CMMC Readiness and Mock Assessments: Key Insights, Lessons, and Best Practices
If you’re an organization supporting federal contracts involving CUI (controlled unclassified information) and you haven’t at least had a CMMC mock assessment in preparation for the real thing, now’s the time to do so. And luckily enough for you, Axiom has prepared a snippet of what a CMMC assessment scenario might look like.
Achieving this certification requires more than just a basic understanding of CMMC compliance, it demands a deep comprehension of the entire assessment process, disciplined preparation, and an organizational culture rooted in cybersecurity awareness. In this article, we breakdown the core insights from our CMMC Mock Assessment webinar, highlighting what organizations must know to navigate the process successfully and instill confidence as they move towards a real CMMC Level 2 assessment. By reviewing the CMMC assessment scenario, you can better understand what an assessor might be looking for.
Why CMMC Matters
CMMC Level 2 applies to organizations that create, receive, transmit, or store CUI. Because CUI is sensitive government data, the Department of War (DoW) mandates strict safeguards to protect it from unauthorized access. A successful Level 2 assessment confirms that an organization can implement and maintain these safeguards effectively. If you have noticed DFARS 252.204-7012 clauses in your contracts, CMMC Level 2 applies to you.
Failure to achieve compliance can disqualify a business from valuable federal contracts, making preparation essential to success.
The Phases to the CMMC Assessment
A Level 2 assessment typically unfolds across structured phases:
- Planning, Preparing, and Scoping
Organizations should identify:
- Their CUI environment
- Assets, systems, and users in scope
- Readiness review
- Evidence collection
- Conduct the Assessment
Assessors will collect:
- Written policies
- Procedures
- Screenshots
- Logs
- Configurations; and
- Training records, etc.
They also will speak with system administrators, security personnel, and sometimes, others that interact within the system to validate that documented practices align with real-world execution.
- Report Assessment Results
Assessors compile a final report detailing pass/fail outcomes for each practice. Thorough preparation at each phase significantly increases the likelihood of a successful assessment.
- Close-out POA&Ms and Assessment
This is the ability for the OSC (Organization Seeking Certification) to flip any of the missed 1-pointers to a ‘met’ within a 10-day period. If satisfactory, the OSC will then receive their official assessment score.
The Power of a Mock Assessment
False starts in real assessment can be costly and time-consuming. This occurs when an organization doesn’t get past the first stage of their assessment. Conducting an internal or third-party mock assessment helps organizations identify gaps early and practice for the real thing.
Being fully prepared with policies, procedures, and evidence avoids these setbacks and helps maintain momentum.
The Mock Assessment Script
In our Mock Assessment Webinar, we went over a CMMC assessment scenario that can give you an idea of what to expect. (All names and scenarios are completely made up and any relation to outside entities is not intentional.)
Lights. Camera. Action. And learn from this CMMC assessment scenario
AUDITOR
I see in your matrix you don’t have things broken down by AO. You have 3.1.1 marked as shared, and your SSP doesn’t lay out who’s responsible.
AUDITOR
The procedure called, “Administrative Procedures” in Section Two, outlines that process. Can you walk me through this and who’s responsible for what?
CLIENT
Sure. The procedure outlines that company leadership reviews all requests for access to the system. Once we feel their access is approved and appropriate, we email our MSP the required information outlined in the procedure.
AUDITOR
Do you obtain a background check before giving access?
CLIENT
Well, we are supposed to do background checks on everyone before they are hired, so the fact that HR has hired them and requested that we add them means that they have gone through the process.
AUDITOR
We will circle back to that when we get to the PS domain. So, Easy MSP, how do you know who’s authorized? And that the person giving the authorization is able to tell you it’s ok to add that person?
MSP
The only person at Max Fabricators authorized to request new users is Maleah who notifies us via email requesting the account be added. This comes in via our PSA which we track. We then follow the rest of section two in the produced which outlines adding access, licenses, etc.
AUDITOR
Maleah, can you show me an example of that request?
CLIENT
I don’t keep a list of email requests I send since Easy MSP tracks those requests in their ticketing system.
MSP
What Maleah said is correct. We track all requests via our ticketing system. Would you like to see an example of a request?
AUDITOR
That would be great.
< Auditor makes notes>
AUDITOR
Where is your list of approved users?
MSP
We consider the Entra ID as our list of approved users.
AUDITOR
How do you review approved users?
MSP
We email a screenshot to the Client to review quarterly.
AUDITOR
Are you sure there aren’t any other authoritative lists that helps govern who is authorized to have access to your system?
MSP
No, it is outlined in the Administrative Procedures document how we use Entra ID.
AUDITOR
Ok then…?
