CMMC Assessment: What the C3PAO Does, Phase by Phase

A CMMC Level 2 certification assessment runs in four phases that the Cyber AB’s CMMC Assessment Process, version 2.0 from December 2024, sets for every C3PAO: a pre-assessment, the assessment itself, reporting, and the certificate with POA&M close-out. On 12 November 2026 the Cyber AB Marketplace lists 121 C3PAOs and 1,213 Certified CMMC Assessors, about 10 for each C3PAO, with 692 Lead CCAs listed on top of them. Only a solicitation that asks for it puts a contractor through one today, because the Department of War suspended Phase II on July 13, 2026 and left self-assessment in force. The C3PAO guide covers how to choose one.

Before phase 1

The C3PAO and the contractor sign an agreement and frame the assessment together. They settle who is available, which evidence exists, which documents are ready, including the System Security Plan, and how long the assessment will take. They also decide where it takes place. The process names 18 requirement objectives, such as media marking, physical access and visitor escort, that the team should consider validating on site rather than virtually.

Phase 1: the pre-assessment

The C3PAO checks that the contractor is ready before the assessment starts.

1. It reviews the System Security Plan and validates the assessment scope.
2. It confirms the evidence is available and decides whether the contractor is ready.
3. It composes the assessment team and completes the Pre-Assessment Form.
4. A quality assurance reviewer checks the planning, and the form goes into eMASS.

If the lead assessor finds the contractor unprepared, it tells the Affirming Official in writing why the assessment is suspended. It gives no advice on how to improve. The process says that offering recommendations for a rescheduled assessment would conflict the C3PAO from resuming that assessment. A contractor that needs that help hires a separate consultant, and the RPO list shows who is registered.

Phase 2: the assessment

The Lead CCA opens with an in-brief meeting. The Affirming Official, the contractor’s point of contact and the assessment team attend. The team then assesses each security requirement against NIST SP 800-171A, scores it, and reviews how external service providers and cloud service providers affect scope. A quality assurance reviewer who is not on the team observes. At the end of each assessment day the team meets the contractor to cover progress and open items.

Each requirement ends as MET, NOT MET or not applicable. A NOT MET result can be re-evaluated during the assessment and for 10 business days after the active assessment ends, if new evidence exists, the change does not weaken another requirement scored MET, and the findings report has not been delivered.

Phase 3: reporting

The team compiles the results in the format eMASS requires. A CCA outside the assessment team reviews them for accuracy and completeness. The Lead CCA convenes the out-brief meeting no sooner than 10 business days after the evaluative work ends, and presents the results to the contractor. The C3PAO uploads the results to eMASS, which sends them on to SPRS, and delivers a CMMC Assessment Findings Report. A contractor that disagrees can use the appeals process the C3PAO administers.

Phase 4: the certificate and the POA&M

An Authorized Certifying Official at the C3PAO signs the Certificate of CMMC Status. The C3PAO uploads it to eMASS, gives a copy to the Affirming Official and the contractor’s point of contact, and sends one to the Cyber AB.

A contractor with a Conditional status then has 180 days to close the POA&M. A Conditional status needs a score of at least 0.8, which is 88 of 110 points, with no POA&M item worth more than 1 point, and six requirements may never sit on a POA&M. The contractor may hire a different C3PAO for the close-out assessment, which re-assesses only the NOT MET requirements. The Level 2 guide covers the scoring in full.

After any assessment the Affirming Official files an affirmation in SPRS, and again every year after a Final status. The contractor keeps the hashed evidence files for six years from the status date.

Who does the work

Role on the Marketplace	Listings, 12 November 2026
C3PAO	121
Certified CMMC Assessor (CCA)	1,213
Lead CCA	692
Certified CMMC Professional (CCP)	2,378
Registered Practitioner (RP)	2,115
Registered Provider Organization (RPO)	399

Each Marketplace listing carries one role, so the 692 Lead CCAs are not part of the 1,213 CCAs. Only a C3PAO can run the assessment, and the Lead CCA oversees the assessment team. A CCP or an RP helps a contractor prepare. The cost guide holds the Department of War’s estimate for what the C3PAO engagement costs.

Cloud services in scope

A contractor that keeps controlled unclassified information in a cloud service can use one that is FedRAMP Authorized at the Moderate baseline, or one that meets equivalent requirements. The assessment also covers the contractor’s on-premises systems that connect to the service.

The FedRAMP path guide explains how a provider reaches that certification, and the impact levels and classes guide explains how the classes relate to the old Low, Moderate and High labels.

Software and advisers

The CMMC software ranking scores the platforms that prepare the System Security Plan and POA&M. Sprinto matches a contractor to an RPO from its partner network, and Secureframe sells a Defense plan for CMMC.

The CMMC hub lists the other guides, and the compliance management software ranking covers platforms that span CMMC and other frameworks.