- Phase 1 is in effect. CMMC implementation began November 10, 2025, when the DFARS CMMC acquisition rule took effect.
- Phase II is suspended. On July 13, 2026, the Department of War suspended the Phase II requirements that were scheduled to begin November 10, 2026. During the suspension, solicitations may require only CMMC Level 1 (Self) or Level 2 (Self).
- The underlying rules still apply. DFARS 252.204-7012 and the 110 security requirements of NIST SP 800-171 Revision 2 remain in effect.
- C3PAO assessments remain available. Voluntary Level 2 (C3PAO) certification assessments are still operational through Authorized C3PAOs.
- November 10, 2028 is a contract-clause date, not a restart. DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026) sets November 10, 2028 as the date the CMMC clause (DFARS 252.204-7021) is inserted broadly when contractor systems handle FCI or CUI. It is not a Phase II restart, and class deviations can be revised or rescinded.
What evidence review is
CMMC evidence review is the part of an assessment where assessors check the documents and records that show each requirement is in place. Level 2 has 110 requirements from NIST SP 800-171 Revision 2, broken into 320 assessment objectives. According to NIST SP 800-171A, assessors use three methods: examine, interview, and test. Evidence review is mostly the “examine” part. Good evidence is both relevant and enough to cover the objective.
1. The evidence request
The process starts with knowing what the assessor needs for each requirement. Expect your System Security Plan, scope and asset inventory, network and data-flow diagrams, policies, procedures, any POA&M, and records that show controls running: configurations, logs, tickets, and training records. The DoD Level 2 Assessment Guide lists examples for each requirement.
2. Document owners
Give each requirement family an owner: the person who runs that control. Name one point of contact to track the list, chase missing items, and book interviews. Build an evidence index that ties each file to the objective it supports. That index saves hours for both sides.
3. Submission
Send evidence through the secure method you agree on with your assessor. Never send CUI over channels not approved for it. Keep a clean copy of exactly what you sent. Under the CMMC Assessment Process, the organization keeps the artifacts it used as evidence, and a hash of them is recorded, so version control matters.
4. Resolving gaps
In an advance review, the assessor reads your evidence before the live sessions and flags items that are missing, out of date, or unclear. You then supply more, or confirm the item is not there yet. The assessor will not tell you how to fix a control. Remediation belongs to your internal team, consultant, RPO, or MSP. Requirements still open at the end may affect your result: under 32 CFR §170.21, Conditional status needs a score of at least 80%, only allowed items on a POA&M, and closeout within 180 days.
5. Interview prep
Interviews confirm that what is written is what happens. Make sure the people who run each control are available, know the documents that describe their work, and can show the system live. Do not script answers that differ from practice. A good advance review means interview time goes to verifying and testing, not finding files.
Want an outside read on your evidence first? The optional one-day Spot Check is highly recommended, with results in writing or verbally.
Get My Complimentary CMMC Readiness Spot CheckWho does what
| Item | 123 CMMC (assessor) | Your organization |
|---|---|---|
| Evidence requests | Tells you what evidence is needed | Assigns an owner to each item |
| Documents and records | Reviews them in advance | Supplies SSP, policies, procedures, configs, logs, records |
| Gaps | Flags missing or unclear items | Supplies more evidence or fixes the control (with your own team or provider) |
| Interviews | Runs interviews and tests | Makes control owners available |
| Secure transfer | Agrees the method with you | Sends files only that way; keeps copies |
| Remediation advice | Not provided (independence) | Your team, consultant, RPO, or MSP |
123 Efficient CMMC, LLC is an Authorized C3PAO. We do not provide implementation consulting to organizations we assess. For the full engagement sequence, see what a Level 2 assessment with 123 CMMC involves.