The CMMC audit: what happens, and what fails it.

A CMMC assessment tests whether each security requirement at your level is implemented on the systems in scope, and whether you can prove it. The assessor works requirement by requirement and reaches one of three findings on each: MET, NOT MET, or NOT APPLICABLE. There is no partial credit on an individual requirement. “We have a policy that says we do” is not MET; a policy plus a configuration that enforces it plus evidence it has been operating is.

Evidence comes in three forms and assessors expect all three: what you show them (configurations, dashboards, records), what you tell them (interviews with the people who actually operate the control), and what they test (observing a control work). A requirement supported only by a document is the standard way to collect a NOT MET.

The scope is whatever handles CUI, plus the infrastructure that protects it. This is where assessments are won or lost commercially: a tight, genuinely segmented enclave is a fraction of the assessment effort of an undifferentiated corporate network, and the decision is made months before the assessor arrives.

A C3PAO — CMMC Third-Party Assessor Organization — is authorized to conduct Level 2 certification assessments and to submit the result into the government’s system. C3PAOs are themselves assessed before they are authorized. They are not consultants: an organization that has prepared you for the assessment cannot also be the one that assesses you, and any provider blurring that line is telling you something useful about how it works.

The capacity picture matters when you plan. Fewer than 100 C3PAOs were authorized across the whole defense industrial base as at early 2026, against tens of thousands of companies that will eventually need certification. Lead times of six to nine months were being quoted before the Phase 2 suspension. If certification returns to the schedule with a firm date, the queue is the constraint — not your readiness.

Questions worth asking a C3PAO before you sign:

• Have you assessed companies our size, in our sector? A machine shop and a software vendor fail in different places.
• What is the lead time, and what does the schedule slip look like?
• What is in the fee, and what is not? Travel, re-assessment after a plan of action closeout, and additional days if scope proves larger than described are the three that surprise people.
• How do you handle a Conditional outcome? The closeout assessment inside 180 days should be priced and scheduled at the outset, not negotiated when the clock is running.
• Who is on the team, and are they certified assessors?

Level 2 scoring starts at 110 and deducts 1, 3 or 5 points per unimplemented requirement, weighted by impact — so the floor is −203, not zero. A score of at least 88 out of 110, which is 80% of the maximum, is the threshold for a Conditional CMMC status. Below that there is no status to grant.

Conditional status is not a soft landing. It comes with a plan of action and milestones covering the remaining requirements and 180 days to close every one of them and be re-assessed. Miss the window and the conditional status expires rather than lapsing quietly into something lesser.

The constraint that catches people is what may go on the plan of action. Broadly, only the 1-point requirements are eligible: the 3- and 5-point requirements — the heavy ones, including multi-factor authentication — have to be implemented at the time of assessment, with a narrow carve-out around FIPS-validated cryptography. The practical consequence is that a plan of action cannot rescue a program that has deferred the expensive work. It exists to absorb the long tail, not the core.

Three costs get conflated, and separating them makes the numbers far less alarming.

The assessment fee is what the C3PAO charges to assess you. Market figures reported through 2026 commonly sit in the tens of thousands of dollars for a Level 2 certification assessment, driven mostly by the number of in-scope assets and locations. It is a competitive market and it is quoted per engagement, not published.

Remediation is what it costs to become compliant — new tooling, an enclave, MFA everywhere, logging, someone’s time. This is usually the largest number by a distance, it varies enormously with your starting point, and it is not a CMMC cost: it is the cost of the 800-171 obligation you already had.

Recurring cost is the three-year cycle plus annual affirmations, plus keeping the controls operating. The Department’s own regulatory impact estimates for a triennial Level 2 certification cycle with its affirmations run to roughly six figures for a medium-sized entity — a figure worth quoting to a board, with the caveat that estimates and market rates are different animals.

The lever that moves all three is scope. Reducing the number of systems that touch CUI reduces assessment days, remediation surface and ongoing operating cost simultaneously. It is the only decision on this page that pays three times.

A Level 2 status lasts three years, affirmed annually. In that window your network changes constantly, and so do the networks of every subcontractor you passed CUI to. The assessment is a photograph; the obligation is continuous, and the annual affirmation is you signing to say the photograph is still a fair likeness.

That is the argument for monitoring rather than remembering. Continuous external assessment shows what your perimeter — and your suppliers’ perimeters — look like today: new exposed services, expiring certificates, infrastructure appearing in unexpected places. It does not replace the assessment. It stops you affirming something that stopped being true in month seven. Attack surface monitoring and supplier risk management are the two halves of that.