CMMC Audit Preparation Services: What to Buy Before the Assessment
The bottom line
CMMC audit preparation services are the pre-assessment work that gets a defense contractor ready before a Cybersecurity Maturity Model Certification (CMMC) self-assessment or a CMMC Third-Party Assessment Organization (C3PAO) certification assessment. Audit preparation is a bundle of seven distinct components — scoping, gap analysis against NIST SP 800-171 Revision 2, System Security Plan (SSP) development, Plan of Action & Milestones (POA&M) planning, technical control remediation, evidence packaging, and a readiness rehearsal — plus a separate eighth purchase for the C3PAO certification assessment itself, which is almost always performed by a different organization. This guide tells you what to buy in what order, what not to buy yet, what each provider category actually delivers, what the official sources say it costs, and how to verify any provider before you sign.
Start here: buy this first, don’t buy this yet
The CMMC clause in your contract decides almost everything else. Find yourself in this table before you spend a dollar.
| If this is you | Buy this first | Don’t buy yet |
|---|---|---|
| You handle FCI only, no CUI | Level 1 self-assessment prep against the 15 FAR 52.204-21 basic safeguards | A C3PAO certification assessment |
| You handle CUI and your contract specifies Level 2 (Self) | A NIST SP 800-171 Rev. 2 gap assessment, an SSP, an SPRS score, and a POA&M workflow | A formal C3PAO assessment unless the contract requires one |
| You handle CUI and your contract specifies Level 2 (C3PAO) | A readiness engagement: scope, gap, SSP, remediation, evidence, mock | A C3PAO date before your evidence packet is final, not draft |
| Your CUI is scattered across email, file shares, laptops, and vendors | A CUI scoping and enclave-design review | A mock assessment before the architecture is corrected |
| You think you’re “almost ready” | An evidence-index review or an independent mock assessment | A long remediation retainer unless gaps are actually identified |
| You’re a sub and the prime hasn’t told you what flows down | A clause and CUI review — read the prime contract | Any Level 2 work until your flow-down obligation is confirmed |
Why this table matters
Most wasted CMMC spend traces back to one mistake: a contractor bought the wrong service first because they thought “CMMC audit prep” meant one thing. It doesn’t. It’s seven things on the preparation side plus a separate eighth thing on the certification side — and only some of them apply to you.
Not sure which prep path fits your contract?
See who to hire first →How to prepare for a CMMC audit: the short answer
To prepare for a CMMC audit, first confirm the required CMMC level and assessment type by reading the clause in your contract (DFARS 252.204-7021 if it’s a current or near-term DoD contract). Then define your FCI and CUI scope, assess gaps against the correct requirement set (NIST SP 800-171 Rev. 2 for Level 2), remediate, build final evidence mapped to the SSP, rehearse control-owner interviews with a mock assessment, and schedule a C3PAO certification assessment only when evidence is final — not draft. For Level 1 and Level 2 (Self) contracts, the path ends at a posted SPRS score and a senior-official affirmation in SPRS; no C3PAO is involved.
The order matters more than the names. We’ve watched contractors waste six figures by reversing steps — running remediation against an undefined scope, building an SSP against the wrong requirement set, or paying for a C3PAO date before their evidence was real. The sequence below is the one the rule and the Cyber AB Assessment Process were built around.
- Read the contract clause. Confirm CMMC level, assessment type (Self or C3PAO), and any prime flow-down obligations.
- Define scope. Identify every asset that processes, stores, or transmits FCI or CUI. Consider whether an enclave can compress that boundary.
- Gap analysis. Score your current state against the 110 NIST SP 800-171 Rev. 2 requirements using NIST SP 800-171A assessment procedures.
- SSP development. Document how each requirement is implemented in your defined boundary.
- POA&M planning.For non-met requirements, establish a defensible POA&M with owners, milestones, and eligibility analysis.
- Remediation. Implement the missing controls — MFA, central logging, FIPS-validated encryption, segmentation, incident response, vulnerability management.
- Evidence packaging. Build a final evidence library mapped to the SSP and to each NIST SP 800-171A assessment procedure.
- Readiness rehearsal. Run a mock or non-certification assessment from an independent provider. Close findings before you schedule the real assessment.
- C3PAO assessment (if required). Engage a separately credentialed C3PAO — one that has not provided your readiness work — for the formal Level 2 certification.
What CMMC audit preparation services actually include
CMMC audit preparation services cover seven pre-assessment components: CUI/FCI scoping, gap analysis against the 110 NIST SP 800-171 Revision 2 security requirements organized into 14 control families, SSP development, POA&M planning, technical control remediation, evidence packaging, and a readiness rehearsal (also called a mock or non-certification assessment). The formal C3PAO certification assessment is a separate purchase from a separate organization.
A note on terminology. CMMC’s official term is assessment— there are self-assessments, non-certification assessments, certification assessments, and DIBCAC assessments. Most buyers search for “audit.” We use both because the search term is “audit” and the official term is “assessment.” Any guide worth reading should match how its readers talk while staying faithful to how the program actually works.
