Passing a CMMC Assessment Comes Down to Evidence, Not Controls
A CMMC assessment checks whether a defense contractor can prove, with records, that it protects Controlled Unclassified Information the way NIST SP 800-171 requires. Most contractors can put the technical controls in place. Where they fall short is evidence: logs, policies and approvals that show the controls worked all along. Infrastructure that produces that evidence by default is the fastest way to be ready.
Update: this note was written in April 2026, when third-party assessments were due to become a standard contract requirement on November 10, 2026. In July 2026 the Defense Department suspended that phase. The timeline below shows what changed and what did not.
The CMMC assessment timeline, then and now
The program came in through two rules. The program rule, published in the Federal Register in October 2024, took effect on December 16, 2024. The contract rule was published in September 2025 and took effect on November 10, 2025. Under 32 CFR 170.3, Phase 2 begins one calendar year after Phase 1, and in Phase 2 the department intended to make a Level 2 certification by an accredited third-party assessor a condition of award for contracts that involve CUI.
- Program rule takes effect. 32 CFR part 170 sets out the levels, the assessments and the four-phase rollout.
- Phase 1 begins. The contract rule takes effect, and the department begins including Level 1 and Level 2 self-assessment requirements as a condition of award.
- Phase 2 suspended. A Defense Department CIO memorandum of this date suspended the November 2026 Phase 2 transition, as the later class deviation records. Nextgov/FCW reported the same day that the phase "was to begin on Nov. 10 and requires third-party certifications," that Phase 1 self-assessments stay in place, and that the department opened a 60-day study of the program.
- Class deviation. The acquisition policy office's class deviation limits new requirements to CMMC Level 1 and Level 2 self-assessments and tells contracting officers to remove the suspended requirements from existing contracts at the next option period or administrative modification.
- Reform options reported. Federal News Network reported that the task force's options include restarting Phase 2 with a narrower population within 90 days. The summary it quoted describes them as options that still need approval.
- The original Phase 2 date. Third-party certification does not become a default contract requirement on this date. As of November 4, 2026, the September deviation was still the version in force on the acquisition policy office's deviation list.
The security requirements in CMMC Level 2 are identical to those in NIST SP 800-171 Revision 2. Breaking Defense summed up the standard as 110 cybersecurity requirements. Federal News Network reported the July suspension the same day as Nextgov/FCW.
The CMMC assessment is paused, not repealed
A pause is not a repeal, and a CMMC assessment is still available. The September deviation still requires baseline compliance with NIST SP 800-171 Revision 2 under DFARS 252.204-7012, and self-assessment scores are still submitted. Certification has not stopped either: Federal News Network reported in September 2026 that the program continues to operate and that the number of companies with Level 2 certification continues to grow. Check the department's current guidance before you plan a CMMC assessment around any date.
You will not fail on controls. You will fail on proof
A CMMC assessment does not ask "do you have multi-factor authentication?" It asks you to show that it has been enforced continuously: the logs, the policy, the exception process, and who approved each exception and when. Multiply that by every requirement and the documentation work can outweigh the technical work.
The gap between what companies believe and what they can prove in a CMMC assessment is where the risk sits. Common causes:
- Incomplete or outdated documentation, such as a system security plan that no longer matches the network.
- Misunderstood boundaries: CUI stored or sent somewhere nobody listed.
- Self-assessment scores that were never updated after things changed.
How a CMMC assessment is scored
The scoring rule in 32 CFR 170.24 starts you at the maximum, which equals the number of Level 2 requirements, and subtracts the value of each requirement that is not met. The heaviest requirements, the ones that could lead to significant exploitation of the network or loss of CUI, cost five points each. A contractor can end up with a negative score, which is why the range runs from -203 to 110. Evidence decides whether a requirement counts as met, so a missing log can cost as much as a missing control.
Scores you cannot back up carry legal risk
The Justice Department has used the False Claims Act against contractors whose security claims did not hold up.
