What a CMMC Level 2 Assessor Examines, Asks and Tests: Evidence and Six-Year Retention

The assessment is built on objectives, not on questions

NIST SP 800-171 lists the security requirements for protecting controlled unclassified information, or CUI, on contractor systems. NIST SP 800-171A is its companion. It breaks each requirement into assessment objectives, and for each objective it names the methods and the kinds of things an assessor can look at. NIST describes the procedures as flexible and able to be customized to the needs of the organizations and the assessors using them, and says they can support self-assessments, independent third-party assessments and government-sponsored assessments.

The CMMC rule, 32 CFR part 170, ties the program to it. Section 170.17(c)(1) says an authorized or accredited C3PAO must perform a Level 2 certification assessment in accordance with NIST SP 800-171A and the Level 2 scoping requirements in 170.19, and score it under the methodology in 170.24. A Level 2 self-assessment follows the same objectives under 170.16.

Examine, interview, test

SP 800-171A names three assessment methods. They are meant to be combined, because one method alone rarely proves a control is both designed and working.

• Examine: the assessor reviews specifications, mechanisms and activities as recorded in documents, settings and records. That means your system security plan, policies, procedures, network diagrams, asset inventory, configuration screens, logs, tickets and training records.
• Interview: the assessor talks to the people who run or use the control, such as the IT lead, a system administrator, HR, facilities and ordinary users. The goal is to check that what people say matches the paperwork.
• Test: the assessor watches a control work or tries it. Examples are logging in to see the multifactor prompt, viewing a screen lock time-out, checking that a removable drive is blocked, or confirming that audit logs record an event.

The pattern that fails assessments is a mismatch between the three. The policy says one thing, the person describes another, and the system does a third. A requirement with a policy but no proof, or a setting nobody can explain, tends to end up NOT MET.

Scope decides what gets looked at

The contractor must define the assessment scope before the assessment. Section 170.19(c) sorts assets into categories and sets what the assessor does with each:

• CUI assets (they process, store or transmit CUI): assessed against all Level 2 requirements.
• Security protection assets (they provide security functions to the scope): assessed against the requirements relevant to the capabilities they provide.
• Contractor risk managed assets (they can, but are not meant to, handle CUI): the assessor reviews the system security plan and, if it is sufficiently documented, does not assess them further. If your documentation or other findings raise questions, the assessor can run a limited check that must not materially increase the duration or cost.
• Specialized assets (such as operational technology, IoT devices and government furnished equipment): documented and managed under risk-based policies, with the plan reviewed and no assessment against the other requirements.
• Out-of-scope assets: not assessed, but you must be ready to justify why they cannot handle CUI and do not protect CUI assets.

This is why the asset inventory, the network diagram and the way you describe asset treatment in the plan carry so much weight. They tell the assessor which systems to open and which to leave alone. A sloppy diagram invites more questions.

What counts as evidence

Section 170.24(b) says a requirement is MET when all applicable objectives are satisfied based on evidence, and that all evidence must be in final form and not draft. It lists working papers, drafts and unofficial or unapproved policies as unacceptable forms of evidence. A NOT MET result means at least one objective is not satisfied, and the assessor documents why the evidence does not conform. Two details help: enduring exceptions described in the system security plan, with their mitigations, are assessed as MET, and temporary deficiencies properly handled in operational plans of action, with reviews and progress, are assessed as MET.

Good evidence is specific and dated: a screenshot with the setting and the date, an export of a policy, a log extract showing the event, a signed and approved policy, a training roster, a ticket showing a change was approved and tested. For each requirement, keep a short index that says which artifact answers which objective.

Re-evaluation during the assessment

Section 170.17(c)(2) lets a NOT MET requirement be re-evaluated during the assessment and for 10 business days after the active assessment period, but only if three things hold: additional evidence exists that shows the requirement is met, the change cannot reduce the effectiveness of other requirements already scored MET, and the CMMC Assessment Findings Report has not been delivered. It is a narrow window, not a second attempt.

Hash and keep your artifacts for six years

Section 170.17(c)(4) is about artifact retention and integrity. The hashed artifacts used as evidence for the assessment must be retained by the contractor for six years from the CMMC Status Date. To show they have not been altered, the contractor hashes the artifact files with a NIST-approved hashing algorithm and gives the C3PAO a list of artifact names, the hash values and the algorithm, which the C3PAO uploads to the CMMC instantiation of eMASS, the program's system of record. The assessment results the C3PAO submits include that list.

Practical consequences: decide before the assessment where the evidence folder lives, who owns it, and how it is backed up and protected, since it will hold sensitive configuration details. Hash at the time you assemble the package, record the algorithm, and store the hash list apart from the files.

How to prepare

• Write the scope, the asset inventory and the network diagram first, and make the plan match them.
• For every requirement, list the objectives from SP 800-171A, the artifact for each and the person who can explain it.
• Run your own examine, interview and test pass. Have someone other than the control owner try to find the gaps.
• Make sure policies are approved and dated, not drafts.
• Check that what staff say matches what the system does, and fix whichever is wrong.

We run readiness reviews against SP 800-171A objectives for defense subcontractors and help assemble the evidence set so that it stands up to a certified assessor.

Sources

• NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information (NIST)
• 32 CFR 170.17, Level 2 certification assessment and affirmation (eCFR)
• 32 CFR 170.19, CMMC scoping (eCFR)
• 32 CFR 170.24, CMMC Scoring Methodology (eCFR)
• 32 CFR 170.16, Level 2 self-assessment and affirmation requirements (eCFR)

This article is general information, not legal, contracting or technical advice for your environment. Contract clauses, DoD policy and certification rules are set by the Department of Defense and your contract; check what applies to you with your prime, your contracting officer and counsel. Last reviewed November 9, 2026.

Next article

Next · RegulationPOA&M Rules Under 32 CFR 170.21: The One-Point Rule, 180 Days and What Happens AfterA plan of action and milestones, or POA&M, lets a contractor earn a conditional CMMC status while a few gaps are still open. The rule is narrow. Only some requirements qualify, there is a score floor, and a 180-day clock starts on the status date. This article walks through 32 CFR 170.21 in plain words.8 min read

Related reading

• RegulationK-12 Student Data Security: FERPA, COPPA and CIPA in Plain Words, and How to Vet an Edtech Vendor8 min
• RegulationWriting the Customer Responsibility Matrix Section of a System Security Plan: Shared Responsibility With a Cloud Provider8 min