Skip to content

CMMC assessment workflow

The CMMC module (Compliance Programs → CMMC 2.0) keeps the record behind a NIST SP 800-171 self-assessment, an SPRS submission, and a CMMC Level 2 certification assessment. This guide covers what an assessor looks at:

  • the assessment objectives
  • your assessment scope
  • whether you are ready to schedule a C3PAO
  • your SPRS history

The module works without a scanner. Scan results are proposals that a person with the compliance-management permission accepts. Nothing is recorded on your behalf.

Assessment objectives

A C3PAO scores the 320 NIST SP 800-171A determination statements, not the 110 requirements. On each requirement's page, Assessment Objectives lists its statements, and you record Met, Not Met or N/A for each one.

When a compliance scan has evaluated a statement, its verdict is shown on that statement, with the check that produced it, the evidence and the scan date.

  • Accepting a scan verdict on a requirement records the scanner's verdict on each statement it evaluated, with that evidence. The statements it did not evaluate are filled from your answer for the requirement and marked seeded. Seeded statements still need individual attestation before an assessment.
  • Partial requirements, which the scanner could only partly decide, still let you accept the statements it did decide. Accept met / N/A takes passes in bulk. A Not Met statement is accepted one at a time.
  • A newer scan that disagrees with a verdict you accepted from an earlier scan marks it out of date, and offers to re-accept. A pass whose scan evidence has expired reads as stale, and no longer counts toward the requirement being met.
  • A scan never overwrites your attestation. If the scanner disagrees with a statement you answered yourself, the statement is flagged so you can review it.

How the SPRS score is calculated

The score follows the DoD Assessment Methodology: 110, minus the weight of every requirement that is not implemented or not applicable. Once you have answered any statement of a requirement, the statements decide it:

  • one statement Not Met fails the requirement;
  • an unanswered statement keeps it from counting as implemented.

This can lower your score below what the requirement-level answers alone would give. When it does, the SPRS Score page lists each affected requirement and the points it costs.

POA&M items

A Not Met statement offers Open POA&M, which files a POA&M item against that statement. The button is disabled for requirements that may not be on a Level 2 POA&M. The POA&M page exports the register as CSV.

Scoping

Scoping records your assessment scope.

  • Asset categories. Give every asset one of the five CMMC categories (32 CFR 170.19(c)): CUI Asset, Security Protection Asset, Contractor Risk Managed Asset, Specialized Asset, or Out of Scope. Out of Scope requires a justification. Assets the scanner found are listed for you, and you can add others by hand.
  • CUI flow map. Where CUI enters, is stored, is processed and is transmitted. Propose flows suggests entries from your CUI Assets and from SSP interconnections that carry CUI. Review them, then Confirm map. Any later edit clears the confirmation.
  • Boundary statement. Which systems are inside the assessment boundary, and why. It is printed in the SSP and on the SPRS scorecard.

Every scoping change is kept in Scope History: who changed what, when, and the reason given.

How scoping affects scan results

Only CUI Assets and Security Protection Assets are assessed against the requirements. Compliance-scan verdicts from a target you categorise as Contractor Risk Managed, Specialized or Out of Scope are still kept, but are left out of your CMMC results, so a scan of a system outside the boundary cannot fail a requirement for the enclave being assessed. The Overview names any targets left out. Uncategorized targets still count. The Create Scan form warns you before a CMMC scan of a target that is not assessed.

Scoping works per scan target: a subscription, a Microsoft 365 tenant, an AWS account or a GCP project. To scope an enclave, give it its own subscription or tenant.

C3PAO readiness

Audit Prep shows one computed answer to "ready to schedule a C3PAO assessment?", plus a checklist of what is blocking it. A summary appears on the Overview. All of these must hold:

  1. Every determination statement is attested as Met, as N/A with a written justification, or as Not Met with an open POA&M item covering it.
  2. No pass rests on expired scan evidence.
  3. Organization-defined parameters are set. This does not apply to Rev 2, which CMMC 2.0 assesses.
  4. An SPRS submission is recorded, matches today's score, and is less than a year old.
  5. Open POA&M items meet 32 CFR 170.21:
    • a score of at least 88;
    • none of the requirements that may not be on a POA&M;
    • nothing worth more than 1 point, except 3.13.11;
    • every item due within 180 days.
  6. Scoping is complete: every asset categorized, at least one CUI Asset, the flow map confirmed, and a boundary statement.

Each failing item links to the requirement, POA&M item or scoping section that needs attention. When the scanner cannot be reached, a condition that depends on it shows could not be checked, never met.

SPRS history and submissions

The SPRS Score page keeps your score history and draws a trend line against the 88-point threshold. The history records three kinds of entry:

  • a daily point whenever the score changes;
  • Save score, a checkpoint you record deliberately;
  • Record SPRS submission, the score and date you entered in the DoD SPRS portal. The readiness gate checks this one.

Download scorecard (PDF) gives you a printable scorecard with the fields the SPRS portal asks for, deductions by domain, and every open requirement.

What the platform does not do

  • It does not submit to SPRS, and it does not attest for you. A company officer affirms the score.
  • It does not replace a C3PAO's judgement. The readiness gate tells you what an assessor will check, not what they will conclude.