Prepare Your Evidence for a CMMC Level 2 Assessment
A control-family-by-control-family reference for contractors and practitioners preparing for a CMMC Level 2 assessment. Organized by NIST SP 800-171 practice, with example evidence artifacts and notes on how Examine, Interview, and Test methods apply during assessment. Artifacts vary by implementation, scope, and assessment objectives; use this guide as a planning reference, not a universal checklist.
Request the Free Evidence Guide
How a CMMC Level 2 Assessment Evaluates Your Environment
The CMMC Level 2 assessment is a structured verification process: not a paperwork audit and not a penetration test. Here is what every contractor preparing for Level 2 needs to understand, whether you are conducting a self-assessment or preparing for a C3PAO-led assessment.
The Three Assessment Methods
Examine, Interview, and Test: how each method works, what assessors are looking for, and how gaps or inconsistencies between them can affect evidence evaluation.
Control Families That Require Close Attention
AC, AU, CM, IA, and SC are control families that commonly require both technical implementation and operational evidence. The guide includes example evidence artifacts organized by control family and practice across these and other NIST SP 800-171 domains.
What Can Turn a Control into a Finding
Four pre-assessment evidence gaps that can cause a finding on an otherwise implemented control: SSP currency, evidence consistency, interview alignment, and scope definition. Open POA&M items are a separate consideration: they factor into Conditional Level 2 eligibility and closeout requirements under 32 CFR § 170.21, not into MET determinations on controls that are fully implemented.
MET vs. NOT MET Determinations
How assessors make practice determinations and how POA&M items factor into the outcome. Conditional Level 2 status requires meeting all applicable conditions under 32 CFR § 170.21(a)(2), not the minimum score threshold alone. Under § 170.21(b), required POA&M items must be remediated and confirmed by a closeout assessment within 180 days of the Conditional CMMC Status Date; the applicable closeout process differs between self-assessment and C3PAO paths. See § 170.21 for complete eligibility requirements.
Assessment Boundary Validation
How scope is defined, why boundary ambiguity invites expansion, and what your network architecture documentation must clearly demonstrate to protect the boundary.
Personnel Interview Preparation
How interview responses factor into assessment findings. When staff descriptions differ from documented processes, assessors may examine related evidence more closely. This section covers how to prepare your team to describe implementations accurately and consistently.
Three Methods. One Coherent Picture.
Every practice in the CMMC Assessment Process is evaluated through one or more of these methods. Gaps or inconsistencies between methods may prompt closer examination of the evidence across all three.
Method 01
Examine
The assessor reviews documentation including your SSP, policies, procedures, configuration baselines, network diagrams, asset inventories, audit logs, and training records. The document must reflect current state, not planned state.
Method 02
Interview
The assessor speaks with your system administrators, security staff, and end users. They verify that the people responsible for implementing controls understand what is deployed and why. Significant inconsistency with your SSP documentation may prompt closer examination.
Method 03
Test
The assessor observes or interacts with the system directly: firewall rules, MFA in practice, audit log samples, endpoint configurations, access control lists. Controls must be operational, not just documented.
Common Assessment Failures
Implemented Controls That Still Produce Findings
These preparation gaps can contribute to findings even when technical controls are fully in place. Understanding each one helps you prepare evidence that supports consistent evaluation across Examine, Interview, and Test.
Request the Evidence Reference Guide-
1SSP Describes a Future State
The assessor examines the SSP and then tests the system. When they do not match, that inconsistency may result in a finding even if the technical implementation is correct.
-
2Evidence Assembled Only for the Assessment
The Examine and Test methods may include review of configuration history and timestamps. Evidence that appears assembled only for the assessment may not hold up when interview and test scrutiny reveals inconsistencies with daily operations.
-
3Interview Inconsistency
When documentation says one thing and your system administrator describes a different process, assessors may examine related evidence more closely. Consistent, well-practiced descriptions across your technical staff reduce assessment risk.
-
4Ambiguous Assessment Boundary
If out-of-scope systems have network connectivity to CUI-bearing systems and are not properly isolated and documented, the assessor may expand scope.
-
5Misunderstanding POA&M Limits
Not all findings are deferrable through a POA&M. Conditional Level 2 status requires meeting all applicable conditions under 32 CFR § 170.21(a)(2), not the minimum score threshold alone. Under § 170.21(b), required POA&M items must be remediated and confirmed by a closeout assessment within 180 days of the Conditional CMMC Status Date; the applicable closeout process differs between self-assessment and C3PAO assessment paths. Review § 170.21 for complete eligibility requirements.
Control Families Covered in the Guide
These families frequently require both technical implementation and operational evidence, making thorough documentation especially important. The guide includes example evidence artifacts organized by control family and practice. Review the complete contents when you receive your copy.
What's Inside
The CMMC Level 2 Assessment Evidence Guide
A practitioner-written reference built for IT managers, security managers, compliance leads, and consultants preparing for a CMMC Level 2 assessment, whether self-directed or C3PAO-led.
-
Control-family-by-control-family breakdown
Organized by NIST SP 800-171 domain so you can work through each area systematically before the assessment.
-
Example evidence artifacts organized by practice
Example documentary, interview, and technical artifacts organized by NIST SP 800-171 practice. Relevance depends on your implementation, scope, and the applicable assessment objectives.
-
MET/NOT MET decision guidance
Guidance on what typically constitutes sufficient and consistent evidence for a practice determination under the CAP framework. Actual determinations depend on the applicable assessment objectives, implementation, and scope.
-
Pre-assessment readiness checklist
Steps to validate SSP currency, evidence integrity, boundary documentation, and personnel readiness before the assessment begins.
Request the Assessment Evidence Guide
Know what your assessment team will be looking for before the assessment begins. Enter your information below and a member of the Xact team will follow up with your copy.
Request Your Free Copy
Complete the form below to request the CMMC Level 2 Assessment Evidence Guide, a control-family-by-control-family reference for practitioners preparing for a Level 2 assessment. A member of the Xact team will follow up with your copy.
CMMC Compliance Consulting for Defense Contractors
Xact Cybersecurity is a managed IT and CMMC compliance consulting firm based in Marlton, NJ. We work with defense contractors and small-to-mid-size businesses operating under DFARS 252.204-7012, providing advisory and implementation support as they work toward CMMC Level 2 compliance.
Start Your Assessment Preparation