CMMC 2.0 Phase 1 enforcement is live as of November 10, 2025. Under Phase 2, beginning November 10, 2026, most defense contractors handling Controlled Unclassified Information will require third-party certification by a Certified Third-Party Assessment Organization — a C3PAO. The gap between “we know we need to be ready” and “we actually are ready” for most DIB clients is significant, and the preparation timeline is measured in months, not weeks.
As the MSP managing these clients’ IT environments, you are in the best position to drive that preparation — and to structure it as a billable, ongoing engagement rather than a reactive scramble. This article is a step-by-step guide for MSPs: how to scope the work, map the gaps, prioritize remediation, generate evidence, and communicate progress to the client in a way that is credible and specific rather than reassuring but vague.
This is not a repeat of the conceptual overview. It is the tactical sequence: what you do, in what order, and why each step matters for the assessment outcome.
Step 1 — Define the Scope Before Anything Else
The most expensive mistake in CMMC preparation is starting the technical work before the scope is defined. Scope determines which systems, networks, personnel, and data flows fall inside the CMMC assessment boundary — and everything outside that boundary does not need to be assessed. Preparing the wrong systems wastes time, inflates cost, and produces an evidence package that does not align with what the C3PAO will actually evaluate.
Scoping a CMMC Level 2 assessment starts with identifying where CUI lives. The client needs to know which systems create, process, store, or transmit Controlled Unclassified Information — and that means getting specific: which servers, which workstations, which cloud services, which personnel roles. A client who answers “everywhere” has not done the scoping work. CUI scope should be defined, documented, and connected to the specific contracts that require it.
The scope document needs to describe the assessment boundary clearly enough that the C3PAO assessor can determine what to test without asking you to explain it during the assessment. That document — sometimes called an Asset Inventory and Network Diagram, sometimes incorporated into the System Security Plan — is the first deliverable of the preparation engagement. Everything else builds on it.
Key scoping questions to work through with the client:
- Which contracts require CMMC Level 2 certification? Are there subcontract flowdown clauses?
- Which systems handle CUI? Can any of those systems be isolated from systems that do not?
- Which personnel roles have access to CUI? Are those roles clearly defined and documented?
- Which cloud services are in scope? What is the cloud service provider’s FedRAMP authorization status?
- Does any CUI leave the primary environment — through remote access, portable media, or third-party vendor access?
A tighter scope is almost always better than a broader one — as long as it accurately reflects where CUI exists. The goal is not to hide anything from the assessor. It is to ensure you are not doing remediation work on systems that have nothing to do with CUI handling.
Step 2 — Run the Gap Assessment Against All 110 Practices
Once scope is defined, the gap assessment maps the client’s current control state against all 110 security requirements in NIST SP 800-171 Revision 2, which is the technical baseline for CMMC Level 2. This is not a questionnaire that the client fills out about themselves. It is a technical assessment that produces evidence-backed answers to whether each practice is implemented, partially implemented, or not implemented.
The 110 practices span 14 domains: Access Control, Awareness and Training, Audit and Accountability, Configuration Management, Identification and Authentication, Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, Security Assessment, System and Communications Protection, and System and Information Integrity. Each domain has a different weight in terms of the risk profile a gap creates, and assessors will not spend equal time on all domains.
For each practice, the gap assessment should produce three things: the current implementation status, the specific evidence that exists to support that status, and — if the practice is not fully implemented — the gap that needs to be closed. “Partially implemented” is not a safe resting state for most Level 2 practices. Assessors look for evidence that a control is operating as intended, not just that a policy exists that says it should.
The output of the gap assessment is the foundation of both the System Security Plan and the Plan of Action and Milestones. You cannot write either document credibly without the gap assessment data. MSPs who skip the technical gap assessment and go straight to documentation are producing paper that will not survive an assessor’s scrutiny.
Platform-level mapping — where vulnerability scan findings and configuration data are automatically aligned to specific CMMC practices at the control level — dramatically reduces the labor required to run a credible gap assessment at scale. Manual mapping across 110 practices for each client is feasible for one engagement. It is not a repeatable business model. Practice-level alignment built into your tooling is what makes the gap assessment a structured, consistent service rather than a bespoke project each time.
→ See how Sentinel’s CMMC alignment works at the practice level — specific control mapping, not just framework presence — and how that changes what the gap assessment output looks like for an assessor.
Step 3 — Build the System Security Plan and POA&M
The System Security Plan is the central document in a CMMC Level 2 assessment. It describes the client’s information system, the security requirements applicable to it, and how each requirement is met. The C3PAO assessor will review the SSP before the formal assessment begins — it sets their expectations and tells them where to look for evidence. An incomplete or inconsistent SSP signals that the client is not prepared, before the technical testing even starts.
