How much staff time does a CMMC Level 2 assessment take?

The scheduled interviews and on-the-record activity for a mock or certification assessment run 1–2 days on our services page. Your team also spends time before that collecting evidence and answering questions. We confirm on the scoping call which people need to be available and when, based on your scope.

What documents will you ask for?

Expect requests for your System Security Plan, asset inventory and scope documentation, network and data-flow diagrams, policies and procedures, any Plan of Action and Milestones, and evidence that each NIST SP 800-171 requirement is in place, such as configurations, logs, and records. The exact list depends on your scope.

Who are the assessors, and what do they do?

Under the CMMC Assessment Process, a Lead Certified CMMC Assessor (Lead CCA) runs the assessment team, and Certified CMMC Assessors (CCAs) examine evidence, interview staff, and test controls against the 320 Level 2 objectives. Your organization names a point of contact who coordinates people and evidence.

What happens if our scope changes?

Scope drives the quote and the plan. If your CUI environment, systems, locations, or service providers change in a material way, which is uncommon, we re-scope with you and provide a revised quote and schedule before work continues.

Do we have to do a Spot Check or mock first?

No. The Spot Check is optional but highly recommended. It takes 1 day, is complimentary, and you get results in writing or verbally. A Detailed Mock Assessment is optional too; it is a full rehearsal against all 320 objectives, with results delivered both verbally and in writing. The mock and the certification assessment are separate engagements, so you can stage them separately.

Is a C3PAO assessment required right now?

Not for new DoD awards. Phase II has been suspended since July 13, 2026, so solicitations may require only Level 1 (Self) or Level 2 (Self). C3PAO certification is voluntary and still available.

CMMC Level 2 Assessment With 123 CMMC: Steps

Q: Will 123 CMMC help fix gaps we find?

No. 123 CMMC is an Authorized C3PAO, and we do not provide implementation consulting to organizations we assess. Your internal team, consultant, RPO, or MSP handles remediation.

Where CMMC stands as of October 29, 2026

Phase 1 is in effect. CMMC implementation began November 10, 2025, when the DFARS CMMC acquisition rule took effect.
Phase II is suspended. On July 13, 2026, the Department of War suspended the Phase II requirements that were scheduled to begin November 10, 2026. During the suspension, solicitations may require only CMMC Level 1 (Self) or Level 2 (Self).
The underlying rules still apply. DFARS 252.204-7012 and the 110 security requirements of NIST SP 800-171 Revision 2 remain in effect.
C3PAO assessments remain available. Voluntary Level 2 (C3PAO) certification assessments are still operational through Authorized C3PAOs.
November 10, 2028 is a contract-clause date, not a restart. DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026) sets November 10, 2028 as the date the CMMC clause (DFARS 252.204-7021) is inserted broadly when contractor systems handle FCI or CUI. It is not a Phase II restart, and class deviations can be revised or rescinded.

The short answer

A CMMC Level 2 assessment with 123 CMMC starts with a short scoping call. You can add an optional one-day Complimentary Spot Check, an independent review before you post to SPRS, or a Detailed Mock Assessment. You then submit evidence, our team reviews it in advance, and the scheduled interviews and testing take 1–2 days. Each step has a clear output, so you know what you are getting and from whom.

Step by step

Step 1: Scoping call

A 5–15 minute call covers your systems and assets, users, locations, technical environment, external service providers, and complexity. That is what CMMC pricing depends on. You leave with a written, scope-based quote and a realistic timeline. There is no obligation.

Step 2: Optional Complimentary Spot Check

The Spot Check is a focused, high-level review of selected areas that can affect your assessment, such as your SSP, CUI asset inventory and scope, POA&M, policies and procedures, monitoring, and SPRS information. It takes 1 day and is complimentary. It is optional but highly recommended, and results come in writing or verbally. It is not a certification and does not produce a score.

Step 3: Optional review before SPRS, or a Detailed Mock Assessment

If you are filing a self-assessment, our independent review before SPRS submission gives you a C3PAO-informed check first (1–2 days). If you are planning certification, the Detailed Mock Assessment is a full rehearsal against all 320 Level 2 assessment objectives (1–2 days of scheduled activity).

Step 4: Evidence submission and advance review

Before the scheduled days, you submit evidence and documentation and our team reviews it in advance. Interview time is then spent verifying and testing, not discovering your environment for the first time. See how CMMC evidence review works.

Step 5: Scheduled interviews and testing

The formal Level 2 certification assessment includes 1–2 days of scheduled interviews and on-the-record assessment activity. Assessors examine documents, interview the people who run each control, and test that controls work, using the methods in NIST SP 800-171A.

Step 6: Results and reporting

Under 32 CFR §170.17, the C3PAO enters results into the CMMC instance of eMASS, which feeds SPRS. If every requirement is MET, you receive Final Level 2 (C3PAO) status. If you score at least 80% and only allowed items are open, you may receive Conditional status with a POA&M that must close within 180 days, per §170.21.

What you get at each step

Step	Time	What you receive
Scoping call	5–15 minutes	Written, scope-based quote and a realistic timeline
Spot Check (optional)	1 day	Results on selected areas, in writing or verbally
Review before SPRS (optional)	1–2 days	Independent feedback on your self-assessment before you post
Detailed Mock (optional)	1–2 days scheduled	Verbal readout and written report across all 320 objectives; no certificate
Certification assessment	1–2 days scheduled	Results in eMASS/SPRS; Certificate of CMMC Status when the rules allow

Not sure which step you are on? Start with the optional one-day Spot Check, with results in writing or verbally.

Get My Complimentary CMMC Readiness Spot Check

Before the live sessions

The 1–2 day labels describe scheduled activity, not the whole engagement. Scoping, evidence collection, and reporting happen around those days. We walk you through the full sequence on your scoping call, so your team knows who is needed and when.

Independence

123 Efficient CMMC, LLC is an Authorized C3PAO. We do not provide implementation consulting to organizations we assess. If you need remediation help, see C3PAO vs RPO.

What a CMMC Level 2 Assessment With 123 CMMC Involves