The Assessments page tracks your CMMC assessment engagements from planning through completion.
Assessment Types
| Type | Who | When |
|---|
| Self-Assessment | Your organisation | Level 1 (all), Level 2 (non-critical CUI) |
| C3PAO Assessment | Accredited third-party | Level 2 (critical CUI) |
| DIBCAC Assessment | U.S. Government | Level 3 |
| Internal Review | Your organisation | Best practice (any level) |
| Mock Assessment | Consultant | Best practice (Level 2+) |
Assessment Outcomes
| Certified | All practices met; full certification (3 years with annual affirmation) |
| Conditional | Some practices on POA&M; 180-day closeout required |
| Not Certified | Too many gaps; must remediate and reassess |
Preparing for C3PAO Assessment
- Complete your SSP covering all 110 Level 2 practices
- Organise evidence by practice
- Brief your team on assessment procedures
- Run an internal review first
- Review your POA&Ms for eligible practices only