An SSP for CMMC Level 2 needs to include a system description and boundary diagram, a description of how each of the 110 practices is implemented (or planned to be implemented), identification of any inherited controls from cloud service providers or other external entities, and a reference to the Plan of Action and Milestones for any practices not yet fully implemented.
The Plan of Action and Milestones documents every gap identified in the gap assessment — what the current state is, what the target state is, who is responsible for closing the gap, and by what date. The POA&M is not a weakness; it is evidence of a mature, managed approach to risk. An assessor reviewing a POA&M with specific dates, responsible parties, and milestone tracking is seeing a client who understands their gaps and is actively addressing them. An assessor who finds undocumented gaps during the assessment that were not in the POA&M is seeing a client who either did not know about them or was not transparent — either of which creates a more difficult assessment outcome.
Practically: the SSP and POA&M should be living documents, updated as remediation progresses. Do not write them once and file them. The CMMC certification process requires continuous compliance attestation — the documents need to reflect the current state of the environment at the time of assessment, not the state six months earlier when you first wrote them.
Step 4 — Prioritize Remediation by Assessment Risk, Not CVSS Score
Not all gaps carry the same weight in a CMMC Level 2 assessment. Prioritizing remediation by CVSS severity score — the default output of most vulnerability scanners — will send your clients in the wrong direction. A medium-CVSS misconfiguration in Access Control that allows unauthorized lateral movement is a more serious assessment risk than a high-CVSS vulnerability in a system outside the CUI boundary. The assessment risk of a gap depends on which practice it implicates, how central that practice is to the domains assessors scrutinize most closely, and whether a similar gap has been exploited in recent defense contractor incidents.
The domains that consistently receive the closest scrutiny in Level 2 assessments are Access Control, Identification and Authentication, Audit and Accountability, and Configuration Management. These four domains account for a disproportionate share of both common gaps and assessment findings. If your client has unresolved gaps in any of these domains, those should be at the front of the remediation queue regardless of their CVSS severity rating.
Within those high-priority domains, the specific practices that assessors focus on most heavily include multi-factor authentication requirements (IA domain), least-privilege access controls (AC domain), audit logging with sufficient detail to reconstruct events (AU domain), and baseline configuration management with documented deviations (CM domain). A client who has robust implementations of these practices — with evidence — is in a substantially stronger position than one who has patched every high-CVSS vulnerability but left MFA and audit logging gaps in place.
The remediation priority framework your team uses should sequence work in three tiers: practices that are not implemented at all in high-scrutiny domains come first; practices that are partially implemented with evidence gaps in high-scrutiny domains come second; and practices with lower assessor scrutiny or outside the CUI boundary come third. This sequencing is not about cutting corners on lower-priority items — it is about ensuring the most assessor-visible gaps are closed before the assessment date.
Step 5 — Build and Maintain the Evidence Package
CMMC Level 2 assessors are not evaluating what your client says they do. They are evaluating what the evidence shows they do. For each practice, the evidence needs to demonstrate that the control is implemented, that it is configured correctly, and that it is operating consistently over time — not just at the moment of the assessment.
For most Level 2 practices, the evidence consists of two categories: technical evidence and procedural evidence. Technical evidence includes configuration records, scan results, access control logs, audit logs, patch management history, and system-generated artifacts that demonstrate a control is operating as configured. Procedural evidence includes policies, procedures, training records, and workflow documentation that demonstrate the organization has defined how a control is implemented and that personnel follow those definitions.
Both categories are required for most practices. A policy that says MFA is required for remote access does not satisfy the IA.L2-3.5.3 practice if there are no technical artifacts showing that MFA is actually enforced. Conversely, a technical configuration showing MFA is enforced does not satisfy the practice if the remote access policy has not been updated to reflect the requirement. Assessors look for both, and missing either creates a finding.
The practical implication for MSPs is that evidence collection needs to be ongoing, not pre-assessment. Scan reports all dated within the month before the assessment, log exports pulled specifically because the assessor is coming, and policies written the week before the review — these patterns are visible to assessors and undermine the credibility of the evidence even when the controls themselves are in place. The evidence needs to show a continuous, consistent practice, which means your monitoring cadence and documentation workflow need to run year-round.
Step 6 — Prepare and Submit the SPRS Score
The Supplier Performance Risk System is the DoD’s portal for tracking contractor cybersecurity compliance status. Under Phase 1 of CMMC, Level 2 contractors who are permitted to self-assess must calculate a score based on their NIST 800-171 compliance and submit it to SPRS, along with an annual executive affirmation signed by a senior company official.
