CMMC Level 2 Assessments from
a Cyber AB Accredited C3PAO

The Current CMMC Implementation Status

CMMC implementation is currently in Phase I. On July 13, 2026, the Department of War (DoW, formerly the Department of Defense) suspended Phase II of CMMC implementation and launched a CMMC Reform Task Force review. The 60-day review window closed September 11, 2026; as of this update, the Task Force's findings have not been published, and Phase II has not resumed.

What still applies: Phase I CMMC self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171 Rev. 2 implementation, SPRS score submission, annual affirmations, and FAR 52.204-21 basic safeguarding. C3PAO Level 2 certification assessments remain available to organizations that choose to be assessed now.

Because requirements are set per solicitation and contract, organizations should review the CMMC level and assessment type stated in each contract rather than assume that every DIB contractor currently needs a C3PAO certification assessment.

Why Get a C3PAO Assessment During the Phase 2 Pause?

Competitive positioning: A Final Level 2 (C3PAO) status is valid for three years and can differentiate you with primes evaluating their supply chain.
Assessor availability: Scheduling is typically easier before demand returns when Phase II requirements resume.
Verified, defensible compliance: An independent assessment supports the accuracy of your SPRS score and affirmations, which carry False Claims Act exposure if overstated.

What is a CMMC Level 2 Assessment?

A CMMC Level 2 certification assessment is an independent evaluation, conducted by a Cyber AB Accredited C3PAO using Certified CMMC Assessors (CCAs), that determines whether an Organization Seeking Certification (OSC) has implemented all 110 security requirements of NIST SP 800-171 Rev. 2 within its defined CMMC assessment scope. Assessors examine documentation, interview personnel, and test systems against the assessment objectives in NIST SP 800-171A.

What is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) Program, codified at 32 CFR Part 170, verifies that defense contractors and subcontractors protect Federal Contract Information (FCI) and CUI. The program is managed by the DoW Chief Information Officer (CIO). Contract implementation is governed by the DFARS rule at 48 CFR, which took effect November 10, 2025 and began Phase I.

Cyber AB cyberab.org

The Cyber AB is the official body that accredits the CMMC ecosystem, managing the training and certification of assessors and C3PAO organizations. All DIB organizations must be certified at a level equal to or greater than the required level within their contract.

This model is based on companies being evaluated on the level of maturity of their cybersecurity practices and processes. The Cyber AB has developed the "Ecosystem" to outline the various organizations and components.

To be clear, the CMMC requirement is only that an OSC be assessed by a C3PAO. It is the C3PAO who will evaluate the OSC's implementation of NIST SP800-171.

CMMC Levels and Requirements

There are 3 levels of maturity at which an organization may obtain a certification. Click here for the official program.

Level	Protects	Requirements	Assessment Type
Level 1 - Foundational	FCI	15 requirements from FAR 52.204-21	Annual self-assessment
Level 2 - Advanced	CUI	110 requirements from NIST SP 800-171 Rev. 2	Self-assessment or C3PAO assessment, as specified in the contract; every 3 years
Level 3 - Expert	CUI against advanced persistent threats	110 Level 2 requirements + 24 selected NIST SP 800-172 requirements (134 total)	Government assessment by DCMA DIBCAC; requires Final Level 2 (C3PAO) first

CMMC Assessment FAQ

Do I need a C3PAO assessment right now?

Only if a current contract or solicitation requires CMMC Level 2 (C3PAO). With Phase II suspended as of July 13, 2026, most current requirements are Level 1 or Level 2 self-assessments. Many organizations are choosing voluntary C3PAO assessments now to get ahead of Phase II and meet prime contractor expectations.

How do I verify that a C3PAO is accredited?

Search the organization in the Cyber AB Marketplace. Accredited C3PAOs are listed with their authorization status.

Can the same company prepare me for CMMC and assess me?

No. A C3PAO cannot conduct a certification assessment for an organization it provided CMMC consulting services to within the prior three years. Choose separate providers for readiness and certification, or confirm the provider's independence controls in writing.

What happens if I don't pass every requirement?

If you score at least 88 of 110 and every NOT MET requirement is POA&M-eligible, you receive Conditional Level 2 status and have 180 days to close the POA&M. If you fall below that threshold, you do not receive a CMMC status and must remediate and be reassessed.

How long is a CMMC Level 2 certification valid?

Three years from the date of Final status, provided you submit an annual affirmation of continued compliance in SPRS.

What is the difference between a mock assessment and a certification assessment?

A mock assessment identifies gaps and gives remediation recommendations; results stay internal. A certification assessment is an independent, official determination by a C3PAO, and results are reported to the DoW through CMMC eMASS.

Who is Conducting CMMC Assessments?

CISEVE is an Accredited C3PAO and has a Cyber AB-accredited CCA on the team that can provide “prep” services to assist you in identifying your weak areas and what evidence you will need. If you are “ready” for an assessment, we can help you there, too. We can conduct your independent assessment. Ethically, however, we are only able to assist with either preparation or assessment.