A CMMC Level 2 assessor tests each security requirement in NIST SP 800-171 against your system security plan and the artifacts that prove it, scored objective by objective. Expect to show the plan, scope documents, policies, configuration evidence, logs and records that people follow the process. A plan alone does not pass.
This post explains how the assessment works under the program rule, 32 CFR Part 170, and what to collect. It describes the framework. It is not legal advice and it does not say any vendor can certify you. Dates for phase-in have shifted in secondary reporting, so confirm the current schedule on the DoD CIO CMMC page before you plan around any date.
What are the levels, in plain terms?
The rule defines three. Level 1 uses the requirements in FAR 48 CFR 52.204-21. Level 2 requirements are "identical to the requirements in NIST SP 800-171 R2." Level 3 selects requirements from NIST SP 800-172. Which level you need comes from your contract and the kind of information you handle, not from your preference.
For a Level 2 certification, an authorized or accredited C3PAO performs the assessment "in accordance with NIST SP 800-171A." That document breaks each requirement into assessment objectives. So the unit of proof is the objective, not the headline requirement.
What will the assessor actually look at?
The rule says the assessment covers the security requirements for the information systems in scope, with scoping set by section 170.19. Practical evidence falls into four kinds, using the usual assessment methods of examine, interview and test:
- Documents. System security plan, network diagrams, data flow diagrams, policies, procedures, asset inventory.
- Configuration. Screenshots or exports showing settings that implement a control, such as access rules or log retention.
- Records. Training logs, access reviews, incident response tests, change tickets, vulnerability scan results and the remediation that followed.
- People. Staff who can describe, without a script, how they do the work the policy describes.
The SSP matters more than teams expect. The rule requires the submission to include the name, date and version of the SSP. If you use a cloud or managed service provider, the plan must document that relationship, and requirements covered by the provider's customer responsibility matrix must be documented in or referenced by the SSP.
What can a POA&M cover?
Less than many teams hope. Section 170.21 says a plan of action and milestones is allowed only for select requirements that are not met, and for Level 2 none included may carry a point value greater than 1, with one narrow exception for encryption that is used but not FIPS validated. Some Level 2 requirements can never go on a POA&M, including AC.L2-3.1.20, CA.L2-3.12.4 and PE.L2-3.10.3.
The score must also reach a threshold: the assessment score divided by the total number of Level 2 requirements must be at least 0.8. Open items have to be closed and confirmed by a closeout assessment within 180 days of the conditional status date, or the conditional status expires.
What happens after you pass?
Affirmation. The rule requires affirmation at the time of the assessment and then annually. Assessment results are entered into eMASS, and hashed evidence artifacts are retained for six years from the status date. Treat evidence retention as a design requirement for how you store proof.
Where does software supply chain evidence fit?
NIST SP 800-171 covers areas such as risk assessment, system integrity and configuration management, so a vulnerability scan history, a dependency inventory and records of fixes are natural artifacts. Keep the scan output, the ticket that tracked the fix and the date it closed together. An assessor wants the chain from finding to resolution.
What to do
- Confirm the level your contract requires and the exact assessment scope.
- Write or update the system security plan, with a version and date.
- For each requirement, list the objectives and the artifact that satisfies each one.
- Store evidence with dates in a place you can export, and plan for six year retention.
- Run a mock assessment using the NIST 800-171A objectives and note gaps.
- Check the POA&M rules before assuming a gap can be deferred.
- Assign an owner for the annual affirmation.
Quick check
Is a written policy enough evidence for a requirement?
No. Assessors examine documents, interview people and test configuration. A policy with no records of it being followed leaves objectives unmet.
Can I put any gap on a POA&M?
No. Section 170.21 limits which requirements are eligible and sets a minimum score of 0.8 and a 180 day closeout window.
Sources
- 32 CFR 170.21, POA&M requirements (Cornell LII)
- 32 CFR 170.14, CMMC level requirements (Cornell LII)
- 32 CFR 170.17, Level 2 certification assessment (Cornell LII)
Last reviewed: 18 October 2026.
