- Phase 1 is in effect. CMMC implementation began November 10, 2025, when the DFARS CMMC acquisition rule took effect.
- Phase II is suspended. On July 13, 2026, the Department of War suspended the Phase II requirements that were scheduled to begin November 10, 2026. During the suspension, solicitations may require only CMMC Level 1 (Self) or Level 2 (Self).
- The underlying rules still apply. DFARS 252.204-7012 and the 110 security requirements of NIST SP 800-171 Revision 2 remain in effect.
- C3PAO assessments remain available. Voluntary Level 2 (C3PAO) certification assessments are still operational through Authorized C3PAOs.
- Voluntary certification still helps. Many organizations pursue a C3PAO path for primes, customers, or internal risk policy even while Phase II is suspended.
Buyers often hear “spot check,” “mock,” and “certification assessment” used interchangeably. They are not the same. This guide explains what 123 CMMC’s Complimentary CMMC Readiness Spot Check actually is—and what it is not—so you can choose the right next step without confusing a free starting conversation with a full rehearsal or a formal exam.
For the commercial offer page and request form, see Complimentary Spot Check. For the full service ladder, see CMMC services.
What the Complimentary Spot Check is
On our site, the Complimentary CMMC Readiness Spot Check is described as a focused, high-level, independent review of selected areas that can affect your CMMC assessment. It is provided at no cost by 123 CMMC as your Authorized C3PAO, with no obligation to buy a later service.
Results are delivered in writing or verbally, whichever you prefer. A Spot Check is not required, but we highly recommend one before an assessment. The purpose is early visibility: surface major issues well before a CMMC Detailed Mock Assessment and long before a formal Level 2 certification assessment—so you find gaps while there is still time for your implementation team to address them.
In short: it is an outside C3PAO perspective on selected readiness topics, not a hope-based walkthrough and not a certification decision.
What it is not
- Not a Detailed Mock Assessment. A mock evaluates all 320 CMMC Level 2 assessment objectives as a rehearsal of the real certification assessment. A Spot Check does not.
- Not a formal CMMC Level 2 (C3PAO) certification assessment. It does not produce a Certificate of CMMC Status or an eMASS certification path by itself. For how certification assessments run, see our Level 2 certification assessment guide.
- Not implementation consulting. We identify selected issues from an assessor’s vantage point. We do not remake your SSP, implement controls, or “fix you” into a pass. That boundary protects independence.
- Not a guarantee of later results. Finding (or not finding) an issue in a Spot Check does not guarantee MET/NOT MET outcomes in a mock or certification assessment. Scope, evidence, and rigor differ.
- Not a full review of every possible topic. Scope depends on your environment and assessment scope. Not every Spot Check reviews every sample area listed on the commercial page.
Spot Check vs Mock vs Certification
| Complimentary Spot Check | Detailed Mock Assessment | Level 2 Certification Assessment | |
|---|---|---|---|
| Purpose | Early, focused C3PAO perspective on selected areas | Full rehearsal against Level 2 objectives | Formal independent certification assessment |
| Cost (as described on 1cmmc.com) | No cost / no obligation | Paid service (quoted after scoping) | Paid service (quoted after scoping) |
| How results are shared | In writing or verbally, your choice | Per engagement scope | Per CMMC Program rules |
| Depth | Selected areas; high-level | All 320 Level 2 assessment objectives | Full certification assessment under CMMC Program rules |
| Certification status? | No | No (rehearsal only) | Yes, when rules allow Conditional or Final status |
| Typical place in sequence | Not required, but highly recommended before an assessment | Before formal certification, after major gaps are addressed | When you need Level 2 (C3PAO) status recorded via eMASS/SPRS |
123 CMMC also offers a separate paid CMMC Self-Assessment Independent Review before SPRS submission (timeline labeled 1–2 days on services). That review is not the Spot Check and is not certification. See how SPRS scores work and Level 2 (Self) vs Level 2 (C3PAO) for pathway context.
