SPRS score updated from the result. Plan the recertification cycle like maintenance, not like a fire drill. ## Before the assessment exists: the contract decides CMMC does not apply to a company the way a law applies to a person. It applies to contracts. The requirement reaches you when DoD contract language puts it there (the CMMC clause, DFARS 252.204-7021, phased into new contracts across the program's rollout), and the clause names your level and your assessment type. Until a contract carries it, the operative requirement for companies handling covered defense information is the older DFARS 252.204-7012 clause: NIST 800-171 compliance plus a self-assessment score posted in SPRS, the Supplier Performance Risk System. That is why the first step of a Level 2 assessment is not technical at all: read the contract. If it requires a C3PAO assessment, nothing self-run will satisfy it. If it accepts the annual self-assessment, a C3PAO is still worth engaging for rigor, but the paper that matters is your own. The [contract-layer explainer here](/blog/dfars-252-204-7012-nist-800-171) walks the clause stack. ## Step 1: Scoping and the asset boundary The assessment covers an environment, not a company. The final rule's scoping vocabulary sorts everything you own into categories: the assets that process or store CUI, the security protection assets that guard them (authentication, logging, backup), contractor risk managed assets, specialized assets (the OT devices, test benches, and phones the practices reach differently), and everything else, which is out of scope. Two companies with identical revenue can face assessments that differ by an order of magnitude, purely on where CUI is allowed to live. The firms that do this well drive CUI into a defined enclave: a bounded network segment, a controlled cloud tenant (GCC High or a FedRAMP-authorized environment), and a short asset list. The firms that do it poorly discover mid-assessment that CUI has been sitting in shared file shares and personal email attachments for years. This is also where a C3PAO earns or loses its fee before the assessment starts: the good ones pressure-test the boundary in advance, in writing. ## Step 2: The System Security Plan The System Security Plan (SSP) is the document the 110 practices get assessed against: for each practice, what your company does, on which systems, implemented how. The assessment is objective-based per the program's assessment guides: the assessor looks for the artifact that proves each practice, not for a narrative about why the practice matters. The SSP and its evidence inventory are the work. A realistic preparation phase runs months, not weeks, and it is where gap analysis, remediation, and POA&M development all happen. A C3PAO that quotes a two-week turnaround for a company with no SSP is not quoting an assessment; it is quoting a disappointment. ## Step 3: Booking the C3PAO The assessment itself is scheduled with the C3PAO, scoped against the enclave, and priced accordingly. What varies between firms, and what the roster's evidence lets you check before you call anyone: - **Authorization itself.** Every firm on the Cyber AB's C3PAO roster is authorized by definition; what varies is where that authorization is verifiable. The [directory here](/firms/cmmc-services) shows per firm whether the authorization is confirmed on the firm's own site, confirmed in public coverage, or carries only the mirror listing. - **Certified people.** The roster publishes counts of certified individuals (CCP and CCA holders); more certified assessors means scheduling flexibility, and some contracts effectively demand it. - **Assessment history.** The transition-era Joint Surveillance Voluntary Assessments (JSVA) ran as pilots; firms with completed assessments behind them have seen the process end to end. - **Fit.** Some C3PAOs specialize in small subcontractors with one enclave; others run multi-site programs for primes. The wrong fit costs either money or rigor. The [choosing a C3PAO guide here](/blog/choosing-c3pao) has the full evaluation checklist. ## Step 4: The assessment on the clock The C3PAO assesses the practices in scope: interviews, artifact review, and technical validation on the enclave. The output is a score out of 110 and, for an official assessment, a report entered into eMASS, the government's assessment system of record. DoD sees the result there; your SPRS score updates from it. A clean pass is 110 of 110. The conditional pass under the final rule is 88 points (80 percent) with no practice excluded from POA&M treatment, and the POA&M items must close within 120 days. Miss the conditions and the assessment is not passed at all. The assessor cannot coach remediation during an official assessment; that separation is the point of the role, and it is why the advisory-then-assess sequence usually involves the disciplines being kept cleanly apart even inside one firm. ## Step 5: After the certificate A C3PAO-assessed certification is valid three years. The maintenance obligation is real: changes to the enclave (a new cloud tenant, a new business unit touching CUI, a change in contract scope) change what the certificate covers. Companies that treat the three years as a project close-out get to recertification and discover their boundary no longer matches their reality, and the second assessment becomes a first assessment with a stale SSP. ## Frequently asked questions **What is a C3PAO?** A Certified Third-Party Assessment Organization: a firm authorized by the Cyber AB (the program's accreditation body) to conduct official CMMC assessments. It is the only role that can run the official Level 2 assessment, and its results go into eMASS. **Can I self-assess Level 2?** Some Level 2 contracts accept the annual self-assessment; the contract language decides. A self-assessment still scores against the same 110 practices and posts to SPRS, and DoD can call for a validation assessment later. **What is eMASS?** The government's enterprise assessment system, where official assessment results are entered and DoD reviews them. It is also why assessment-preparation help ("eMASS report preparation") appears in firms' service lists. **How long does preparation take?** For a company starting from a scored SPRS self-assessment and a real enclave, months of remediation is the honest range; for a company starting from nothing, longer. The assessment itself is a matter of days once the evidence exists. **Where do I find the authorized firms?** The Cyber AB's official marketplace is the authoritative roster; the [documented directory here](/firms/cmmc-services) lists the C3PAO roster with each firm's authorization evidence attached, and a [structured RFP](/rfp/cmmc-services) makes their answers comparable. [Browse documented CMMC assessment firms ->](https://vendorquals.com/firms/cmmc-services) --- *The requirements here reflect the CMMC final rule (32 CFR Part 170) and the program's published assessment guidance as last reviewed, closely paraphrased with attribution; the rule carries its own phased rollout in contracts, so verify what your contract language requires before relying on this. The roster facts reflect the C3PAO list published by CMMC Marketplace as read on October 27, 2026. Last verified: October 2026. Have a correction or addition? [Request inclusion or a correction ->]* Source: https://vendorquals.com/blog/cmmc-level-2-assessment. This page is also served as HTML at https://vendorquals.com/blog/cmmc-level-2-assessment. --- - [All articles](https://vendorquals.com/blog)