Guidance
Straight answers to the questions we hear most.
Notes from more than 40 CMMC Level 2 assessments — written for the people who have to run the program, not just document it.
FAQ
Questions we hear before every engagement
Short answers from the assessments we have led. If yours is not here, ask us directly.
How long does a CMMC Level 2 assessment take?
Most engagements run about five weeks: scoping in week zero, kickoff in week one, evidence collection with an optional mock assessment in weeks two and three, the assessment week itself, and the certification decision the week after.
Can the organization that helps me prepare for CMMC also conduct my assessment?
No. To maintain independence and objectivity, a C3PAO cannot conduct a CMMC certification assessment for an organization to which it has provided CMMC consulting or advisory services within the applicable three-year lookback period. Organizations seeking both readiness support and certification assessment services should engage separate providers for these functions.
Should I contact a C3PAO before I'm ready?
Yes. Involving a C3PAO early can help you understand assessment scope, evidence expectations, and the certification process before you're ready to schedule the official assessment. It also gives you time to plan ahead and secure an assessment window that aligns with your contract requirements and readiness timeline.
Do you offer readiness or advisory help?
ManageIT Security maintains independence between advisory services and certification assessments. We do not provide CMMC advisory or remediation services to organizations we assess. For organizations that need readiness or remediation support before an assessment, we can connect you with independent providers that specialize in CMMC preparation.