How do I get CMMC Level 2 certified, and what does a C3PAO assessment actually involve?

A C3PAO assessment for Cybersecurity Maturity Model Certification (CMMC) Level 2 involves a multi-step process, from preparation to final certification, focusing on the 110 requirements of NIST SP 800-171 Revision 2. My firm doesn't do federal work because of all this cybersecurity stuff. We do county and school work, where we have to meet some state and local requirements, but nothing like this CMMC. For a CMMC Level 2 certification assessment, you need to first make sure your System Security Plan (SSP) is complete and all 110 controls are implemented. The C3PAO will review your SSP and Plan of Action and Milestones (POA&M), conduct interviews with your staff, and examine evidence like policies, procedures, and system configurations. They will look for objective evidence that each control is met, not just described. Any deficiencies found during the assessment will result in a finding, and you will need to implement corrective action to address them before certification can be granted. The CMMC Level 2 self-assessment is conducted every three years, and the resulting CMMC Status is valid for three years from the CMMC Status Date. A CMMC Level 2 certification assessment is also valid for three years.

The actual sequence for a C3PAO assessment starts with the contractor establishing a contract with an accredited C3PAO firm. Your firm will need to provide the C3PAO with access to your system security plan and any other documentation related to your cybersecurity posture, including your self-assessment score. The C3PAO will then conduct a readiness review, which involves examining your documentation and systems to identify any gaps before the formal assessment begins. During the formal assessment, the C3PAO will verify the implementation of all 110 controls of NIST SP 800-171 Revision 2. They will look for objective evidence of compliance, not just documented policies. Any findings that require corrective action must be addressed to achieve certification. The CMMC Level 2 self-assessment is conducted every three years, and the resulting CMMC Status is valid for three years from the CMMC Status Date. A CMMC Level 2 certification assessment is also valid for three years.