The seven preparation components — and the eighth thing that isn’t preparation
| # | Service component | What it produces | Typical duration | Primary delivering category | What it does NOT include |
|---|---|---|---|---|---|
| 1 | CUI / FCI scoping | Documented assessment boundary; data-flow diagram; asset inventory in scope | 2–6 weeks | RPO, Registered Practitioner (RP), or GRC platform with consulting | The remediation work itself |
| 2 | Gap analysis vs NIST SP 800-171 Rev. 2 | Gap report scored against the 110 requirements using NIST SP 800-171A assessment procedures | 3–8 weeks | RPO, RP | Implementation of missing controls |
| 3 | SSP development | An SSP describing how each requirement is implemented in your assessment boundary | 4–12 weeks (often parallel to #4) | RPO, RP, GRC platform | Operating the controls described |
| 4 | POA&M planning | A defensible POA&M for non-met requirements, with owners and deadlines | 2–4 weeks (rolling) | RPO, RP | Closing the items on the POA&M |
| 5 | Remediation / control implementation | Operating controls — MFA, central logging, encryption, segmentation, IR, vulnerability management | 3–9 months | MSP / MSSP, internal IT, CUI enclave vendor | Documenting and evidencing the controls afterward |
| 6 | Evidence collection and packaging | An audit-ready evidence library mapped to the SSP and to each NIST SP 800-171A assessment procedure | 4–12 weeks (continuous) | GRC platform, MSP / MSSP, internal team | Designing the controls in the first place |
| 7 | Readiness rehearsal (mock / non-certification assessment) | A simulated assessment with findings, a remediation list, and interview rehearsal | 1–3 weeks of active work | RPO or readiness provider; or a C3PAO under Cyber AB CoPC §3.4 conditions | The certification itself |
| — | (Separately) C3PAO certification assessment | The formal Level 2 assessment. The C3PAO submits results into the CMMC instantiation of eMASS, which transmits to SPRS; the C3PAO issues a Level 2 Certificate of CMMC Status after eMASS confirmation | 2–8 weeks of active assessment work | An authorized or accredited C3PAO that did not provide your readiness work | Anything other than the assessment |
A few patterns worth internalizing
Components 1–7 are usually what’s being sold when you see “CMMC audit preparation services.” The certification assessment is a separate engagement with a separate organization — almost always.
The cheapest component is often the highest leverage. Scoping (component 1) is two to six weeks of work, but a tight, defensible scope can materially reduce downstream cost and effort by reducing the number of systems, identities, evidence artifacts, and assessor interactions in scope.
Remediation (component 5) is where budgets go to die. Components 1–4 produce paper; component 5 produces controls that operate every day. If your environment is missing central logging, FIPS-validated encryption, or MFA on privileged and remote access, expect this phase to dominate the cost and the calendar.
Evidence packaging (component 6) is the most underestimated step. A finding of MET requires final evidence, not draft policies. 32 CFR Part 170 treats an out-of-date or incomplete SSP as a reason an assessment cannot be completed. Skip evidence packaging and the mock assessment will catch it; skip the mock too and the real assessment will catch it — at much higher cost.
What CMMC audit preparation services are not
- They are not a Certificate of CMMC Status.
- They are not a guarantee of passing.
- They are not a substitute for the formal C3PAO certification assessment.
- They are not a way to avoid the annual senior-official affirmation in SPRS.
- They are not a workaround for the underlying DFARS 252.204-7012 obligations — including safeguarding covered defense information and reporting cyber incidents — which continue to apply independent of CMMC.
See exactly which provider category fits each component.
Compare provider categories →Audit prep vs mock assessment vs C3PAO assessment
Audit preparation is the work you do before an assessment. A mock assessment (officially a non-certification assessment under Cyber AB CoPC §3.4) rehearses the formal assessment without producing a CMMC Status and is not reported to CMMC eMASS. A C3PAO certification assessment is the formal Level 2 evaluation that, if passed, produces your Certificate of CMMC Status. These things get conflated constantly. They are not the same.
| Item | Purpose | Who usually performs it | Produces CMMC Status? | When to use it |
|---|---|---|---|---|
| Audit preparation | Get ready | RPO, RP, MSP/MSSP, GRC platform, CUI enclave provider | No | Before any formal assessment |
| Gap assessment | Find missing requirements | Readiness consultant or RPO | No | Early — usually first paid deliverable |
| Mock / non-certification assessment | Rehearse the formal assessment | A separate readiness provider, or a C3PAO under CoPC §3.4 conditions | No | After remediation, before scheduling the real assessment |
| C3PAO certification | The formal Level 2 assessment | An authorized or accredited C3PAO in the Cyber AB Marketplace | Yes, if successful | When the contract requires Level 2 (C3PAO) |
| DIBCAC assessment | The formal Level 3 assessment | DCMA DIBCAC | Yes, if successful | Level 3 |
If you only remember one thing from this section: preparation does not produce a CMMC Status, and the only path to one is the formal assessment conducted by the right body for your level.
Which provider category fits each piece
Five provider categories make up the CMMC audit preparation ecosystem. Each delivers different components of the audit preparation stack. Most contractors need at least two — typically a readiness consultant for components 1–4 and an MSP/MSSP or enclave vendor for component 5 — and engage a separate C3PAO for the certification.
Registered Provider Organizations (RPOs) and Registered Practitioners (RPs)
Best for:scoping, gap analysis, SSP development, POA&M planning, evidence planning, mock assessments, and overall sequencing.
Limitations: RPOs and RPs are not assessors. They cannot issue a CMMC Status. They are also not a substitute for legal or contractual advice on your specific contract clauses.
Verify before engaging: RPO status must be listed in the Cyber AB Marketplace at cyberab.org. Per the Cyber AB February 2026 Town Hall recap, the Cyber AB reported 378 listed RPOs. A vendor that claims RPO status but does not appear in the Marketplace is a serious red flag. Ask which named individuals — by credential, including CMMC Certified Professional (CCP), CMMC Certified Assessor (CCA), and Lead CCA — will actually work on your engagement.
Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs)
Best for: the operational layer. Endpoint protection, identity and access management, MFA, central logging and monitoring, vulnerability management, incident response operations, and ongoing evidence collection through the security stack.
