A CMMC gap assessment is an evaluation of your current security controls against the 110 requirements in NIST 800-171, the standard underlying CMMC Level 2. It tells you exactly which controls are already in place, which are missing, and what it will take to close the distance before you face a formal C3PAO assessment. It is advisory, not certification, the gap assessment itself doesn’t grant you any CMMC status. It’s the step that determines whether you’re ready to pursue one.
Why “Gap Assessment” and “Assessment” Are Not the Same Thing
This is the single most common point of confusion we see, so it’s worth being precise about early: a gap assessment is an advisory exercise. A firm reviews your environment, compares it against NIST 800-171, and hands you a clear picture of where you stand. No certification results from it. No score gets submitted anywhere on your behalf.
A C3PAO assessment is the formal, independent third-party evaluation that results in your actual CMMC Level 2 certification. It can only be conducted by a Certified Third-Party Assessor Organization, a designation RSAA does not hold, and intentionally so. We provide gap assessment and remediation advisory. We do not conduct C3PAO assessments. That separation exists for the same reason your compliance advisor and your auditor should generally be different firms, independence protects the credibility of the formal assessment.
Confusing the two is how organizations end up unprepared: they think a clean gap assessment means they’re certified, when it actually means they’re ready to be formally assessed.
What’s Actually Reviewed in a Gap Assessment
A real gap assessment isn’t a checklist exercise, it walks through all 110 controls across the 14 NIST 800-171 control families, including:
- Access Control — who can get into systems handling CUI, and how that’s enforced
- Audit and Accountability — whether your systems log and retain the right activity
- Configuration Management — how systems are hardened and changes are tracked
- Identification and Authentication — MFA, password policy, and identity verification practices
- Incident Response — whether you have a real, tested plan, not just a document
- System and Communications Protection — encryption, network segmentation, boundary defense
- Physical Protection — controls over physical access to systems and media
For each control, the assessment records one of three outcomes: Met, Not Met, or Not Applicable. And for anything not met, what specifically needs to happen to close it.
What You Get at the End
Two deliverables come out of a properly run gap assessment:
- A control-by-control gap report. This documents exactly where you stand against all 110 requirements — not a vague summary, but a control-level record you can act on or hand to a C3PAO later as evidence of your preparation work.
- A Plan of Action and Milestones (POA&M). This is your remediation roadmap: every unmet control, what’s required to close it, who owns the fix, and a realistic timeline. This becomes the operating document your team works from for the next several months.
If your environment is mostly mature already, this process surfaces a short, specific list. If you’re starting from close to zero, it surfaces a much longer one — but either way, you leave with clarity instead of guesswork.
What Happens After the Gap Assessment
The gap assessment is the starting point, not the finish line. Here’s the realistic sequence from there:
- Remediation. You work through the POA&M — closing technical gaps, writing missing policies, implementing required controls. This is usually the longest phase.
- Readiness review. A final check to confirm the controls you’ve implemented actually hold up before you move toward formal assessment.
- C3PAO assessment (if pursuing Level 2 certification). This is the formal third-party evaluation that results in your actual CMMC certification — conducted by an independent C3PAO, not by your advisory firm.
- SPRS submission and ongoing compliance. Your results get recorded, and from there, CMMC isn’t a one-time project — annual affirmation and periodic reassessment keep you compliant going forward.
Most organizations need 6–12 months between the gap assessment and being genuinely ready for a C3PAO assessment, depending on how many gaps exist and how complex the environment is.
Why Timing Matters Right Now
CMMC Phase 2, when third-party C3PAO certification becomes mandatory for most CUI-handling contracts, arrives November 10, 2026. Given that most organizations need 6–12 months of remediation work after a gap assessment, starting that assessment this quarter is what keeps you ahead of the deadline instead of racing it.
A CMMC gap assessment gives you a clear, control-by-control picture of where you stand — and a remediation roadmap you can actually execute.
FAQ SECTION
Q: What is a CMMC gap assessment?
A: A CMMC gap assessment is an advisory review of your security controls against the 110 requirements in NIST 800-171. It identifies what’s already in place, what’s missing, and produces a remediation roadmap — it does not itself grant any certification.
Q: Is a gap assessment the same as getting CMMC certified?
A: No. A gap assessment is advisory and produces no certification. Certification at Level 2 requires a formal assessment by a Certified Third-Party Assessor Organization (C3PAO), which is a separate, independent process.
Q: Who can perform a CMMC gap assessment?
A: Compliance advisory firms with NIST 800-171 expertise can perform gap assessments. This is distinct from a C3PAO assessment, which can only be conducted by an accredited Certified Third-Party Assessor Organization.
Q: What is a POA&M and why does it matter?
A: A Plan of Action and Milestones (POA&M) is the remediation roadmap produced from a gap assessment — it documents every unmet control, the fix required, and a timeline. It’s also a required artifact for organizations pursuing conditional CMMC status.
Q: How long does remediation take after a gap assessment?
A: Most organizations need 6 to 12 months to fully remediate identified gaps and prepare for a formal C3PAO assessment, depending on their starting security posture.
Q: Should I get a gap assessment before or after my prime contractor asks about CMMC?
A: Before, if at all possible. CMMC requirements flow down from primes to subcontractors handling CUI, and remediation takes months — waiting until a prime asks directly often means starting under deadline pressure instead of on your own timeline.
