Last reviewed October 13, 2026.
A CMMC gap assessment is a control-by-control review of your environment against the requirements you must meet, most often the 110 requirements of NIST SP 800-171 Rev. 2 for CMMC Level 2. It is a baseline, not an audit. Its job is to show where you stand, give you an honest score and put the remediation work in order.
What a gap assessment covers
- Scoping. Identifying where CUI is stored, processed and transmitted, and defining the boundary of systems, people and facilities in scope.
- Documentation review. Reading the existing policies, procedures, system security plan and any plans of action.
- Control verification. Interviewing staff, examining configurations and testing that each control works, measured against the objectives in NIST SP 800-171A.
- Scoring. Applying the DoD Assessment Methodology to produce a defensible SPRS score.
What you should receive
- A requirement-by-requirement report showing met and not met, with the evidence behind each call.
- Your score and an explanation of how it was calculated.
- A prioritized remediation roadmap that puts high-weight items first.
- A draft or update of the system security plan and a plan of action and milestones that follows the rules for what can be deferred.
When you need one
- You have a contract with DFARS 252.204-7012 and have not tested your own implementation.
- You are preparing to post, update or defend an SPRS score.
- A prime contractor or customer has asked about your compliance status.
- You plan to pursue a certification assessment and want to find problems before an assessor does.
- Your environment has changed significantly, through a cloud migration, an acquisition or a new CUI workflow.
Gap assessment, readiness review and certification are different
A gap assessment and a readiness review are advisory. A certification assessment is a formal event performed by a Certified Third-Party Assessor Organization (C3PAO), and it determines the status you hold. Third-party certification as a condition of award is currently suspended, as described in our Phase 2 update, but the NIST SP 800-171 requirements are not, so the baseline work is still worth doing.
How to choose a provider
- Ask how they score. A provider should assess against the objectives in NIST SP 800-171A, not a short checklist.
- Ask for a sample deliverable. You should see evidence for each finding, not only a list of gaps.
- Check their own certifications. A firm that advises on compliance should meet the standards it recommends, with independently audited credentials.
- Ask what happens next. A report is only the start. Look for help with remediation, documentation and ongoing monitoring.
- Understand what drives the price. Scope, meaning the number of systems and locations in the boundary, and the complexity of your environment matter more than company size alone.
Cyberix holds ISO/IEC 27001 and SOC 2 Type II and has implemented the CMMC Level 2 requirements itself. Our CMMC and NIST SP 800-171 compliance services begin with a gap assessment and carry through remediation, documentation and monitoring. For the full list of what is being assessed, see our NIST SP 800-171 checklist and our guide to CMMC Level 2 requirements.
What a good report looks like
- An executive summary with your score and the three or four findings that matter most.
- A diagram of the CUI boundary and the systems inside it.
- A requirement-by-requirement table showing the objective, the finding and the evidence.
- A remediation roadmap ordered by point value, risk and effort.
- A draft system security plan and POA&M you can maintain after the engagement.
Prepare your people, not only your documents
Assessors interview the people who run the controls. Your IT lead, security officer, HR and facilities contacts, and an executive sponsor should each be able to explain how the controls work in practice and where the evidence lives. A gap assessment is the best time to find out who can and cannot.
Gap assessment, self-assessment and certification assessment
- Gap assessment: advisory, designed to find problems. Its result is a roadmap.
- Self-assessment: your own scoring against the requirements, posted to SPRS. It carries legal weight, so it should rest on the evidence a gap assessment produces.
- Certification assessment: a formal evaluation by a C3PAO that results in a status of record.
Talk to a Cyberix compliance expert about your NIST SP 800-171 and CMMC readiness.
Frequently Asked Questions
What is a CMMC gap assessment?
A control-by-control review of your environment against the requirements for your target CMMC level, usually the 110 requirements of NIST SP 800-171 for Level 2. It produces a score, a list of gaps and a remediation plan.
Is a gap assessment the same as a CMMC certification?
No. A gap assessment is advisory. A certification assessment is a formal evaluation by a C3PAO and results in a status of record.
How long does a gap assessment take?
It depends on the size of the environment and the number of systems and locations in scope. Smaller, well-bounded environments take less time than large, complex ones.
Do I need a gap assessment now that Phase 2 is suspended?
The NIST SP 800-171 requirements under DFARS 252.204-7012 and the self-assessment scoring requirements still apply. A gap assessment gives you an accurate score and a plan, which protects you if the program resumes.
What should I prepare before a gap assessment?
Your network diagrams, a list of systems that handle CUI, existing policies and procedures, and your current system security plan, if you have one.
This article is general information, not legal advice. Confirm which clauses apply to your contracts with qualified counsel or your contracting officer.
For a quick self-estimate before an assessment, try the free SPRS score calculator.