Most CMMC preparation goes wrong in the same way. A team opens the list of 110 NIST SP 800-171 requirements, starts at Access Control, and works forward. Three months later the controls are better, but the scope is still vague, the System Security Plan describes an environment that no longer exists, and nobody has practiced answering an assessor.
The order of work matters more than the effort. This article sets out a sequence that holds for a C3PAO assessment and for a self-assessment done properly. It assumes you already know which form applies; if not, read self-assessment vs C3PAO assessment first.
Confirm what you are being assessed for
Before you touch a control, write down three things from the contract or solicitation:
The level and assessment type. Level 2 (Self) and Level 2 (C3PAO) are different requirements.
The information involved. Whether you handle FCI only, or CUI, and which categories. This drives everything that follows.
The contracts and entities in scope. Which CAGE codes, which programs, which business units. An assessment covers a defined environment, not a company name.
If any of these are unclear, ask your contracting officer or prime now. Guessing here produces either an assessment of the wrong environment or a scope so wide that it cannot be finished.
Fix the scope before anything else
Scope is the single largest driver of how hard the assessment will be. Every system you place in scope needs every applicable requirement implemented and evidenced.
Work through it in this order:
Map where CUI flows. Where it arrives, where it is stored, who handles it, and where it leaves. Email, file shares and engineering tools are the usual surprises.
Build the asset inventory against that map. Categorize each asset using the CMMC categories: CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets.
Decide whether to segment. A dedicated enclave for CUI work can shrink the assessment considerably, but only if the boundary is real and enforced.
List every external service provider. Each one that touches CUI or provides security functions needs to appear in your SSP, along with what it is responsible for.
The detailed method for this step is in scoping where CUI lives in your environment. Do not skip it to get to the controls faster. A scope you cannot defend in the first hour of an assessment undermines every finding after it.
Assemble what the assessor reads first
Before an assessor looks at a single configuration, they read your documentation. These should be current, consistent with each other, and consistent with reality:
- Not done:
System Security Plan, describing how each requirement is implemented in this environment
- Not done:
Network and data flow diagrams that match the SSP
- Not done:
Asset inventory with CMMC categories assigned
- Not done:
Policies and procedures for each domain, with owners and review dates
- Not done:
Customer responsibility matrices from cloud and managed service providers
- Not done:
Any open POA&M, with dates and owners
- Not done:
Your current SPRS submission, if you have one
Inconsistency between these documents is a common early finding. If the SSP says MFA is enforced on all remote access and the diagram shows a path that bypasses the identity provider, the assessor will ask about it, and they will be right to. The NIST 800-171 System Security Plan article covers what that document needs to contain.
Build evidence for each objective
An assessor tests against the assessment objectives in NIST SP 800-171A, not against the headline requirement. A requirement with several objectives needs evidence for each.
The practical tool is an evidence matrix: one row per objective, with the artifact that satisfies it, where it lives, who owns it and when it was captured. Building it exposes gaps faster than any other exercise.
What good evidence looks like varies by domain:
| Domain | Weak evidence | Evidence that holds up |
|---|---|---|
| Access Control | A policy stating least privilege | Account listings exported from the source system, with role assignments |
| Audit and Accountability | Logging enabled | Retained logs, plus records showing someone reviewed them |
| Configuration Management | A hardening standard | Baseline configurations and a record of deviations from them |
| Identification and Authentication | "MFA is on" | Identity provider policy showing enforcement scope and exclusions |
| Incident Response | An IR plan | A dated test or exercise of the plan, with lessons recorded |
| Risk Assessment | A scanner license | Scan results over time and the remediation tickets they produced |
The pattern is the same throughout: a statement of intent is not evidence that the control operates. For more on why system-generated records carry more weight than screenshots, see types of audit evidence and which is strongest.
Periodic controls need a history
Several requirements involve something done on a schedule: reviewing logs, reviewing accounts, scanning for vulnerabilities, updating the SSP. An assessor will want to see that the activity happened at the interval you stated. If you start doing it a month before the assessment, you will have one occurrence to show. Start periodic activities early.
Prepare the people, not only the documents
Interviews are one of the three assessment methods, alongside examining artifacts and testing mechanisms. Assessors talk to the people who run each control, not only to the compliance lead.
Identify an owner for each domain. Make sure each owner can explain, in their own words, how the control works, where the evidence is, and what happens when it fails. They should answer the question asked, show the record, and say "I don't know, I'll find out" when that is true. A confident wrong answer does more damage than an honest gap. Preparing control owners for auditor interviews covers the technique in more detail.
Rehearse with a mock assessment
Run a full rehearsal before the real thing. It should be conducted by someone who did not build the controls: an internal reviewer from another team, or an outside consultant such as a Registered Practitioner Organization.
A useful mock assessment does three things:
Tests every objective with the same methods an assessor would use.
Times the evidence retrieval. If an artifact takes a day to find, it will take a day during the assessment too.
Produces a written list of findings you then close or move to a POA&M.
Remember the POA&M limits. Only some requirements can be carried on one, you need a minimum score to qualify for conditional status, and items must close within 180 days. A mock assessment that finds a gap in a requirement that cannot be deferred has given you the most valuable result it can.
Choose and engage your C3PAO
Authorized C3PAOs are listed in the Cyber AB marketplace. When you speak to them, ask how they schedule, how they run the planning phase, how they want evidence presented, and how they handle access to your environment during testing.
Conflict-of-interest rules prevent an organization from assessing a client it helped prepare. If you used a consultant for readiness work, keep that relationship separate from the firm that assesses you.
Expect the engagement to move through planning, the assessment itself, reporting, and, if you have POA&M items, a later closeout assessment. Daily debriefs during the assessment are common and useful: they tell you early where the assessor sees a problem.
How TrustLynce helps
TrustLynce tracks each NIST SP 800-171 requirement against your controls and collects evidence on a schedule, so periodic controls build a dated history rather than a last-minute snapshot. The auditor portal keeps assessor requests, evidence and findings in one place. Our CMMC page outlines the framework coverage.