The SPRS score is calculated by starting at 110 points and subtracting weighted penalties for each unimplemented or partially implemented practice. A fully compliant organization scores 110. An organization with significant gaps may score zero, negative, or — if gaps are severe enough — deeply negative. Whatever the score is, it must be submitted accurately. Contracting officers check SPRS scores before awarding contracts. A missing submission disqualifies a contractor from bidding on covered solicitations. A score submitted that does not reflect actual implementation is a potential False Claims Act violation.
For clients who will require C3PAO certification under Phase 2 rather than self-assessment, the SPRS submission remains relevant — it reflects the current posture while certification is being pursued. Help your client calculate an accurate score based on the gap assessment results and ensure it is submitted and kept current. A stale or missing SPRS entry creates risk in the period between now and the formal certification.
What MSPs Should Have Ready Before the Assessor Conversation
When your client schedules their C3PAO assessment, the preparation enters a different phase. The assessor will request documentation before the assessment begins — typically two to four weeks in advance — and will use that documentation to set their testing plan. What you have ready at that moment determines how the assessment unfolds.
A current, complete System Security Plan. This is the document the assessor reads first. It should describe every in-scope system, every applicable practice, and how each is implemented. It should be accurate as of the assessment date — not the date you last updated it. If there have been infrastructure changes since the SSP was written, update it before submission.
A clean, current POA&M. Every open gap should be in the POA&M with a realistic closure date and a responsible party. Gaps that are in the POA&M with active milestones are assessed differently than gaps the assessor discovers independently. The POA&M does not hide weaknesses — it demonstrates managed awareness of them, which is a different assessment outcome than undisclosed gaps.
A documented asset inventory and network diagram. The assessor needs to understand the boundary before testing can begin. The network diagram should show all in-scope systems, their connections to each other and to external networks, and any boundary protection controls. The asset inventory should match the diagram. Inconsistencies between the two raise questions that take time to resolve and create distrust of the documentation generally.
Organized evidence files mapped to practices. Do not hand the assessor a pile of scan reports and log exports and ask them to find the evidence for each practice. Organize the evidence package so that for any given practice, you can immediately produce the relevant technical and procedural evidence. A folder structure organized by domain and practice number, with a coverage index that shows which evidence satisfies which practice, saves time during the assessment and demonstrates preparation maturity.
A current SPRS submission that matches the SSP. If the SPRS score was calculated based on a different gap assessment than the SSP reflects, the discrepancy will surface. Ensure the SPRS submission, the SSP, and the POA&M are all internally consistent before the assessor conversation begins.
A designated technical point of contact for the assessment. The assessor will have questions — specific, technical questions about configurations, access control implementations, and audit log settings. The person answering those questions needs to know the environment well enough to answer them accurately and in detail. Brief that person on the SSP, the gap assessment findings, and the remediation history before the assessment begins. An assessor who encounters uncertainty or inconsistency in technical answers spends more time testing, not less.
Pre-Assessment Readiness Checklist
Use this as a structured reference in the weeks before the assessment date. Every item should have a clear owner and a confirmed completion date before the assessor conversation is scheduled.
Scoping and documentation
- CUI inventory complete — all systems, personnel roles, and data flows documented
- Assessment boundary defined and approved by client leadership
- Network diagram current and consistent with asset inventory
- System Security Plan updated to reflect current environment and controls
- POA&M current with accurate status, milestone dates, and responsible parties for all open items
- SPRS score calculated, submitted, and consistent with SSP
- Annual executive affirmation completed and on file
Evidence collection
- Vulnerability scan history available for in-scope systems (minimum 6 months preferred)
- Patch management records demonstrating remediation cadence
- Access control audit logs with sufficient retention and detail
- MFA implementation evidence for all in-scope remote and privileged access
- Configuration baseline documentation with deviation records
- Incident response log and test documentation
- Security awareness training completion records for all personnel with CUI access
- Media protection records (sanitization logs, transfer authorizations)
- Physical access control logs for systems in scope
- Evidence organized by domain and practice with coverage index
Gap and remediation status
- All high-scrutiny domain gaps (AC, IA, AU, CM) either closed or documented in POA&M with milestones
- No undisclosed gaps — everything discovered in gap assessment is in the SSP or POA&M
- Remediation tickets closed in PSA with documented evidence of completion
- Any conditional POA&M items have realistic 180-day closure timelines (required for conditional certification)
Assessment preparation
- Technical point of contact briefed on SSP, gap findings, and remediation history
- Evidence package organized and accessible — not buried in raw scan exports
- Pre-assessment readiness review completed 90 days before assessment date
- Documentation pre-submission package prepared for C3PAO two to four weeks before assessment
Client Communication Throughout the Process
One of the places MSPs lose credibility in CMMC preparation engagements is in client communication. The technical work is solid; the client updates are vague. “We’re making good progress” and “things are on track” are not meaningful answers for a client whose contract eligibility depends on passing a C3PAO assessment by a specific date. Specific, structured progress communication is part of the service.
