CMMC Assessment Process (CAP) Fundamentals
The CAP is a process, not a checklist
The CMMC Assessment Process, published by The Cyber AB, defines how a certification assessment runs. Know its three broad phases:
1. Plan and Prepare. Engagement request and acceptance, conflict-of-interest screening, team composition and roles, scoping validation, scheduling, and evidence requests. The organization's SSP, POA&M, asset inventory, diagrams, and policies are collected here.
2. Conduct the Assessment. Documentation review first, then verification of each requirement using the three evidence methods - Examine, Interview, Test (E/I/T). Examine means reviewing artifacts; interview means talking to the people who perform the practice; test means observing or exercising the control. Sampling of assets, people, or evidence is permitted only with documented justification and must remain representative.
3. Report Results. Findings per requirement, score, validation of any POA&M, the assessment report, and the certification decision. Assessors verify; they do not advise, remediate, or coach mid-assessment.
Scoring and POA&M boundaries
At Level 2 the 110 requirements are scored; a POA&M is permitted only under defined conditions (a minimum score threshold and a bounded remediation window), and Level 1 does not allow a POA&M at all.
Traps
Watch for questions that confuse a readiness assessment (performed by an RPO/consultant, non-binding) with a certification assessment (performed by a C3PAO). Also watch for the claim that every asset must be individually tested, or that an assessor may help implement a fix.
Rule of thumb
Escalate evidence strength: an artifact alone (examine) is weakest, an artifact plus a knowledgeable interviewee is stronger, and direct observation or testing is strongest. When a question asks which method best confirms a practice is actually operating, choose test.