Limitations: MSPs and MSSPs are not assessors and do not certify your CMMC status. The right MSSP is the one whose tooling and operations fit your CUI environment — Microsoft 365 GCC High, AWS GovCloud, on-premises, or hybrid. An MSP that has never operated a GCC High tenant should not be your Level 2 partner.
ESP and CSP nuance. The DoD CMMC FAQ explicitly addresses External Service Providers (ESPs) and Cloud Service Providers (CSPs). If your MSP administers, stores, or logs CUI on your behalf, expect their controls to be in scope.
GRC platforms
Best for: the workflow layer. Control mapping, evidence tracking, policy management, task ownership, dashboards, and readiness reporting that make a Level 2 program manageable across the months it takes to prepare.
Limitations: A GRC platform is tooling, not a program. It does not implement controls, configure your network, train your control owners, or speak for you to an assessor. A platform alone does not make an organization compliant.
CUI enclaves and secure-cloud vendors
Best for: scope reduction. A well-designed enclave isolates CUI workflows from the rest of your enterprise IT. When CUI is processed, stored, or transmitted in a cloud environment, 32 CFR §170.17(c)(5) frames the CSP requirement around FedRAMP Moderate authorization or equivalency — not brand names alone.
Limitations:Enclaves help only if the boundary is real and operated as designed. Encryption alone does not create logical separation. Buying an enclave product without re-architecting your CUI workflows around it is one of the more expensive ways to feel like you’re making progress.
C3PAOs
Best for: the formal Level 2 certification assessment. C3PAOs are the only organizations authorized under 32 CFR Part 170 to conduct CMMC Level 2 certification assessments, listed publicly in the Cyber AB Marketplace.
Limitations — and this is the big one:A C3PAO that provides preparation, advisory, or consulting services to an organization is generally barred from performing that organization’s Level 2 certification assessment within three years. We cover that rule in the next section because every dollar of your audit preparation budget depends on it.
Verify any provider’s current credentials directly.
Check the Cyber AB Marketplace →The Cyber AB independence rule that disqualifies many vendors
Under 32 CFR 170.8 and the Cyber AB Code of Professional Conduct (CoPC), CMMC ecosystem members are prohibited from participating in a Level 2 certification assessment of an organization they previously consulted to prepare for any CMMC assessment within the prior three years. For most buyers, the practical effect is that your readiness consultant and your certification C3PAO should be separate organizations.
Why this rule exists, in one paragraph
The DoD wanted CMMC assessments to be independent the way financial audits are independent. A firm that helped you build your control environment has an obvious incentive to give that environment a passing grade. A firm that just sold you a $200,000 remediation project has an obvious incentive to confirm that the project worked. The independence rule cuts the conflict at the source. It is not a Cyber AB preference. It is in the federal rule.
What that means when you’re buying
- Do not let a vendor sell you “we’ll prepare you and certify you” as a single package. If you see this on a proposal, ask in writing who is performing the formal certification assessment and confirm that organization separately on the Cyber AB Marketplace.
- Watch out for related entities. Some vendors are legally separate but commercially linked — same parent company, same office, same staff with different titles. The spirit of the rule is independence.
- A mock assessment by a C3PAO is allowed under CoPC §3.4, but with conditions. The C3PAO performing the non-certification assessment cannot provide recommendations, advice, or consultative information about how to remediate or improve for the official assessment. Most buyers should treat preparation and certification as separate vendors and move on.
What to do if you’ve already engaged the wrong vendor
If you read this and realize you’ve already engaged a single vendor for preparation andan in-house certification path, the prep work isn’t wasted. Your scope, SSP, control implementation, and evidence still count. You’ll just need to engage a different C3PAO for the certification — which, given current Cyber AB Marketplace capacity, means getting in the queue immediately.
What CMMC audit preparation actually costs
Official DoD cost estimates published in the Federal Register at 89 FR 83092 put a small-entity Level 2 self-assessment plus initial affirmation at approximately $34,277, and a small-entity Level 2 C3PAO certification assessment plus affirmation at approximately $101,752. Real-world preparation engagements typically run $50,000 to $500,000+ once implementation and remediation costs are included, plus a separate C3PAO fee where applicable.
What the official numbers actually say
| Cost item | Official estimate | How to read it |
|---|---|---|
| Small entity, Level 2 self-assessment + initial affirmation | $34,277 | Official DoD estimate; covers assessment and affirmation activities; excludes implementation and remediation |
| Small entity, Level 2 C3PAO certification assessment + affirmation | $101,752 | Official DoD estimate; assumes NIST SP 800-171 Rev. 2 implementation already in place; excludes remediation costs |
| Small entity, Level 2 C3PAO, three-year total cost | $104,670 | Lifecycle estimate over the triennial assessment cycle |
| Other-than-small entity, Level 2 C3PAO, three-year total cost | $117,768 | Larger orgs — surprisingly close to the small-entity number |
| C3PAO engagement assumption (120 hours × $260.28/hr) | $31,234 | The assessor labor line item alone |
First, the official numbers exclude the work most contractors actually need. The Federal Register explicitly notes that Level 1 and Level 2 cost estimates are based on assessment, certification, and affirmation activities — and do not include implementation or maintenance costs. Remediation. Documentation. Evidence collection. Network re-architecture. CUI enclave implementation. Staff training. The DoD model assumes those costs are absorbed by your existing IT and security budget. For most small and mid-size DIB contractors, they are not.
Second, the official numbers model an organization that arrives substantially compliant. If your starting point is “we have an MSP and a few firewalls,” the gap from there to a successful Level 2 C3PAO assessment is much larger than $101,752.