In the first case, the Justice Department announced in March 2025 that the contractor had reported a score of 104, near the top of the possible range, when an outside consultant later put its score at -142. The whistleblower was the company's own head of security and received an $851,000 share. In the second, announced in December 2025, the failure was to protect drawings of parts the company supplied to defense prime contractors, and the whistleblower was a former quality-control manager. That company was a supplier, not a prime. Enforcement reaches down the supply chain whether or not a third-party CMMC assessment is mandatory.
Conditional status is a shorter clock, not a reprieve
CMMC allows a conditional Level 2 status for companies that come close in a CMMC assessment. Under 32 CFR 170.21, the assessment score divided by the number of Level 2 requirements must be at least 0.8, certain requirements can never be deferred, and open items must be confirmed closed within 180 days or the conditional status expires. For a third-party certification, the closeout assessment is also performed by an accredited assessor, so a second CMMC assessment has to be booked too.
Before you book: run a full mock CMMC assessment against your own evidence first. Every requirement you find unmet before the assessor arrives is one you fix on your own schedule instead of inside a 180-day window.
Revision 3 is already published
Every CMMC assessment today measures against Revision 2, which the September 2026 class deviation still names as the baseline, but the standard behind it has moved on. NIST published SP 800-171 Revision 3 in May 2024, and finalizing the move to it is one of the task force options Federal News Network described in October 2026. Companies that build only to the minimum of one revision may face a second project when the baseline moves. Building to the underlying controls, with evidence, turns the next change into mapping and paperwork instead of re-architecture. Our note on the newer 800-172 controls covers the higher tier.
Build for the CMMC assessment from the start
The difference between a year-long compliance project and a migration is whether your infrastructure was built with NIST SP 800-171 in mind from the start. When configuration baselines are enforced by automation, they do not drift, and the logs exist because the systems produce them as part of running correctly. When an assessor asks for proof, the answer is where to find it. Kief Studio runs LTFI on the same habits: each company gets its own dedicated server, patched and watched by us, and every action by the AI staff and the team lands in an activity log. Read more on how we watch the server we run for you, see our note on CMMC readiness by level, and Brian Gagne's guide to CMMC requirements for small manufacturers.
Frequently asked questions
Is a CMMC assessment by a third party still required?
Not as a default contract requirement for now. Phase 2, which would have made third-party Level 2 assessments standard from November 10, 2026, was suspended in July 2026, and a September class deviation limits contracts to self-assessments and has contracting officers remove the third-party requirement from existing ones. Self-assessments under Phase 1 remain in effect, and companies may still choose certification.
What is a C3PAO?
A CMMC Third-Party Assessment Organization. 32 CFR 170.4 defines it as an organization authorized or accredited by the Accreditation Body to conduct Level 2 certification assessments.
How is a CMMC assessment scored?
You start at the maximum score, which equals the number of Level 2 requirements, and lose the value of each requirement not met, up to five points for the most serious. The score can go negative.
Can we still get a CMMC assessment during the pause?
Yes. The suspension removed third-party assessment as a contract requirement, not the assessments themselves, and Federal News Network reported in September 2026 that Level 2 certifications were still being issued. A certificate lasts three years under 32 CFR 170.17, with a yearly affirmation.
What happens if our self-assessment score is wrong?
An inflated score can lead to False Claims Act liability. The Justice Department has settled cases with both prime contractors and suppliers.
Does LTFI make a company CMMC compliant?
No. LTFI runs your customers, projects, content and AI staff on a dedicated server that Kief Studio manages, patches and watches, with an activity log of every action. It does not replace your System Security Plan, your CUI environment or a CMMC assessment. Book a walkthrough to see how it runs.
More on Industry notes
- White-Label Hosting Is Dead. White-Label Operations Is What Clients Actually WantAugust 25, 2026
- The Compliance Assessment That Pays for Itself in One Cyber Insurance RenewalAugust 12, 2026
- Vendor Lock-In: How It Happens and How to Avoid ItAugust 12, 2026
- Own the Box: What It Means to Own Your InfrastructureAugust 12, 2026