Assessment preparation is the work between "we think we comply" and "we can show it to a stranger in a structured interview." Most organizations that fail a NIST SP 800-171 or CMMC review have implemented a reasonable share of the controls. What they have not done is assemble proof at the level the assessor works at, brief the people who will be interviewed, or check that the documentation describes the system that actually exists.
This service covers that gap. We prepare you for whichever review is actually in front of you — a prime contractor's supplier review, a DCMA DIBCAC Medium or High assessment under DFARS 252.204-7020, or a future third-party CMMC assessment once the program restarts — by mapping evidence to objectives, rehearsing interviews, and running a mock assessment that scores you the way an assessor would.
Which assessment you are preparing for
The answer changes how much evidence you need and who will look at it. Under the DoD Assessment Methodology there are three confidence levels. A Basic assessment is your own self-assessment, scored and posted to SPRS under DFARS 252.204-7019. A Medium assessment is a DCMA DIBCAC review of your System Security Plan and score. A High assessment is DIBCAC on site or virtually, examining, interviewing and testing against the objectives.
Third-party C3PAO certification assessments are paused while the CMMC Phase 2 suspension stands — see CMMC program status — but nothing about that pause lowers the bar of a DIBCAC High assessment or a prime's own supplier audit. Preparing to the objective level covers every one of these, so that is the standard we prepare to.
What assessors actually test
NIST SP 800-171A breaks the 110 requirements into 320 assessment objectives, each written as a "determine if" statement. Access Control requirement 3.1.1, for example, is not assessed as one sentence; it carries six objectives covering whether authorized users, processes and devices are identified and whether access is limited to each of them. A requirement is MET only when every one of its objectives is met.
For each objective the assessor uses one or more of three methods: examine (documents, configurations, records), interview (the people responsible), and test (watch the mechanism work). Preparation therefore produces three things per objective — an artifact, a person who can explain it, and where relevant a demonstration that can be run on the day.
The preparation sequence
- Confirm the assessment scope and the CUI boundary the assessor will see, including every asset category in the asset inventory.
- Re-read the System Security Plan against the current environment and correct anything that has drifted since it was written.
- Map evidence to each of the 320 objectives and record where every artifact lives, who owns it, and how fresh it is.
- Brief control owners: what they will be asked, what they should demonstrate, and what they should not volunteer beyond the question.
- Run a mock assessment using the three methods, score it MET or NOT MET per requirement, and recalculate the SPRS score.
- Close or formally document every finding from the mock before the real assessment window opens.
The evidence package checklist is the artifact this sequence produces, and the SSP documentation service is where we send anything the mock shows the plan has wrong.
Interviews are where well-built programs fail
An administrator who configured multifactor authentication correctly but describes it vaguely, or who answers a question about privileged accounts with "everyone uses the same process," creates a finding that the configuration export alone would not have produced. Assessors are trained to probe the edges: what happens when someone leaves, who reviews the logs, how a temporary exception gets approved.
We prepare each interviewee with the objectives that touch their role and a short written brief of the evidence that supports their answers. The goal is consistency between what the SSP says, what the configuration shows and what the person describes — not scripted answers, which assessors recognize immediately.
What the mock assessment produces
You receive a requirement-by-requirement result with the objectives that failed and why, a recalculated SPRS score, a list of evidence gaps ranked by point value, and an updated POA&M showing which gaps are lawfully deferrable. Under 32 CFR 170.21 only 1-point requirements may be deferred, plus 3.13.11 where encryption exists but is not FIPS-validated; six requirements can never be deferred. If you need help building that plan, see POA&M development.
The mock also produces a calendar: which artifacts need refreshing before the assessment date — scan results older than your stated cadence, access reviews that were due last quarter, training records for new starters — so that the evidence is current on the day rather than current when it was collected.
Frequently asked questions
How long before an assessment should preparation start?
Allow at least eight to twelve weeks for an organization that has already implemented most controls. That covers evidence mapping, interviews, one mock assessment and time to fix what it finds. If a mock reveals five-point gaps, add the remediation time on top.
Is a mock assessment the same as a readiness assessment?
No. A readiness assessment finds out where you stand and builds the plan. A mock assessment assumes the work is done and tests whether it survives an assessor. Most organizations need the first one months before the second.
Do we need to prepare if CMMC third-party assessments are suspended?
Yes. DIBCAC Medium and High assessments under DFARS 252.204-7020 continue, primes still review suppliers, and a self-assessed SPRS score carries False Claims Act exposure if it cannot be supported by evidence.
Who should attend the assessment?
Control owners for each family, the person accountable for the SSP, and someone senior enough to make scoping decisions on the day. Keep the group small; assessors prefer to interview the person who actually operates the control.