C3PAO Assessment and What Happens If You Fall Short

A C3PAO is a CMMC Third-Party Assessment Organisation: an entity authorised to conduct Level 2 certification assessments. Understanding how one works is still worth your time even though the requirement is currently suspended — because the assessment method is what your self-assessment is being measured against, and because the suspension is under review.

What an assessment actually examines

Not the 110 requirements. The 320 assessment objectives in NIST SP 800-171A, which decompose those requirements into testable statements. A requirement is satisfied only when every objective beneath it is.

That is the single most important thing to understand about assessment, and the reason self-assessed scores routinely exceed assessed ones. “We use MFA” satisfies a requirement in conversation and fails at objective level, where the questions become which account types, which access paths, and how enforcement is verified.

The three methods

Assessors work through three methods, and evidence that satisfies one may not satisfy another:

• Examine — reading policies, configurations, architecture documents, logs.
• Interview — asking the people who operate the systems how things actually work. This is where policy-and-practice divergence surfaces.
• Test — observing the control functioning. Watching an account be denied, seeing a log entry generated.

A written policy is examine-evidence only. If the person who runs the system describes something different, the finding follows the interview.

Why assessments fail

Published DIBCAC data, drawn from 117 historical assessments and presented in 2023, puts the same items at the top repeatedly. Date it when you cite it — it remains the best public dataset, but it is not current-year.

The top two are 3.13.11 (FIPS-validated cryptography) and 3.5.3 (multi-factor authentication). Both are partial-credit controls, and both fail for the same underlying reason: something is in place that resembles the requirement without meeting it. Encryption that uses an approved algorithm but not a validated module. MFA on some account types and not others.

Three of the top ten sit in Audit and Accountability — defining which events are logged, alerting on logging failure, and correlating and reviewing records. That family carries the lowest point density in the standard, which is exactly why it gets deprioritised and then fails.

Beyond individual controls, the recurring structural failures are scoping errors, an SSP written at requirement level rather than objective level, policy that contradicts live configuration, and missing shared-responsibility matrices with cloud providers.

What happens if you fall short

Not a binary pass or fail. Where you score at least 88 of 110 and the outstanding items are eligible for deferral, conditional status is available with a 180-day closeout.

Eligibility is the constraint people miss. Under 32 CFR 170.21 only one-point requirements may generally sit on a POA&M, with 3.13.11 the sole exception under its partial-credit condition. Six requirements can never be deferred at all:

3.1.20 · 3.1.22 · 3.12.4 · 3.10.3 · 3.10.4 · 3.10.5

So a score of 92 with a five-point requirement unmet does not qualify for conditional status, while a score of 89 with only one-pointers outstanding does. The composition matters as much as the number.

How an assessment is sequenced

The on-site or remote assessment window is the visible part and the smallest. Ahead of it sits a readiness review in which the C3PAO examines your System Security Plan and the evidence package to decide whether the assessment is worth starting — assessors do not generally want to spend a week discovering that the documentation was not ready, and a package that fails this review costs you the scheduling slot. Ahead of that sits scope agreement, where the boundary you assert is compared with the data flow you can demonstrate.

After the window comes a period in which findings are written up, preliminary results are discussed, and limited clarification is possible — clarification meaning pointing the assessor at evidence that already existed, not producing evidence created after the fact. The distinction between clarification and remediation is one assessors hold firmly, and it is the strongest practical argument for assembling evidence as you remediate rather than in the weeks before the assessment.

For how assessors apply the official DoD guides objective by objective, see the CMMC assessment guide.

Where this stands now

Third-party assessment requirements were suspended on 13 July 2026 and removed from contracts by Class Deviation 2026-O0025 Revision 3 on 3 September. You are not currently required to undergo a C3PAO assessment.

Two things follow. DIBCAC retains the ability to conduct government-led assessments, so the method above is not hypothetical. And your self-assessment is now the primary artefact the government relies on, which means the honest question is no longer “would we pass” but “is the score we posted defensible if someone looks.”

See program status for the current position, and readiness assessment for finding out where you stand before anyone else does.