Home / Docs / Assessment Guidance

Assessment Guidance (Rev 2)

Every Rev 2 requirement page includes a collapsible Assessment Guidance panel sourced from the official CMMC Assessment Guide – Level 2 — the same document C3PAO assessors apply. It shows you each control the way an assessor will see it, before an assessor ever does.

The Assessment Guidance panel expanded on a requirement, showing assessment methods and the evidence checklist
Assessor-grade guidance, inline on every Rev 2 requirement.

What the panel shows

  • Discussion & examples — a plain-language explanation of the requirement with worked scenarios, so you know what "implemented" actually means in practice.
  • Assessment methods — the three ways an assessor determines a requirement is met: Examine, Interview, and Test. Each has an info popover with its definition and a concrete example.
  • Examine checklist — the specific evidence types an assessor may examine for this requirement, as an interactive checklist (see below).
  • Potential assessment considerations — the kinds of questions an assessor may ask your team.
  • Key references — the underlying NIST SP 800-171 and FAR citations, linked so you can verify the guidance against the source publication.

The Examine checklist

For each requirement, the guidance lists the artifacts an assessor will look to examine — policies, procedures, configurations, logs, and so on. Tick off the ones your organization has actually collected:

  • The panel header shows an at-a-glance count, like Examine 3/15, so you can see evidence coverage per requirement from the tree.
  • Not every listed item is required to meet a control — the list is what an assessor may examine, and the app reminds you of that. A requirement can be fully met with a subset.
  • Evidence you tag with a shared evidence type auto-checks the matching checklist items.
  • Your checklist selections are saved locally and travel with database export/import, like everything else.

Why this matters

The most common self-assessment failure isn't missing controls — it's misjudging what a control requires and having no evidence trail when the assessor asks. Working with the assessor's own guidance and evidence list closes that gap while you work, instead of during a pre-assessment scramble. When you want a professional read on the result, that's what a mock assessment is for.