CMMC 2.0: preparing evidence and surviving the audit or assessment

To survive a CMMC 2.0 assessment, build an evidence binder before the assessor arrives: every requirement tied to a documented practice, an owner, and a dated artifact that proves it runs. Scope tightly, rehearse interviews, and fix gaps early, because assessors check what you do, not what you wrote.

What does an assessor look at?

CMMC Level 2 is built on NIST SP 800-171, which organizes requirements into 17 families, from Access Control to Supply Chain Risk Management. NIST's own assessment companion is SP 800-171A. The usual method is to examine documents, interview staff, and test or observe the technology. Your evidence should serve all three.

The CMMC program rule is 32 CFR Part 170. Our fetch of the eCFR text was blocked, so POA&M details here come from secondary summaries and need checking against the rule: reportedly a conditional status needs a minimum score of 80 percent of the maximum, only low value items may be deferred, and open items must be closed within 180 days.

How should you structure the binder?

One folder or workspace per family, and in each, one record per requirement:

• the requirement ID and a plain language summary
• the policy or procedure paragraph that covers it
• the system or scope where it applies
• the owner
• the artifact: a configuration export, a log, a ticket, a signed review
• the capture date and the next refresh date
• your own status: met, partly met, not met

If you cannot fill a row, that row is your gap.

What counts as good evidence?

Artifacts that show the control working on real systems. A written access control policy plus a quarterly review with names, dates and removals beats a policy alone. A firewall rule export beats a statement that traffic is restricted. A log of reviewed alerts beats a claim of monitoring.

How do you keep scope small?

Identify where controlled unclassified information (CUI) is stored, processed or transmitted, and which systems protect those. Draw a boundary and explain it in a one page narrative. A separate enclave for CUI often costs less than hardening the whole company, but it needs clean data flow control.

How do you prepare people?

Assessors interview administrators and ordinary users. Make sure the person who runs backups can explain them and show where the proof is. Run a mock assessment: a colleague, or an outside reviewer, reads requirements aloud and asks for the artifact. Time how long it takes to find each one.

Mistakes to avoid

• Marking a requirement met because the tool supports it, not because it is configured.
• Evidence that predates a major system change.
• A narrative scope that disagrees with the network diagram.
• A shared responsibility gap with your cloud provider or managed service provider that nobody documented.
• Cramming the binder together in the last week.

What to do

1. Confirm your target level from your contract and the type of data you handle.
2. Document the CUI boundary and data flows.
3. Build one record per requirement with owner, artifact and refresh date.
4. Self score honestly and list every gap with a fix date.
5. Run a mock assessment and time the evidence retrieval.
6. Document shared responsibilities with every provider in scope.
7. Freeze a dated copy of the binder before the assessment and keep working on gaps in a separate copy.

Quick check

How Safeguard helps automate this

Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits. That removes most of the binder-building from the last weeks.

Technical requirements around vulnerability and flaw management are backed by evidence from your real code and dependencies through scans, SBOMs and reachability, not just policies. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and at what approval level. The assessment is done by an authorized independent assessor where the contract requires one. Safeguard helps prepare and keep evidence ready.

Want to see it on your own stack? Book a call.

Sources

• NIST SP 800-171 Rev. 3, Protecting CUI in Nonfederal Systems
• 32 CFR Part 170 (CMMC Program), check the current text on eCFR
• Search summary of CMMC Level 2 POA&M rules (secondary, verify against the rule)

Last reviewed: 18 October 2026.