Realistic market ranges for preparation work
| Service | Typical market range (DCR editorial synthesis) | Notes |
|---|---|---|
| Level 1 self-assessment prep | $5,000 – $20,000 | Most small subs can do this with internal help |
| Level 2 self-assessment readiness, small DIB | $50,000 – $150,000 | Scope-dependent |
| Level 2 C3PAO-assessed readiness, small DIB | $100,000 – $250,000 (+ C3PAO fee) | Bulk goes to remediation and evidence |
| Level 2 C3PAO-assessed readiness, mid DIB | $200,000 – $500,000+ (+ C3PAO fee) | Larger scope, more systems, more evidence |
| CUI enclave implementation | $25,000 – $150,000+ initial; recurring | Highly architecture-dependent |
| Mock / non-certification assessment | $10,000 – $50,000 | Depends on depth and team size |
| Formal C3PAO certification assessment | $30,000 – $150,000+ | Quoted by the C3PAO; scope-dependent |
For a deeper, separately maintained cost breakdown, see our CMMC Level 2 Cost Guide.
The Quote Sanity Checklist (use this on every proposal)
Vendor proposals are notoriously hard to compare because each one quotes a different scope. Send every prospective provider the same nine questions before you sign anything:
- Which CMMC level and assessment type is this quote scoped for?
- Does it include remediation, or only findings?
- Does it include writing the SSP, or only reviewing one?
- Does it map evidence to NIST SP 800-171A assessment procedures?
- Does it include technical control implementation?
- Does it include MSP / MSSP operating costs?
- Does it include the C3PAO certification assessment fee?
- Does engaging this firm create an independence conflict with our intended C3PAO?
- What is explicitly excluded from this quote?
A serious provider will give you direct answers to all nine. Anyone who can’t, or won’t, is signaling something you should pay attention to.
Send one scope, get three apples-to-apples proposals back.
Free. No obligation. No CUI, contracts, system diagrams, or sensitive files.
Get matched with providers that fit your level, scope, and timeline →How long CMMC audit preparation takes
Most CMMC Level 2 audit preparation programs are planned in the 6 to 18 month range from kickoff to a successful certification, depending on starting maturity, scope complexity, remediation depth, and C3PAO scheduling availability. Multiple Level 2 readiness publications across 2025 and early 2026 have quoted C3PAO scheduling lead times in the 6 to 9 month range, with longer waits expected as Phase 2 approaches.
The DCR readiness-stage ladder
| Stage | What happens | Typical bottleneck | Exit criterion |
|---|---|---|---|
| 1. Scope | Identify FCI/CUI; document asset categories, ESPs, CSPs, and any enclave boundaries | CUI discovery — finding it all | A documented and defensible assessment scope |
| 2. Gap | Score current state against the 110 NIST 800-171 Rev. 2 requirements using NIST SP 800-171A procedures | Incomplete or inaccurate SSP | A prioritized gap list with owners |
| 3. Remediate | Implement the missing controls — MFA, logging, encryption, segmentation, IR plan, etc. | Procurement cycles and technical debt | Controls are operating, not just designed |
| 4. Evidence | Build the final evidence packet that maps each control to the requirement it satisfies | Draft policies; missing logs | Evidence supports each in-scope requirement |
| 5. Rehearse | Mock or non-certification assessment; control-owner interview rehearsal | Control owners can’t explain their work | Mock findings are closed |
| 6. Assess | The formal Level 2 C3PAO assessment, if required | C3PAO calendar availability | A CMMC Status (Conditional or Final) posted to SPRS via CMMC eMASS |
The brutal truth about this ladder: most contractors underestimate stages 3 and 4. Remediation is where the calendar stretches, and evidence packaging is where the calendar collapses if it wasn’t built into the SSP from the beginning.
Where the phase schedule fits
The CMMC Program Rule at 32 CFR Part 170 became effective December 16, 2024. The DFARS implementation rule — DFARS 252.204-7021 — became effective November 10, 2025. That date marked the start of Phase 1, which runs through November 9, 2026 and primarily focuses on Level 1 and Level 2 self-assessment requirements.
Phase 2 begins November 10, 2026. From that date, DoD intends to include CMMC Level 2 (C3PAO) certification requirements in applicable solicitations as a condition of contract award. Phase 3 follows on November 10, 2027, and Phase 4 on November 10, 2028.
If your contract pursuit is Phase 2, work backward from November 10, 2026.
- Subtract 2–8 weeks of active C3PAO assessment time.
- Subtract 6–9 months of currently reported C3PAO scheduling lead time.
- Subtract 3–9 months of remediation.
- Subtract 6–12 weeks of scoping, gap analysis, and SSP development.
The math gets tight fast.
The evidence packet a C3PAO will actually inspect
A formal Level 2 C3PAO assessment is an evidence exercise. The C3PAO inspects your SSP, your asset inventory, your network and CUI data-flow diagrams, your assessment scope documentation, your policies and procedures, your technical control evidence, your training records, your incident response artifacts, and your POA&M. Under 32 CFR Part 170, evidence must be final — not draft — for a finding of MET.
The minimum evidence packet for Level 2
This list collapses in real engagements when teams treat documentation as the last step. It’s not. It is the work product.