A monthly status update should include: the current SPRS score, the count of practices by status (implemented, partially implemented, not implemented), the practices closed during the month, the practices targeted for the next month, and any blockers — client decisions, third-party dependencies, or resource constraints — that are affecting the timeline. That is a communication that a client can share with their legal counsel, their prime contractor, or their own leadership. It demonstrates managed progress, not reassuring vagueness.
The other communication moment that requires care is when gaps are discovered that the client did not expect. The instinct is to soften the message — to frame a significant gap as “something we are working through” rather than as the concrete assessment risk it represents. The better approach is to be specific about what the gap is, which CMMC practice it implicates, what an assessor would likely do with it if it were unresolved at assessment time, and what remediation looks like. Clients who receive specific information make better decisions about prioritization and timing than clients who receive reassurance.
If you want to see how the Sentinel platform’s practice-level CMMC mapping, continuous scanning, and evidence generation support the preparation workflow described here — and how to structure this as a repeatable engagement for your DIB client base — book a 30-minute demo.
Frequently Asked Questions
How far in advance of the assessment should preparation begin?
For a client starting from a significant gap — which describes most DIB contractors — six to twelve months is the realistic preparation window for Level 2 C3PAO readiness. That time covers the scoping work, the technical gap assessment, SSP and POA&M development, remediation implementation, evidence collection, and a pre-assessment readiness review. Clients who begin preparation three months before the Phase 2 mandatory date in November 2026 are not on a comfortable timeline. The readiness review should happen approximately 90 days before the scheduled assessment, which means the preparation work needs to be substantially complete at that point.
What happens if gaps remain at assessment time?
Gaps at assessment time do not automatically result in a failed certification. The assessor determines whether the gap can be addressed through a conditional certification with a Plan of Action and Milestones. If the gap is documented in the POA&M with a realistic closure milestone — generally within 180 days of certification — the assessor may allow a conditional certification. However, the POA&M item must be closed within that window or the certification expires. Gaps that are not in the POA&M and are discovered by the assessor are treated differently — they reflect an incomplete assessment process rather than managed risk, and the assessment outcome is more difficult to predict.
Does the MSP need to be present during the C3PAO assessment?
The MSP is typically not a formal party to the assessment — the assessment is between the C3PAO and the contractor. However, as the party managing the client’s technical environment, your team will almost certainly be involved in answering technical questions, producing evidence, and demonstrating configurations during the assessment. Brief your technical contact on the SSP and evidence package before the assessment begins, and ensure your team is available to support the client’s designated point of contact when the assessor requests system access or technical demonstrations.
How does cloud infrastructure affect CMMC scoping and assessment?
Cloud services in the assessment boundary introduce additional scoping questions that need to be resolved before the SSP is written. Cloud Service Providers used to store, process, or transmit CUI need to be either FedRAMP Authorized at the Moderate baseline or meet equivalent security requirements. If the client is using a cloud service that does not meet these requirements for CUI handling, that is a scoping and remediation issue, not just a documentation issue. The assessor will verify cloud service authorization status as part of the assessment. Resolving cloud scope questions early — ideally in the initial scoping phase — prevents late-stage surprises that affect the assessment timeline.
What is the difference between a self-assessment and a C3PAO assessment for Level 2?
Under Phase 1 (in effect since November 2025), many Level 2 contracts allow self-assessment — the contractor evaluates themselves against the 110 practices, calculates an SPRS score, and has a senior official attest to the accuracy of that assessment. The DoD retains discretion to require C3PAO certification for specific high-priority programs even during Phase 1. Under Phase 2 (beginning November 10, 2026), most contracts involving CUI require third-party certification by a C3PAO rather than self-assessment. The evidence standard, documentation requirements, and consequences of inaccurate attestation are the same in both cases — the difference is whether a third-party organization is independently verifying the assessment. For a contractor who has never had their environment externally assessed, the C3PAO will almost always surface gaps that the self-assessment did not.
Can my client start the assessment process and remediate during the observation period?
Not in the way that sometimes gets suggested. The C3PAO assessment evaluates the environment as it exists at the time of the assessment, not as it is planned to exist after remediation. Remediation items that are documented in the POA&M before the assessment can be handled through conditional certification, but remediation that begins after the assessor arrives does not affect the assessment outcome. The preparation work — scoping, gap assessment, remediation, evidence generation — needs to be substantially complete before the C3PAO engagement begins. This is why the preparation timeline matters: the assessment is not the beginning of a compliance journey, it is the validation of one.