Self-Assessment Survival Guide: Key Evidence Steps and Mistakes to Avoid
Cut through the complexity to what really matters when preparing for a strong CMMC Level 2 Self-Assessment.
The Department of War’s recent pause on CMMC Phase 2 has left many defense contractors wondering where to focus their compliance efforts. What hasn’t changed: self-assessment requirements, SPRS scoring, and annual affirmations remain fully in force. These aren’t optional activities you can postpone while waiting for policy clarity—they’re contractual obligations embedded in DFARS 7012 and foundational to maintaining your eligibility for DoW contracts.
We recently hosted a candid discussion with two experts who’ve guided organizations through countless assessments: Steven Molter, Lead GRC Consultant at IntelliGRC, and David Buchel, Compliance Assessment Consultant at C3. Their conversation cut through the complexity to reveal what really matters when preparing a strong self-assessment.
Executive Buy-In: The Foundation You Can’t Skip
The most technically perfect compliance program will fail without leadership support. This isn’t about getting permission to start. It’s about establishing compliance as a company-wide priority rather than an IT department responsibility.
“Everything rises and falls on leadership,” Steven noted. Without executive buy-in, organizations run into the same roadblocks:
- Inadequate funding for tools and staff
- Siloed information that can’t be easily traced
- Inability to implement controls that require process changes, not just technical configuration
Many executives initially view CMMC as a cost center. David offered a reframe that resonates with business leaders: “Do you pay your insurance premium every month, even though you don’t get anything tangible from it?” Compliance is insurance for continued DoW contracting eligibility, and increasingly a competitive differentiator. When you’re compliant and a competitor isn’t, you win contracts they can’t bid on.
Under DFARS 7024, the government is expected to weigh SPRS scores and self-assessment results in contract awards. Your organization may jeopardize qualifying for new awards or option year extensions without meeting these requirements.
Scoping: Following the Bouncing Ball
Proper scoping doesn’t start with inventorying IT assets. It starts with understanding where your Controlled Unclassified Information (CUI) actually goes. David’s analogy: “You’re just following the bouncing ball.”
That ball is your CUI. Every bounce raises the same questions:
- Who’s handling this information?
- What device are they using?
- What applications are processing it?
- Where is it being stored?
Keep following the bounces until the information reaches archival storage or gets destroyed. “Once you look at those bounces, what you’ve just created is your data flow diagram,” David explained. “Now you know where your CUI is going and who’s touching it.” This exercise often surfaces both your in-scope assets and the security gaps that need addressing.
32 CFR § 170.19 defines four asset categories based on their relationship to CUI: CUI assets, security protection assets, contractor risk managed assets, and out-of-scope components. You can’t categorize assets correctly without first mapping the data flow. Too many organizations start by cataloging every server and device, decide what’s “in scope,” then retrofit a data flow narrative to match. That’s backwards, and it produces incomplete or inaccurate scoping that causes problems throughout the assessment.
Between the bounces, you’ll also identify your security protection assets: the systems that don’t directly touch CUI but protect it. Mapping how information moves point to point reveals whether you have adequate encryption in transit, appropriate access controls at each stage, and proper logging throughout the lifecycle.
Evidence Collection: Understanding Adequacy and Sufficiency
Once scoping is done, evidence collection gets much more straightforward, but it hinges on two principles used to evaluate compliance:
- Adequacy: the right type of evidence that is relevant to the requirement at hand and to your system. Adequate evidence bridges your system and the requirement, showing the control is actually implemented in your environment.
- Sufficiency: enough of that adequate evidence to demonstrate implementation everywhere it needs to apply. A screenshot of a login banner is adequate but not sufficient since it only shows one device. An Intune configuration policy pushing that banner to all 27 in-scope devices with successful application status is both adequate and sufficient.
A few foundational evidence documents will carry you through most of the assessment process:
- Role-based access control matrix or RACI chart: addresses requirements across multiple control families, easily more than 20% of your assessment objectives
- Ticketing system: your system of record for change management, incident response, and periodic reviews, showing you’re actually performing documented procedures
- Network and data flow diagrams: the visual foundation of the assessment
- Endpoint management configuration policies: demonstrate both definition and enforcement of security controls
These documents act as the artifacts that tell the story of how security is embedded into your operational processes.
The Mistakes That Keep Happening
Even with proper scoping and evidence strategy, certain mistakes appear constantly. NIST 800-171 practice 3.1.1, the very first requirement (limiting system access to authorized users, processes, and devices), trips up more organizations than almost any other.
“You won’t believe how many times somebody will take a screenshot of Active Directory and say, these are my authorized users,” Steven shared. But that’s not the ask. It’s not about showing who’s in the system today. It’s about demonstrating what users should be in the system through a defined authorization process.
Before someone gets an account and identity in the system (a separate requirement, 3.5.1), someone needs to verify they should have access through HR onboarding, background checks, manager approvals, and provisioning tickets. Authorization precedes identification. Too many organizations conflate the technical implementation of identity management with the organizational process of authorization.
This points to a broader pattern: misreading what requirements actually mean. It’s important to watch out for the specific verbs used in CMMC, each of which signals a different type of evidence:
- Define: policies, plans, and procedures documenting how you do something
- Enforce: configuration evidence showing controls are technically implemented and can’t be bypassed
- Authorize / Approve: evidence that someone with appropriate authority made a decision
Recognizing these patterns turns intimidating requirements into answerable questions.
Another common mistake: attempting self-assessment without adequate expertise. You’re not expected to become a compliance expert overnight, but you do need help, whether that’s hiring internally, engaging consultants, or partnering with an MSP that understands CMMC.
The Path Forward
Self-assessment requirements haven’t disappeared during the policy pause. If anything, they’re now the primary mechanism for demonstrating compliance. SPRS scores stay visible to contracting officers and annual affirmations stay contractual.
- Start with executive buy-in and make compliance a company-wide initiative, not an IT project.
- Build a data flow diagram by following CUI through every bounce.
- Use that foundation to scope your environment and identify assets and gaps.
- Collect evidence that’s both adequate and sufficient, starting with your access control matrix and ticketing system.
- Get help. The most successful organizations acknowledge the complexity and build compliance programs that hold up regardless of policy changes ahead.
Ready to Get Started?
You can catch the full discussion by watching the webinar on demand here.
If you’d like to speak with a member of our team to learn how C3 can help you reach your compliance goals, schedule a consultation today.
Meet the Author