- A current System Security Plan (SSP) that matches the environment as it actually operates
- A documented assessment scope (CUI assets, security protection assets, ESPs, CSPs, out-of-scope assets)
- An asset inventory
- Network and CUI data-flow diagrams
- CAGE code and CMMC Unique Identifier (UID) information for in-scope systems
- Policies and procedures aligned to each control family
- Technical control evidence — configuration baselines, MFA reports, logging coverage, vulnerability scan and patch records, access reviews
- Incident response artifacts — IR plan, tabletop exercise records, contact lists
- Training records (security awareness and role-based)
- A POA&M for any unmet requirements, with the eligibility analysis (Level 1 does not permit POA&Ms; Level 2 Conditional status requires a minimum score and only specific requirements are POA&M-eligible, with closeout within 180 days)
- A control-owner interview list, with primary and backup owners
- Senior-official affirmation workflow and SPRS posting documentation
The standard isn’t we have a policy — it’s we have a policy, it matches our practice, the practice is operating, and we have the records to prove it. That’s the bar a C3PAO is calibrated to.
Before you pay for the formal assessment, see whether your packet is actually ready.
32 points mapped to the 14 NIST SP 800-171 Rev. 2 control families. Free.
Download the CMMC Readiness Checklist →The Cyber AB Marketplace capacity snapshot
The March 2026 Cyber AB Town Hall reported approximately 103 authorized C3PAOs and 759 CMMC Certified Assessors (CCAs), with approximately 178 new Level 2 certificates issued that month and approximately 1,000 organizations certified to date. Industry reporting on DoD figures cites roughly 80,000 DIB organizations as the addressable Level 2 population. At the current run rate, C3PAO scheduling — not technical readiness alone — has become a binding constraint on Phase 2 timing.
Cyber AB Marketplace ecosystem trajectory, November 2025 – March 2026
| Month | Authorized C3PAOs | Certified CMMC Assessors (CCAs) | Lead CCAs | Certified CMMC Professionals (CCPs) | RPOs |
|---|---|---|---|---|---|
| Nov 2025 | 88 | *(not separately reported)* | — | — | — |
| Dec 2025 | 93 | 635 | 377 | 1,372 | — |
| Jan 2026 | 97 | 688 | 425 | 1,459 | — |
| Feb 2026 | 98 | 748 | 452 | 1,494 | 378 |
| Mar 2026 | 103 | 759 | — | — | — |
What the math says
- ~178 new Level 2 certificates were issued in March 2026 (Cyber AB March 2026 Town Hall).
- ~1,000 organizations have achieved Level 2 certification to date.
- ~80,000 DIB organizations are commonly cited as the addressable Level 2 population in industry reporting on DoD figures.
- Level 2 certification penetration in that snapshot is roughly 1 percent — that is a certification-penetration figure, not a full measure of DIB readiness.
The implication for any contractor whose contracts move into Phase 2 isn’t subtle. Capacity is finite. Lead times are growing. Phase 2 begins November 10, 2026 — and at the current pace, the queue itself becomes a competitive risk, independent of how good your controls are.
This is real scarcity, not manufactured urgency. The numbers are what they are, and pretending the calendar is flexible doesn’t help anyone reading this.
If your Phase 2 contract pursuit is inside 12 months, the queue matters more than the price.
Free. No obligation. Availability-first matching for Phase 2 timelines.
Request availability from matched CMMC providers →How Level 1, Level 2 Self, Level 2 C3PAO, and Level 3 change what you buy
The CMMC level and assessment type set by your contract dictate which audit preparation services you actually need. Level 1 is light-touch preparation. Level 2 Self requires a full SSP, evidence index, and SPRS posting but no C3PAO. Level 2 C3PAO requires the full preparation stack plus a separately engaged C3PAO. Level 3 requires Level 2 prerequisites and specialized NIST SP 800-172 readiness.
| Level | Information type | Requirements | Assessment type | What audit prep should emphasize |
|---|---|---|---|---|
| Level 1 | FCI | 15 | Annual self-assessment + senior-official affirmation | Basic safeguards, self-assessment workflow, SPRS posting |
| Level 2 (Self) | CUI | 110 | Triennial self-assessment + annual affirmation | SSP, score, evidence, SPRS, POA&M workflow |
| Level 2 (C3PAO) | CUI | 110 | Triennial C3PAO assessment + annual affirmation | Readiness, remediation, evidence, mock, separate C3PAO |
| Level 3 | Most sensitive CUI | 110 + 24 selected NIST 800-172 | DIBCAC assessment | Level 2 prerequisite + NIST 800-172 enhanced controls readiness |
For a deeper breakdown of the levels themselves and which one applies to your contract, see our CMMC Levels guide.
Scoping and CUI enclaves: why the first dollar should go here
Scoping is the single highest-leverage decision in a CMMC program. A tight, defensible scope reduces the number of controls you have to implement, the volume of evidence you have to produce, the assessor hours you have to pay for, and the total program cost. CUI enclaves — when designed and operated properly, on infrastructure that is FedRAMP Moderate authorized or meets FedRAMP Moderate equivalency — can compress an enterprise-wide scope into a manageable boundary. But enclaves only work if the boundary is real; encryption alone is not separation.
Most CMMC cost blowouts trace back to a single mistake: declaring the entire enterprise in scope without considering whether the CUI can be isolated. We have seen quote spreads of several hundred thousand dollars between enterprise-scope and enclave-scope proposals for the same contractor without changing the regulatory outcome.
When an enclave makes sense
- CUI flows through email, file shares, and laptops across the enterprise.
- The enterprise IT footprint includes commercial-grade systems that would be expensive to remediate to NIST 800-171 Rev. 2 standards.
- The company plans to grow its DoD work and wants a clean compliance boundary that can scale.
When an enclave doesn’t help
- CUI is already contained in a small set of systems that can be remediated in place.
- Your CUI handling is so deeply integrated with commercial operations that the enclave would require parallel workflows you can’t maintain.
