When people search for "the CMMC assessment guide" they usually mean one of three documents. The Department of Defense publishes an Assessment Guide for each CMMC level, and each one is the rulebook an assessor works from: it restates every requirement, breaks it into assessment objectives, and describes the evidence that would show the objective is met.
This page explains how those guides work in practice, what changes from level to level, and how to use them before anyone else does. If you want the requirements themselves rather than the method for judging them, start with NIST SP 800-171 and the CMMC Level 2 requirements.
The three official guides
| Guide | What it assesses | Who performs the assessment |
|---|---|---|
| Level 1 Assessment Guide | The 17 practices that protect Federal Contract Information, drawn from FAR 52.204-21 | The contractor, as an annual self-assessment affirmed in SPRS |
| Level 2 Assessment Guide | The 110 requirements of NIST SP 800-171 Revision 2, broken into 320 assessment objectives | The contractor (Level 2 self) or a C3PAO (Level 2 certification), depending on the contract |
| Level 3 Assessment Guide | 24 additional requirements selected from NIST SP 800-172 | DCMA DIBCAC, after a Final Level 2 C3PAO certification |
The guides are published by the DoD CIO on its CMMC resources page. Download them from the source rather than from a third-party copy, so you are working from the current version.
The guides do not add requirements. They describe how existing requirements are tested. That distinction matters, because most failed assessments are not caused by an unknown requirement. They are caused by a known requirement that was implemented in a way the assessor could not verify.
Objectives, not requirements, are what get tested
A NIST SP 800-171 requirement is a sentence. An assessment objective is one of the testable statements inside it. Requirement 3.1.1, for example, limits system access to authorized users, processes and devices. The assessment guide splits it into separate objectives: authorized users are identified, processes acting on their behalf are identified, devices are identified, and access is limited to each of those.
Across Level 2 there are 320 of these objectives. A requirement is met only when every objective beneath it is met. This is why an organization can sincerely believe it complies with a requirement and still be scored NOT MET: one unaddressed objective is enough.
The practical consequence is that your System Security Plan should describe implementation at objective level. An SSP that restates the requirement and says "implemented" gives an assessor nothing to test.
Examine, interview and test
Every objective in the guide lists the assessment methods that apply to it. There are three.
- Examine: the assessor reads documents and configurations. Policies, procedures, the SSP, system settings, logs, records and screenshots all count as examine evidence.
- Interview: the assessor talks to the people who perform the control. The test is whether the person who runs the system describes the same process the policy describes.
- Test: the assessor watches the control operate. A login is attempted without MFA, an account is checked for lockout, a removable drive is plugged in.
A written policy on its own is examine evidence only. Where the guide expects interview or test evidence as well, a policy will not carry the objective. The C3PAO assessment guide covers how assessors weigh the three methods and why the gap between them is where most findings come from.
How findings are scored
Each requirement receives one of three findings. MET means every objective is satisfied. NOT MET means at least one is not. NOT APPLICABLE is allowed where a requirement genuinely cannot apply, such as wireless access controls in an environment with no wireless, and the assessor expects to see the justification.
At Level 2, NOT MET findings are converted into a score using the same 5, 3 and 1 point weights as the DoD Assessment Methodology. You start at 110 and lose the weight of each unmet requirement. The arithmetic is set out on the SPRS score page, and the free SPRS score calculator applies it for you.
Conditional Level 2 status needs at least 88 of 110, with only POA&M-eligible gaps outstanding and a 180-day closeout. Which gaps are eligible is covered in the POA&M template guide.
The CMMC Assessment Process (CAP)
The assessment guides describe what is tested. The CMMC Assessment Process, published by the Cyber AB, describes how a C3PAO runs a Level 2 certification assessment from start to finish. In outline it moves through four phases.
| Phase | What happens |
|---|---|
| 1. Plan and prepare | Scope is agreed, the SSP and evidence are reviewed for readiness, and the assessment plan is set |
| 2. Conduct the assessment | Assessors examine, interview and test against every objective in scope |
| 3. Report results | Findings are finalized, the score is calculated, and results are entered for the contractor |
| 4. Close out POA&M items | Where conditional status was granted, eligible gaps are verified as closed within 180 days |
Third-party assessments were suspended in July 2026 and removed from contracts by the September class deviation. The guides remain the right yardstick for a self-assessment, because they are the standard you would be held to if your SPRS score were ever challenged. See CMMC program status for what currently applies.
Scoping comes before the guide
An assessment guide only tells you how to judge the assets in scope. Which assets those are is set by the CMMC scoping guidance for each level. At Level 2, assets are sorted into CUI assets, security protection assets, contractor risk managed assets, specialized assets and out-of-scope assets, and each category is treated differently.
A wrong boundary makes every later score unreliable. Settle it first using how to find CUI in your own systems, and consider an enclave if CUI is spread across systems that do not need it.
Using the guide on yourself
- Work objective by objective, not requirement by requirement, and record the evidence for each one as you go.
- For every objective, note which assessment method you would rely on and check that evidence of that kind exists.
- Interview your own administrators. If their description differs from the policy, fix whichever one is wrong.
- Score honestly. An optimistic self-assessment is a representation to the government, not a draft.
- Assemble the evidence into a package an outsider could follow. The evidence package checklist gives a structure.
The step-by-step version of this exercise is the CMMC self-assessment guide. If you would rather have it done with you, a readiness assessment scores every objective against the same guide an assessor would use.
Frequently asked questions
Where can I download the official CMMC Assessment Guide PDF?
The DoD CIO publishes the Level 1, Level 2 and Level 3 Assessment Guides, along with the scoping guides, on its CMMC resources and documentation page. Use that source so you have the current version.
How many assessment objectives are in CMMC Level 2?
There are 320 assessment objectives across the 110 NIST SP 800-171 Revision 2 requirements. A requirement is only met when every one of its objectives is met.
Is the CMMC assessment guide the same as NIST SP 800-171A?
They are closely related. NIST SP 800-171A defines the assessment procedures and objectives for NIST SP 800-171. The CMMC Level 2 Assessment Guide builds on those objectives and adds CMMC-specific guidance, examples and scoring rules.
Does Revision 3 of NIST SP 800-171 change the assessment guide?
Not for now. DFARS and CMMC remain tied to Revision 2, so the Level 2 guide and its 320 objectives still apply. See the page on NIST SP 800-171 Revision 3 for what changed and when it might matter.