Want an early read before your assessment? Request the Complimentary CMMC Readiness Spot Check—no obligation.
Get My Complimentary CMMC Readiness Spot CheckWhat a Spot Check may review
Depending on your environment and assessment scope, the Complimentary Spot Check may review areas such as:
- System Security Plan (SSP) — assessment scope, boundaries, and whether the plan reflects your actual environment.
- CUI asset inventory & scope — relevant assets, network and data-flow documentation, connections and dependencies.
- Plan of Action & Milestones (POA&M) — identified deficiencies, responsibilities, milestones, tracking and status, where applicable.
- Information security policies — whether applicable policies exist, are approved, and align with your environment.
- Information security procedures — whether operational procedures are documented and whether practice aligns with documentation.
- Security Assessment Report (SAR) — existing assessment results, control-validation evidence, findings or identified risks, where applicable.
- Ongoing security monitoring — monitoring processes, logging and alerting, recurring reviews, and reporting practices.
- SPRS-related documentation — existing SPRS information and supporting documentation, where applicable.
Again: not every Spot Check reviews every item. Scope is tailored. Treat the list as examples of selected areas that often matter before a mock or certification assessment—not a checklist you are promised in full.
How Organizations Seeking Certification can prepare
You do not need a perfect package to start a Spot Check. You do need enough clarity for a focused conversation. Practical prep that matches the areas above:
- Have your current SSP (even if incomplete) and a plain-language description of where CUI lives and who touches it.
- Bring or point to your asset / boundary notes—diagrams, inventories, or data-flow sketches you already use.
- If you have a POA&M, know which items are open and who owns them.
- Locate approved policies and procedures that claim to implement NIST SP 800-171 practices relevant to your scope.
- If you already posted or drafted an SPRS self-assessment, have that score and supporting narrative handy for discussion—without treating the Spot Check as SPRS submission help or certification.
- Know who your implementation partners are (internal IT, MSP, RPO, consultant). We coordinate without taking over their job. Role boundaries are covered in C3PAO vs RPO.
Pricing for later paid services depends on size and complexity of scope. Our services page notes that a short scoping call (about 5–15 minutes) supports a written, scope-based quote—not a guess. The Spot Check itself remains no-cost, as described on /spot-check.
Independence and conflict of interest
123 Efficient CMMC, LLC is an Authorized C3PAO listed by the Cyber AB. 123 CMMC does not provide implementation consulting to organizations we assess. That CoI line is deliberate: CMMC’s trust model depends on the assessor not grading their own homework.
A Spot Check is still an independent look. It is not a back door into remediation consulting. If the Spot Check surfaces gaps, your implementation team closes them. If you later engage us for a Detailed Mock Assessment or a formal Level 2 certification assessment, we remain the impartial examiner—consistent with Cyber AB independence expectations and the organizational conflict-of-interest rules that apply to C3PAOs under the CMMC Program.
We also do not guarantee a passing result or tie fees to certification outcomes. A complimentary starting engagement does not change that rule for later paid work.
What typically comes after a Spot Check
Our services page frames four focused offerings from one Authorized C3PAO:
- Complimentary CMMC Readiness Spot Check — not required, but highly recommended before an assessment.
- Self-Assessment Independent Review before SPRS (1–2 days) — when you want a C3PAO-informed review of a Level 1 or Level 2 self-assessment package before you submit a score.
- CMMC Detailed Mock Assessment (1–2 days scheduled activity) — all 320 Level 2 objectives as a rehearsal.
- Formal CMMC Level 2 C3PAO Certification Assessment (1–2 days scheduled activity) — the certification assessment itself.
You are not required to buy the next step. Many organizations use the Spot Check to decide whether they need more readiness work with their own partners, a pre-SPRS review, a mock, or a path toward voluntary certification while Phase II remains suspended.
When you are ready to talk, contact our CMMC team or request the Spot Check directly on the commercial Spot Check page.