- You’re treating the enclave as a way to claim CUI is out of scope without changing how the data actually flows. The DoD CMMC FAQ explicitly addresses this — encryption alone doesn’t create logical separation.
The right sequence: scope first, decide on enclave architecture second, remediate third. Reversing that order is how budgets blow up.
How to evaluate any CMMC audit preparation provider before you sign
Verify the provider’s Cyber AB Marketplace listing directly; confirm named credentialed staff; insist on documented experience in your specific CUI environment; require a written scoping deliverable as the first paid phase; check independence-rule compatibility with the C3PAO you intend to engage; demand pricing transparency by phase; and ask for two references from completed engagements. Anyone who can’t answer those items in writing is not ready to be your partner.
The provider verification checklist
- Cyber AB Marketplace listing — current status. Verify directly at cyberab.org/Catalog. A vendor not listed cannot claim RPO or C3PAO status.
- Credentialed staff, by name. Which specific individuals will work on your engagement, and what are their credentials (RP, CCP, CCA, Lead CCA)?
- Environment fit. GCC High, AWS GovCloud, on-prem, or hybrid? Demand named-environment experience and recent engagements.
- DIB experience at your size and level. How many engagements at your employee count and CMMC level have they completed (not started — completed)?
- Scoping deliverable first. The first paid deliverable should be a written scoping document, not a remediation invoice or a long retainer.
- Independence-rule compliance, in writing. Confirm the engagement does not violate the 32 CFR 170.8 three-year window for the C3PAO you intend to engage.
- Pricing transparency by phase or deliverable.A defensible engagement quotes by phase, not as a vague “CMMC package.”
- References from completed engagements. At least two clients who have actually achieved certification or posted self-assessment scores in SPRS — not just kicked off.
- Published methodology and team page. Black-box providers are a red flag. Trustworthy firms publish how they work and who works for them.
- What they decline to do. A serious provider will tell you what falls outside their scope. Anyone who claims to do everything probably does several things poorly.
Red flags — walk away
- “We can prepare you and certify you.” (Independence violation. Walk.)
- “Our templates guarantee a pass.” (No one can guarantee a CMMC outcome. Walk.)
- “We’re Cyber AB approved, so you don’t need to verify.” (Always verify. Walk.)
- “A mock assessment is basically certification.” (No, it isn’t. Walk.)
- “You don’t need to worry about who did remediation when we certify you.” (Yes, you absolutely do.)
- A Level 2 pitch with no documented GCC High, AWS GovCloud, or on-prem CUI experience.
- No published methodology, no named team, no references.
What changes for subcontractors and prime flow-down
Under 32 CFR 170.23, prime contractors are required to flow appropriate CMMC requirements down to subcontractors based on the information type the subcontractor processes, stores, or transmits and on the prime contract’s required CMMC level and assessment type. A subcontractor handling only FCI can be flowed Level 1. A subcontractor handling CUI is flowed at least Level 2.
| What the sub receives | Minimum likely path | Confirm with the prime |
|---|---|---|
| FCI only | Level 1 (Self) | Is only FCI flowing down, in writing? |
| CUI + the prime is on Level 2 (Self) | Level 2 (Self) at minimum | Is the prime’s requirement Self or C3PAO? |
| CUI + the prime is on Level 2 (C3PAO) | Level 2 (C3PAO) at minimum | What scope and timeline are flowed down? |
| CUI + the prime is on Level 3 | Level 2 (C3PAO) minimum unless guidance says otherwise | Is there specific contractual guidance for subs? |
Subcontractors should not guess. Get the prime’s flow-down requirement in writing before starting any meaningful preparation spend. We have seen subs spend six figures preparing for a Level 2 C3PAO assessment they never actually needed because the prime’s clause only required Level 2 (Self).
SPRS, CMMC UIDs, and annual affirmations: the lifecycle after the assessment
CMMC compliance is not a one-time event. Per DFARS 252.204-7021, contractors must maintain the required CMMC Status, submit CMMC Unique Identifiers (UIDs) to the contracting officer, enter current self-assessment results in SPRS when applicable, complete annual senior-official affirmations, and flow appropriate requirements down to subcontractors. Good audit preparation services leave a contractor with a maintainable compliance program, not just a one-time binder.
What a good preparation engagement should hand over at the end:
- A documented SPRS workflow with the named owner — covering self-assessment posting (where applicable) and the annual affirmation cadence
- An annual affirmation calendar with the responsible senior official
- CMMC UID tracking for in-scope systems and a process for submitting UIDs to the contracting officer
- An evidence maintenance schedule — what gets refreshed monthly, quarterly, annually
- A change-management trigger list — what environmental changes warrant SSP and POA&M updates
- A POA&M closeout plan, where applicable, with the 180-day window mapped to specific owners
- A control-owner accountability map that survives staff turnover
If your preparation provider hands you a deliverable that ends at the assessment date and not at the operational program, ask for the lifecycle plan. The annual affirmation is when the program gets tested in real life.
CMMC audit preparation checklist
A complete CMMC audit preparation checklist combines the operational evidence packet a C3PAO will inspect with the buyer due-diligence steps that protect you from the most expensive sequencing mistakes. Use the two halves below before you sign with any provider and before you schedule any formal assessment.
Before you engage any provider
- Read the actual contract clause (DFARS 252.204-7021 if present) and confirm the required CMMC level and assessment type with the contracting officer.
- Identify whether your organization processes, stores, or transmits FCI, CUI, or both.
- Identify any prime flow-down obligations that affect required level and assessment type.
- Run the Quote Sanity Checklist above against every proposal.
- Verify each provider’s Cyber AB Marketplace status directly at cyberab.org/Catalog.
