Most contractors don’t fail a CMMC Level 2 assessment because their technology is wrong. They fail — or stall, or burn months they don’t have — because the evidence isn’t ready. A control can be implemented and still be unprovable on the day. Assessment preparation is the discipline of closing that gap before a C3PAO ever logs in.
This article is the template we want every post on this site to follow: a clear promise up front, short sections an executive can scan, specifics a compliance lead can act on, and one honest call to action at the end. If you are reading it as a contractor rather than a designer, start with the checklist in the middle — it is the order we actually work in.
1. Your SSP is the assessment
Your System Security Plan is not paperwork that accompanies the assessment; in large part, it is the assessment. Assessors test what your SSP says you do. If the SSP describes an environment that no longer exists — old tools, departed staff, a network diagram from two reorganizations ago — every interview that follows starts with a credibility problem.
- Scope first: name exactly which systems, people, and locations handle CUI. Everything else follows from that boundary.
- Control by control: for each of the 110 NIST SP 800-171 controls, state how it is met, by what, and where the evidence lives.
- Keep it alive: an SSP updated at last year’s assessment and untouched since is a finding waiting to happen.
2. Know your SPRS score before a prime asks
Your SPRS score is not an internal metric. Primes look at it, compare it, and — increasingly — select on it. Submitting an inflated score is worse than submitting a low one: it converts a gap you could have explained into an integrity question you can’t.
Submit the honest score, with a POA&M that shows the path. A low score with a credible plan reads as a contractor in motion. A perfect score you can’t evidence reads as a risk.
Score yourself the way an assessor would: a control is only “met” when it is implemented and you can show it. Partial credit is not how this works — and it is exactly why pre-documented controls and evidence packages matter.
The pre-assessment checklist
- Current SSP with a defensible CUI scope and boundary diagram
- Honest SPRS score submitted, with scoring worksheet retained
- POA&M for every unmet control — owner, milestone, and date on each item
- Evidence package indexed by control: screenshots, configs, logs, tickets, training records
- Policies staff can actually describe in an interview — not just PDFs they signed
- Incident response plan tested at least once, with the test documented
3. Work the POA&M in risk order, not list order
A POA&M worked top-to-bottom wastes your scarcest resource: calendar time before the assessment window. Work it by risk and dependency instead. Identity controls — MFA, privileged access, account management — unlock or block a surprising share of everything downstream. Logging and monitoring take time to produce the history assessors want to see, so they should start early even when they feel less urgent.
This is also where an enclave decision pays off. Moving CUI into a GCC High enclave or a FedRAMP-authorized cloud environment shrinks the scope you must bring to full compliance, which shrinks the POA&M with it. Scope reduction is the most underused readiness move we see.
4. Rehearse the interviews
Assessors interview people, not just systems. The engineer who runs backups, the office manager who onboards staff, the executive who owns the incident plan — each will be asked to describe, in their own words, processes your SSP claims exist. Thirty minutes of rehearsal per person, walking through “show me how you’d…” scenarios, prevents the most avoidable findings we encounter: the control that exists but nobody could explain.
What “ready” actually looks like
Ready does not mean perfect. It means: the scope is defensible, the score is honest, every gap has an owner and a date, the evidence is indexed before anyone asks for it, and your people can describe what they do. Contractors who arrive in that state don’t fear the assessment — they use it, because a passed Level 2 assessment is a competitive asset every time a prime builds a team.
And readiness is not a finish line. Continuous monitoring and a living compliance dashboard are what keep the posture you proved on assessment day true on every day after it.