# CMMC C3PAO Assessment Day Prep Checklist > Source: https://netray.co/tools/cmmc-c3pao-assessment-day-prep-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer A four part checklist covering documents, evidence, people and logistics before a third party assessor arrives, with the items that sink assessments marked critical. ## Category compliance-legal ## Industry Defense ## Audience - Compliance lead - IT manager - Quality manager - Operations manager ## Tool **Kind:** checklist **Groups:** #### Scope and documents **Items:** **Text:** Scope statement lists CUI types, where CUI is received, stored, processed and sent **Critical:** true **Text:** Network diagram shows the assessment boundary, enclaves, firewalls and external connections **Critical:** true **Text:** Data flow diagram traces CUI from receipt through production to delivery **Critical:** true **Text:** Asset inventory by category matches diagrams and the SSP exactly **Critical:** true **Text:** System Security Plan covers all 110 practices and was updated within the last quarter **Critical:** true POA&M lists only items allowed on a POA&M, with owners, dates and milestones Policies and procedures are approved, dated, versioned and reachable by staff **Text:** External service providers and cloud services are listed with their responsibility matrices **Critical:** true Current SPRS score is posted and matches your own latest scoring #### Evidence **Items:** **Text:** Evidence folder exists for each practice, named by practice ID **Critical:** true **Text:** Every assessment objective has at least one artifact or a planned demonstration **Critical:** true Configuration exports for MFA, password settings, screen lock and encryption are current **Text:** FIPS validated cryptography is supported by module certificate numbers **Critical:** true Audit log samples show retention, review and alerting in operation Access review records show who reviewed, when, and what changed Vulnerability scan and patch records show remediation inside your own timelines Training records exist for every user with CUI access Incident response plan has been tested and the test is documented Media sanitization and physical access records are available #### People and interviews **Items:** **Text:** Each practice has a named owner who can explain it without reading from the SSP **Critical:** true **Text:** Administrators can show a control working live on request **Critical:** true General staff can say how they recognise, mark and report CUI Leadership can explain risk acceptance and how the program is funded A single point of contact manages assessor requests and tracks follow-ups Provider staff are available for interviews if they run in scope controls Mock interviews were run at least once with someone who was not on the project #### Logistics **Items:** Assessment dates, location and remote access rules are confirmed in writing A room with network access is booked and escorted access is arranged **Text:** Assessor access to evidence is read only and itself meets your CUI rules **Critical:** true Physical security walkthrough route and visitor logs are prepared Backup plan exists for a required system owner being unavailable Daily debrief slot is scheduled to review findings and gaps as they appear Contract and affirmation responsibilities after the assessment are assigned **Scoring Note:** Every critical item left unchecked is a likely finding. Resolve all critical items before scheduling. Review this against the current CMMC assessment process guide and your C3PAO's own instructions. ## Content **Intro:** Most failed or delayed assessments come from the same few causes: scope drawn differently in each document, evidence that proves a policy exists but not that it operates, and owners who cannot explain their own controls. This checklist focuses on those. **Sections:** #### How to use it **Body:** Work through the four groups in order. Start with scope and documents, because every other group depends on them. Check an item only when you can show the artifact in less than a minute. Hold a mock assessment two to three months ahead, using someone outside your project team, and treat unchecked critical items as blockers. Export the checklist to track the results in a ticket or a project plan, and attach owners and dates to everything left open. #### What assessors test **Body:** Assessors use the examine, interview and test methods from NIST SP 800-171A across each objective. They will compare your diagram, inventory and SSP against what they see on the network. They will ask administrators to demonstrate a setting rather than describe it. They look for operation over time, such as several months of access reviews or log reviews, and for consistency between what staff say and what documents claim. **Bullets:** - Consistency across SSP, diagrams and inventory - Evidence of operation, not only existence - Live demonstrations by the people who run the control - Provider evidence for inherited controls #### Common mistakes **Body:** Teams often update the SSP the week before and forget the diagram, leaving mismatches. Others buy tooling late and have only days of logs to show. Some prepare one subject matter expert for every interview, who then becomes the bottleneck. Another is giving the assessor broad access to a shared drive full of CUI without applying your own rules to it. Plan for follow up questions after the visit and keep a log of every artifact you provided. **Cta:** If gathering evidence from your ERP, ticketing and identity systems is the slow part, we can build a private assistant that locates the right artifact for each objective, on your own servers. **Faq:** #### How far ahead should I start? **Answer:** Three to six months is realistic for a small supplier with a reasonable starting point, and longer if you still have large gaps. Start with scoping and evidence, not tools, and schedule a mock assessment before booking the real one. #### Can I use a consultant? **Answer:** Yes, for preparation. The assessing organization must be independent of the consultant who prepared you, so keep the roles separate and check your assessor's conflict of interest rules. #### What if I cannot show evidence for an objective? **Answer:** The practice is not met. Depending on the practice and your score, it may be eligible for a POA&M, but some practices cannot be placed on one. Resolve these before the assessment if you can. #### Does passing end the work? **Answer:** No. Level 2 status requires an annual affirmation and a new assessment on a three year cycle, and the controls need to keep operating. Assign owners for the recurring evidence. ## Search terms cmmc assessment checklist, c3pao assessment preparation, cmmc level 2 readiness checklist, cmmc mock assessment checklist, how to prepare for cmmc assessment, cmmc assessment day, cmmc interview preparation, cmmc assessment evidence checklist --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json