Six Weeks to Assessment, 25 Controls Open
Cedar Peak Consulting is helping a 90-employee machining supplier, Fabritek, prepare for a CMMC Level 2 assessment. The assessment is in six weeks. Fabritek has 64 practices fully implemented, 21 partially implemented, and 25 not started. The biggest gaps are in configuration management, incident response testing, and supplier risk assessments. Fabritek's president wants to proceed because the prime contractor is pressing for a date, and says 'we can fix the rest after the assessment and put them in the POA&M.' Cedar Peak's engagement letter says it will provide a readiness recommendation, not certify. The consultant has 30 billable days left and one junior analyst. The client also wants Cedar Peak to reuse an SSP from a different client in the same industry to save time. The consultant must decide what to recommend and how to handle the reuse request.
1. Should Cedar Peak recommend that Fabritek proceed with the assessment in six weeks? Provide a reasoned decision.
Read the worked answer
Cedar Peak should not recommend proceeding in six weeks. Only 64 of 110 practices are fully implemented; 21 are partial and 25 are not started. The largest gaps are not cosmetic: configuration management, incident response testing, and supplier risk assessments are practices an assessor will test with evidence and interviews. A POA&M is not a general amnesty for missing controls; it is limited and does not replace implementation. Proceeding would create pressure to overstate readiness, which conflicts with the engagement letter and professional ethics.
The recommendation should be a readiness decision with a revised date. Cedar Peak should give Fabritek a triage plan: close the highest-risk access and configuration items first, complete an incident response test with records, and document supplier risk for the CUI supply chain. A 90-day extension is more realistic than six weeks. If the prime needs assurance, Cedar Peak can provide a factual status letter showing milestones and evidence, not a prediction of certification. The consultant should document the advice and the client's decision either way.
2. How should the consultant respond to the request to reuse another client's SSP and to place open items in the POA&M?
Read the worked answer
The SSP reuse request should be declined as proposed. An SSP must describe Fabritek's actual environment, data flows, system boundaries, inherited controls, and evidence. A document from another client may contain different architecture, different service providers, and different responsibilities; copying it would create inaccurate representations and could mislead the assessor. Cedar Peak may use an anonymized outline or template with permission, but Fabritek must rewrite the content and validate every statement.
On the POA&M, the consultant should explain that only certain practices may be eligible for a POA&M and that the assessor will still verify evidence. Placing 25 not-started practices into a POA&M does not make them compliant. The consultant should help prioritize: fix practices that are prerequisites for other controls, assign owners, and set dates. If the president insists on presenting the copied SSP as Fabritek's own, Cedar Peak should escalate internally, document the objection, and consider withdrawing from the readiness role rather than sign off on a misleading package.