< What’s going wrong here?>
3.1.1 (b)
AUDITOR
Moving on to bravo. I see in your SSP that the process acting on behalf of a user would follow a change control process before being allowed, and that you review that quarterly. Also, in your SSP you have no accounts listed as service accounts.
MSP
Currently, the client doesn’t have any.
AUDITOR
Can you please bring up your Entra ID list for me to look at?
MSP
Sure, here it is.
AUDITOR
Also, can you explain the Veeam account that is listed?
MSP
Well, that’s the account we typically use to do Veeam backups.
AUDITOR
That would be an account acting on behalf of a user or service in this case Veeam throughout the system, correct?
MSP
Yes, I guess you’re correct.
< So how do you think things are going?>
3. 1. 1 (C)
AUDITOR
Let’s move on to charlie [c]. Where is your list of authorized devices? Your procedure named “Administrative Procedures”, Section Four outlines how you authorize them, but I don’t see a master list of devices in the evidence you provided other than Entra ID.
MSP
We manage that through Entra ID and it is our authoritative list of devices.
AUDITOR
You don’t keep any other alterative lists that you use to review authorized devices? Do you happen to have a list of devices that you keep track of when you authorize a device and make the request to Easy MSP?
CLIENT
No, I don’t either, should we?
AUDITOR
I can’t answer what you should and shouldn’t do. I’m only allowed to assess your environment, and I can’t provide consulting but what I can say is we are trending Not Met on both Alpha and Charlie right now.
< Auditors can’t consult, but they can share how you are trending on controls. This is prohibited by Cyber-AB/CAP. How are things going?>
3.1.1 (d, e, f)
AUDITOR
So, for Delta, Echo, and Foxtrot, who is responsible for them?
MSP
We are. We use Entra to limit access to the system through Condition access that ensures only approved devices can access the system. These devices are managed by Intune and are Azure AD joined. Even if a user tried to login to Microsoft 365 with their correct info, the CA policy would block them.
AUDITOR
OK. Could you demonstrate that for me? Showing that you can’t access Microsoft 365 from a non-managed device. Also, show me your list of Intune managed devices, and who is authorized to access them?
MSP
I don’t have an account we could test from. I guess we could use mine on my son’s computer. I’m not sure how I could show you it blocked me. Maybe it will show it in the Entra ID logs? Also, the list of authorized devices and users accessing them is listed under devices in Intune.
< The MSP eventually demonstrates the CA is working via logs and some trial and error. The auditor had to wait 10 minutes while Easy MSP figured it out>
<The MSP shows the list of Intune managed devices showing who logs into what>
AUDITOR
Ok if you will please show me your Intune Managed Device. I count here that you have eleven devices in your list, but your SSP states there are ten authorized devices. Where did the extra device come from?
<The MSP and Client briefly talk amongst themselves about where the extra device came from>
MSP
I believe that the last device in the list is Charles Walker’s who is the owner of the company. He wanted to be able to access the system from his vacation home.
AUDITOR
Can you show the authorization for that?
MSP
Let me check…
<The MSP shuffles through paperwork and present ticket evidence>
MSP
Well, Charles called in and asked if we could add his new home machines while he was on vacation as you can see from this ticket and since he’s the owner we complied.
AUDITOR
So did you try contacting Maleah since she is supposed to be the only person in Max Fabricators that is authorized to request new machines be added.
MSP
No, it was the weekend, and he was unavailable, and Charles is the owner of the company.
AUDITOR
Ok I believe I have what I need for 3.1.1 lets move on to 3.8.3.
It states in your SSP that you have established and implemented formal Media Sanitization and Disposal Procedures. When you broke down the roles, you listed Easy MSP “performs sanitization or coordinates destruction according to procedures.”
Easy MSP, is this correct?
MSP
Yes, this is correct.
AUDITOR
Here, it states that Max Fabricator’s MSP is responsible for overseeing and executing sanitization.
Maleah, how does Easy MSP sanitize your devices?
CLIENT
We send Easy MSP all our devices via U.S. Mail and they handle the sanitization and destruction of it.
AUDITOR
Do you remove/wipe all the data from the devices BEFORE sending them to Easy MSP?
CLIENT
No, we do not because sometimes the devices do not boot up.
<End Audit>
Now, ask yourself what happened in this CMMC assessment scenario. Did anything go right? And most importantly, what went wrong?
Continuing to Promote Cyber Awareness and Education
Cybersecurity is a shifting landscape. Continuous improvement is critical. A well-trained workforce strengthens the entire security posture and supports long-term compliance.
CMMC Level 2 assessments demand organizational alignment. By understanding the aspects of this CMMC assessment scenario and what went wrong, gives you and your organization a leg up on the real thing. With the right structure and education in place, successful certification becomes not just achievable but a natural outcome of a strong cybersecurity culture.
If you’d like to learn more, check out our CMMC Mock Assessment Webinar. Or reach out to us.