Written and maintained by CASRAI Editorial Board
Last updated
The CMMC CAP is the CMMC Assessment Process, the procedural guide that Third-Party Assessment Organizations (C3PAOs) follow when they run a CMMC Level 2 certification assessment. This guide covers what the document is, which assessments it governs, how its four phases run, and the constraints that tend to surprise the contractor being assessed. Content below is as described in the Cyber AB document dated December 2024 and in 32 CFR 170.17, checked on 2026-10-29.
What the CMMC CAP is and who runs it
CAP stands for CMMC Assessment Process. The Cyber AB describes it as the official procedural guide for C3PAOs conducting a CMMC Level 2 certification assessment of an Organization Seeking Certification (OSC). The current edition is version 2.0, dated 16 December 2024 and marked “CMMC 2.0 Effective and In Force”. It replaced version 1.0, a pre-decisional draft dated 23 August 2022.
The Cyber AB publishes and maintains the CAP, and the CMMC Program Management Office (PMO) reviews and approves it. Adherence is required of C3PAOs and their CMMC Certified Assessors (CCAs), and it is an element of the C3PAO Accreditation Scheme.
The CAP is not the regulation
The CAP is a procedure, not a rule. The document itself says it does not replace 32 CFR part 170, the DoD scoping and assessment guides, or NIST SP 800-171 Revision 2, and that DoD and NIST documentation control if they contradict it. It also warns that the CAP should not be confused with the general references to an “assessment process” in 32 CFR part 170. The regulation text of 32 CFR 170.17 does not name the CAP. For the control set being assessed, see the NIST SP 800-171 term and the NIST SP 800-171A assessment procedures guide.
Eligibility: which assessments the CAP covers
The CAP applies only to CMMC Level 2 certification assessments conducted by a C3PAO. Under 32 CFR 170.17, an OSC must obtain a Level 2 certification assessment from an authorized or accredited C3PAO. Other assessment types sit outside it: the Level 1 self-assessment is performed by the organization itself, and Level 3 is led by the government rather than a C3PAO.
What the CAP requires: the structure
The CAP opens with Preliminary Proceedings and then moves through four phases.
- Preliminary Proceedings: the C3PAO receives the request from the OSC, confirms the entities involved, frames the assessment, identifies conflicts of interest and executes the contractual agreement.
- Phase 1, Conduct the Pre-Assessment: review of the System Security Plan, validation of scope, confirmation that evidence is available, a readiness determination, assembly of the assessment team, completion of the Pre-Assessment Form, a quality assurance review and upload of the form into CMMC eMASS.
- Phase 2, Assess Conformity to Security Requirements: an In-Brief Meeting, assessment of implementation, sampling for depth and coverage, scoring, treatment of External Service Providers and Cloud Service Providers, quality assurance reviews and Daily Checkpoint Meetings.
- Phase 3, Complete and Report Assessment Results: compilation of results, a quality assurance review, an Out-Brief Meeting, upload of results into eMASS, and appeals.
- Phase 4, Issue Certificate and Closeout POA&M: generation and issuance of the Certificate of CMMC Status and, where a Plan of Action and Milestones applies, its close-out.
The document names the roles involved: the Authorized Certifying Official, the Lead CCA, the OSC Point of Contact (who may be a consultant or Registered Practitioner) and a quality assurance individual who must be a CCA.
Steps from the contractor’s side
- Settle the assessment boundary first. The C3PAO validates scope in Phase 1, so a boundary built on the CMMC scoping guide logic is what it will test.
- Have the System Security Plan and the evidence ready. Phase 1 includes a review of the plan and a check that evidence can be made available.
- Engage a C3PAO and sign the contractual agreement during Preliminary Proceedings, after the conflict-of-interest check.
- Take part in the In-Brief, daily checkpoints and Out-Brief. Sampling is non-statistical, following NIST SP 800-171 Revision 2 Appendix D, and all CAGE codes in scope are accounted for.