- Confirm in writing that the proposed engagement does not create an independence conflict with the C3PAO you intend to engage.
Before you schedule a formal C3PAO assessment
- Final System Security Plan that matches the environment as it actually operates.
- Documented assessment scope and CUI data-flow diagrams.
- Asset inventory and network diagrams covering in-scope systems.
- CAGE code and CMMC UID information for in-scope systems.
- Policies and procedures aligned to each NIST SP 800-171 Rev. 2 control family.
- Technical control evidence: configuration baselines, MFA reports, logging coverage, vulnerability and patch records, access reviews.
- Incident response artifacts: IR plan, tabletop records, contact list.
- Security awareness and role-based training records.
- POA&M with eligibility analysis (Level 1 does not permit POA&Ms; Level 2 Conditional status has minimum-score and content limits; closeout within 180 days).
- Mock assessment findings closed.
- Control-owner interview list with primary and backup owners.
- Senior-official affirmation workflow and SPRS posting documentation ready.
Run this checklist twice — once before remediation closes and once before you sign the C3PAO engagement. The two passes catch different gaps.
Frequently asked questions
What are CMMC audit preparation services?
CMMC audit preparation services are the pre-assessment professional services that get a defense contractor ready before a CMMC self-assessment or C3PAO certification assessment. They bundle seven components: scoping, gap analysis against NIST SP 800-171 Revision 2, SSP development, POA&M planning, technical control remediation, evidence packaging, and a readiness rehearsal. They do not include the C3PAO certification assessment itself, which under Cyber AB rules is generally performed by a separate organization.
How do you prepare for a CMMC audit?
You confirm the required CMMC level and assessment type from the contract clause, define your FCI/CUI scope, assess gaps against NIST SP 800-171 Rev. 2 using NIST SP 800-171A procedures, remediate, build final evidence, rehearse control-owner interviews, and schedule a C3PAO assessment only if the contract requires Level 2 (C3PAO). For a Level 1 or Level 2 (Self) contract, the path ends with a posted SPRS score and a senior-official affirmation; no third party is involved.
How much do CMMC audit preparation services cost?
Costs vary with starting maturity, scope, environment, and CMMC level. The Federal Register at 89 FR 83092 puts a small-entity Level 2 C3PAO certification plus affirmation at approximately $101,752 and a small-entity Level 2 self-assessment plus initial affirmation at approximately $34,277. Those official estimates cover assessment and affirmation activities and exclude implementation, remediation, and maintenance costs. Real-world preparation engagements typically run $50,000 to $500,000+ once those are included, with the C3PAO assessment fee on top.
How long does CMMC audit preparation take?
Most Level 2 preparation programs are planned in the 6 to 18 month range from kickoff to a successful certification, depending on starting maturity, remediation depth, scope complexity, and C3PAO scheduling. Industry reporting in early 2026 has quoted C3PAO lead times at 6 to 9 months, with longer waits expected as Phase 2 approaches on November 10, 2026.
Can the same company prepare me and certify me?
Generally, no. Under 32 CFR 170.8 and the Cyber AB Code of Professional Conduct, an ecosystem member that has served as a consultant preparing an organization for any CMMC assessment within the prior three years is barred from participating in that organization’s Level 2 certification assessment. A narrow exception exists under CoPC §3.4 for formal non-certification assessments, but the C3PAO performing the mock cannot give recommendations for remediation. In practice, most buyers should treat preparation and certification as separate engagements with separate vendors.
Do I need an RPO for CMMC audit preparation?
You are not required to engage a Registered Provider Organization. In practice, RPOs are the most direct source of structured NIST SP 800-171 Rev. 2 readiness expertise for organizations that do not have it in-house. Per the Cyber AB February 2026 Town Hall, the ecosystem reported 378 listed RPOs. Verify any vendor’s status directly on the Cyber AB Marketplace before engaging.
What is a CMMC mock assessment?
A mock assessment — officially a non-certification assessment under Cyber AB CoPC §3.4 — simulates the formal Level 2 certification assessment without producing a CMMC Status and is not reported to CMMC eMASS. It is used to identify gaps in documentation, evidence, and staff readiness before scheduling the real assessment. A mock can be performed by an RPO or readiness provider, or by a C3PAO under specific CoPC §3.4 conditions; in either case it does not produce a Certificate of CMMC Status.
Is CMMC Level 2 against NIST SP 800-171 Rev. 2 or Rev. 3?
CMMC Level 2 currently assesses against NIST SP 800-171 Revision 2. The DoD CMMC FAQ (Revision 2.3) states that Revision 3 will be incorporated through future rulemaking and that assessments continue against Revision 2 until the class deviation is withdrawn or superseded.
Can my MSP prepare me for CMMC?
An MSP can implement and operate technical controls, but most MSPs should not be a contractor’s only CMMC readiness resource unless they can also address scope, documentation, evidence, the assessment methodology, and External Service Provider (ESP) and Cloud Service Provider (CSP) obligations. Many contractors pair an MSP/MSSP with an RPO to cover both the operational and the readiness sides.
Can software alone make us CMMC ready?
No. A GRC platform can organize tasks, evidence, policies, and control mapping, but it cannot implement controls, define your CUI scope, operate your security program, or issue a CMMC Status. Treat GRC software as an evidence and workflow layer, not a complete solution.
What if our SPRS score is below 110?
A below-110 Level 2 score does not automatically mean “no CMMC Status,” but the rule is narrower than many vendors imply. Under the DoD FAQ and 32 CFR Part 170, a score below 110 only supports a Conditional CMMC Status if the score divided by total Level 2 requirements is at least 0.8, the missing requirements are POA&M-eligible (certain controls cannot be deferred), and closeout occurs within 180 days. If the contract requires Final Level 2 status, or if missing items are not POA&M-eligible, a below-110 score will not satisfy that requirement.