- Receive the results. They reach the OSC in a CMMC Assessment Findings Report, and the C3PAO uploads them to CMMC eMASS, which sends them to SPRS.
- If a Plan of Action and Milestones is allowed under 32 CFR 170.21, plan the close-out assessment (see the timeline section).
Typical timeline phases
The CAP orders the work but does not publish a calendar for the whole assessment. The sequence is: Preliminary Proceedings, then the pre-assessment, then the on-engagement assessment with daily checkpoints, then reporting, then certificate issuance. The dates that do matter come from 32 CFR 170.17:
- To maintain a Level 2 (C3PAO) status, the Level 2 certification assessment must be completed within three years of the CMMC Status Date, and the affirmation of continuing compliance is made at each assessment and annually under 170.22.
- Where all requirements are met, the result is Final Level 2 (C3PAO). Where a valid POA&M under 170.21 applies, the result is Conditional Level 2 (C3PAO), and the POA&M closeout assessment from a C3PAO, with results posted into eMASS, must be completed within 180 days of the CMMC Status Date for the Conditional Level 2 (C3PAO) or that status expires.
Common mistakes
- Treating the CAP as the rulebook. It governs how the C3PAO behaves, not what the OSC must implement. The requirements come from 32 CFR part 170 and NIST SP 800-171.
- Expecting coaching after an adverse readiness finding. If the pre-assessment finds the OSC not ready, the Lead CCA informs the Affirming Official and explains the finding in writing to the OSC, without providing any remedial advice. A C3PAO that advises on how to improve is in conflict with the Code of Professional Conduct for resuming with that OSC.
- Expecting remediation advice in the results briefing. The CAP says the results briefing contains no remedial recommendations.
- Discarding evidence early. The OSC must retain the hashed artifacts used as evidence for six years from the CMMC Status Date, hashed with a NIST-approved algorithm, together with a list of artifact names, hash return values and the algorithm used.
- Assuming a first appeal goes elsewhere. The OSC must file an initial appeal with the same C3PAO, under 32 CFR 170.9(b)(19). The C3PAO has a time-bound appeals process aligned with ISO/IEC 17020 (2012) on file with the Cyber AB.
- Forgetting the CAP applies only to Level 2. Level 1 and Level 3 follow different processes.
Related programs
| Related topic | Relation to the CAP |
|---|---|
| CMMC C3PAO | The organization that must follow the CAP when it conducts a Level 2 certification assessment. |
| CMMC Level 2 assessment | The only assessment type the CAP applies to. |
| CMMC Certified Professional (CCP) | The CAP assigns the assessment work to CMMC Certified Assessors (CCAs) and requires its quality assurance individual to be a CCA. |
| CMMC scoping guide | Scope is validated in Phase 1 of the CAP. |
| CMMC Level 3 | Outside the CAP, which applies only to Level 2 certification assessments. |
FAQ
What does CAP stand for in CMMC?
CMMC Assessment Process, the Cyber AB’s procedural guide for C3PAOs conducting Level 2 certification assessments.
Is the CMMC CAP a regulation?
No. It is published by the Cyber AB and approved by the CMMC PMO. The regulation is 32 CFR part 170, and DoD and NIST documentation control if they conflict with the CAP.
Does the CAP apply to Level 1 or Level 3?
No. By its own terms it applies only to CMMC Level 2 certification assessments.
Who handles an appeal of the result?
The OSC files its initial appeal with the same C3PAO that conducted the assessment, using that C3PAO’s appeals process.
Sources
- The Cyber AB, “CMMC Assessment Process (CAP) v2.0”, December 2024 (checked 2026-10-29): cyberab.org CMMC Assessment Process v2.0.
- 32 CFR 170.17, Level 2 certification assessment requirements (checked 2026-10-29): eCFR 32 CFR 170.17.
Programs change. Check the Cyber AB downloads page, https://cyberab.org/Resources/Downloads, for any edition newer than the one described here.