Should we book a C3PAO now because of backlogs?
Possibly — but do not pay for a formal assessment date before you know your scope and your evidence readiness. The safer sequence is to confirm your assessment path (Self or C3PAO), run a real readiness engagement, close the critical gaps, then schedule the C3PAO with a realistic date. Booking too early and arriving unprepared is the most expensive form of being early.
The bottom line on CMMC audit preparation services
CMMC audit preparation is a bundle of seven pre-assessment components, with the formal certification assessment as a separate eighth purchase from a separate organization. For most Defense Industrial Base companies handling CUI, the right path is: scope your CUI environment first; run a gap analysis against the 110 NIST SP 800-171 Revision 2 requirements; build an SSP that matches your environment as it actually operates; remediate the gaps with a partner that knows your cloud or on-prem environment; package evidence at the NIST SP 800-171A assessment-procedure level; rehearse with a mock from an independent reviewer; and engage a separately credentialed C3PAO for the formal certification when your contract requires it.
The single most expensive mistake is conflating preparation and certification. Under 32 CFR 170.8, your readiness consultant and your certification C3PAO should be different organizations for the same engagement. The single most expensive false economy is skipping evidence packaging and mock assessment to “save money” — both surface findings that are far cheaper to fix before the formal assessment than during it.
Phase 1 of the CMMC rollout runs through November 9, 2026. Phase 2 — when DoD intends to include Level 2 (C3PAO) requirements in applicable solicitations as a condition of award — begins November 10, 2026. The March 2026 Cyber AB Town Hall reported approximately 103 authorized C3PAOs against the ~80,000-organization addressable Level 2 population commonly cited in industry reporting on DoD figures. The math doesn’t allow for procrastination, and it doesn’t allow for buying the wrong service first.
Need help deciding what type of CMMC provider you need?
Free. No obligation. We disclose all referral and lead-routing relationships in our Editorial & Advertising Policy.
Get matched with verified providers in 60 seconds →What we actually verified for this article
- 32 CFR Part 170 — CMMC Program Rule. Confirmed at the Federal Register entry of October 15, 2024 (89 FR 83092) and the current eCFR text. Effective December 16, 2024.
- DFARS 252.204-7021 — confirmed at Acquisition.gov. DFARS implementation rule effective November 10, 2025; Phase 1 runs November 10, 2025 through November 9, 2026.
- NIST SP 800-171 Revision 2 — confirmed at the NIST Computer Security Resource Center as the control set referenced for CMMC Level 2 unless and until DoD amends the rule.
- NIST SP 800-171A — confirmed at NIST CSRC as the source for the assessment procedures used to score the 110 Rev. 2 requirements.
- NIST SP 800-172 — confirmed at NIST CSRC as the source catalog for Level 3 enhanced requirements.
- The 32 CFR 170.8 three-year consultant/advisory restriction — confirmed in the eCFR section text and reinforced by the Cyber AB Code of Professional Conduct v2.0.
- Cyber AB CoPC §3.4 non-certification assessment provisions — confirmed against the published Cyber AB Code of Professional Conduct v2.0 and the February 2026 Cyber AB Town Hall recap.
- Federal Register cost estimates at 89 FR 83092 — confirmed the small-entity Level 2 self-assessment ($34,277), the small-entity Level 2 C3PAO certification + affirmation ($101,752), the small-entity three-year Level 2 C3PAO cost ($104,670), the other-than-small three-year Level 2 C3PAO cost ($117,768), and the 120-hour / $260.28-per-hour C3PAO engagement assumption ($31,234).
- Cyber AB Marketplace ecosystem trajectory — assembled from Cyber AB Town Hall recaps for November 2025, December 2025, January 2026, February 2026, and March 2026.
- DoD CMMC FAQ (Revision 2.3)— confirmed at the DoD CIO CMMC FAQ page on NIST 800-171 Rev. 2 vs Rev. 3 status, on ESP/CSP and enclave guidance, and on the Conditional CMMC Status / 180-day POA&M closeout rules.
- DFARS 252.204-7012, 7019, 7020 — confirmed at Acquisition.gov.
If you spot an error, write to corrections@thedefensecompliancereport.com or see our Corrections policy. We re-verify every regulatory and ecosystem claim on this page on the cadence published in our Methodology and update the “Last verified” stamp accordingly.
About the editorial team
We are The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance. We do not accept editorial-approval rights from sponsors. Our methodology, corrections policy, and editorial standards are published in full and link from the footer.
This article is editorial research and is not formally reviewed by a named CMMC Subject Matter Advisor. We will list a named reviewer only when a Subject Matter Advisor on our published advisor list has actually reviewed the article. Until then: verify scope and applicability with a Registered Practitioner (RP) or qualified federal-contracts counsel before acting.
Related reading
- CMMC Gap Assessment Services: What They Should Deliver, Who Can Perform Them, and What to Verify Before You Hire (2026)
- CMMC Readiness Assessment Services: Cost, Scope, Vetting (2026)
- CMMC Consulting Services: What to Buy and When (2026)
- CMMC Level 2 Consulting Services (2026)
- CMMC Provider Categories: C3PAO, RPO, MSP, MSSP, GRC & CUI Enclave Explained
- CMMC Level 2 Cost in 2026
- Best CMMC Consultants for Defense Contractors (2026)
- CMMC Phase 1 and Phase 2: Enforcement Timeline and What Changes