🕸️ Ada Research Browser

lessons-learned.md
Home›Research Reports›lessons-learned.md
← Back

Lessons Learned: CMMC Level 2 Assessments

Compiled from firsthand accounts on r/CMMC, 2025-2026. Every entry has a source. Prioritized: firsthand accounts > community consensus > speculation.

What WORKED

1. Front-Load Evidence Collection

2. Separate Policy Docs Per Domain (Not One Big Doc)

3. Know Your Scope / CUI Flow First

4. Leverage Microsoft Inheritance (GCC High)

5. Documentation is 70% of the Work

6. Prepare Your People, Not Just Your Systems

7. Get Mock Assessment From Your C3PAO (Not Consultant)

8. Enclave Strategy Works Well for Small Orgs

9. PreVeil as CUI Container

10. SSP in Word Works Fine

New Lessons (2026-03-14)

6. RMM Tools Can pass as SPA (if locked down properly)

7. C3PAO Lead Times are Book early

8. Solo IT Can do this - get help

9. Change Management Needs Software Review Checklists

1. Google Workspace (Commercial) for CUI Environments

2. AWS Workspaces VDI for CUI

3. Cheap Consultants

4. No Leadership Buy-In

5. Not Knowing Your Firewall Posture Before the Audit

6. Delaying Documentation to Focus on Technical

7. Putting Everything In Scope

Assessment Timeline & Cost

Timeline Reality

Cost Ranges (2025-2026 market)

Org Size Architecture Total Cost Range Notes
<10 users Cloud (GCC H or PreVeil enclave) $20K–$40K Includes C3PAO + implementation
~20-30 users Cloud $30K–$50K Competitive market rate
20-30 users Cloud + consulting only $45K–$80K Consulting, no implementation
SMB any size Self-managed + consultant $20K–$30K + $500-1K/mo maintenance
Enterprise hybrid 500+ endpoints $100K+ Complex environments

Sources: r/CMMC multiple threads (2025-2026)

Assessor Behavior Observations

New Lessons (2026-03-12)

"We Passed" Post #4 — 40-person DC Company (Kieri Solutions, 2026-03)

Source: https://old.reddit.com/r/CMMC/comments/1rpitjk/ (76 upvotes)

Vendor red flags confirmed (again): - Hired unnamed CMMC vendor for GCC High migration; vendor never verified their own hardening work — controls were not implemented. VP of Engineering had to spend months fixing in Intune. - Same vendor also missed entire Google Shared Drives in the SharePoint migration. - Lesson: audit your vendor's output, not just their deliverables. Don't assume "we paid for it" = "it works."

Baseline documentation: - One week to build baseline document properly. Separate sections per device type (PC models, iPhones, Macs, OS minimums). Windows 11 25H2 as floor. - "Specifying that all devices must be enrolled and compliant with clearly defined compliance criteria does a lot of the heavy lifting." - Used Claude AI + PowerShell output to structure the baseline document faster than starting from scratch.

SSP implementation statements as work instructions: - "If your controls are written well enough, they describe the how, not just the what." Well-written implementation statements can satisfy the work instruction requirement.

Physical assessment detail: - Kieri came on-site. ~2-hour visit. Had a dedicated printer locked in a server rack for CUI printing. - Another commenter: Redspin will do on-site visit if you have physical CUI and allow printing.

Evidence tools this org used: - SnipeIT for asset management (assessors could see records) - JIRA Service Desk for IT tickets (had to retrain staff to use it) - MS Intune + Conditional Access (no VPN to tenant) - Sentinel with custom KQL queries (AI-assisted) - macOS: macOS Security Compliance Project + Jamf Compliance Editor for Mac baselines

Appendix J access (GCC High): - Not publicly downloadable — must email Microsoft: - O365 GCC High: O365FedRAMP@microsoft.com - Azure Government: AzFedDoc@microsoft.com - Source: https://techcommunity.microsoft.com/blog/publicsectorblog/support-for-fedramp-in-microsoft-365-government-gcc-high/4112262

First-submission pass rate: - Community reporting first-submission pass rate may be under 30% across C3PAOs - Source: https://old.reddit.com/r/CMMC/comments/1rnu0yr/ (7 upvotes)

MSP W-2 requirement claim = FALSE: - An MSP told a client their ISSM must be a W-2 employee for CMMC compliance. Community consensus: false, no such requirement exists in NIST 800-171 or CMMC regulations. - MSPs can provide third-party monitoring via contractual relationship. W-2 is an upsell tactic. - Source: https://old.reddit.com/r/CMMC/comments/1rmq8is/

CMMC certification as new business generator: - Community thread: Most companies say CMMC L2 is primarily a requirement to keep existing DoD business, NOT an opener of new doors. Very few report unsolicited new contracts from certification alone. - Source: https://old.reddit.com/r/CMMC/comments/1rml8gj/

ISACA exam transition (BREAKING as of 2026-03-12): - ISACA taking over CCA/CCP exams on April 1st; PSI will administer - Measure Learning cancelled some exam slots ahead of schedule - CCP holders must pay $100 delta exam fee to get CCP badge on CyberAB - Source: https://old.reddit.com/r/CMMC/comments/1rmxurd/

New Lessons (2026-03-13)

C3PAO Lead Times (March 2026)

Source: https://old.reddit.com/r/CMMC/comments/1rrp19k/

Current scheduling reality: - 8-12 weeks is most common across C3PAOs - Some "better firms" at 90-120 days - Anecdotally: many booking into early summer 2026 - One C3PAO rep (FJminer): "8-12 weeks seems most common, some are out even further" - Community advice: "Ask their audit schedule/duration for your proposed assessment. Last thing you want is a 1-week audit crammed through with lots of findings."

Implication: As Phase 2 (Nov 10, 2026) approaches, expect lead times to grow. Book early.

Level 1 MSP Misinformation

Source: https://old.reddit.com/r/CMMC/comments/1rrtptn/

The claim: MSP told subcontractor that L1 requires all 110 controls (but "just self-attestation").

Reality: - L1 = 15 controls ONLY - MSP was either incompetent or trying to upsell - Official source: DoD CMMC Assessment Guide L1 v2 — https://dodcio.defense.gov/Portals/0/Documents/CMMC/AssessmentGuideL1v2.pdf - If MSP is confused about L1, their L2 support may be questionable

Community tools for L1: - Project Spectrum cyber-readiness check: https://www.projectspectrum.io/#/cyber-readiness-check - CMMC CAP v2.13 Level 1 (official)

"CMMC is an Organizational Problem Disguised as an IT Problem"

Source: https://old.reddit.com/r/CMMC/comments/1rqbl58/ (18 up, 32 comments)

Context: Solo IT person at 220-employee construction company, 30-50% DoD work, -23 SPRS score.

Key community insights: - "I describe CMMC as an organizational problem disguised as an IT problem" (HSVTigger, 25 up) - "Not to mimic the other responses but what they're saying is the truth. First and foremost CMMC really isn't an IT problem, and putting the entire brunt of the effort on IT can often do more harm than good without proper buy-in from leadership." (DarthCooey, mod, 18 up) - Construction specifics: If drawings are marked CUI, the organization has to track how drawings flow through the entire org — including every trade subcontractor

Cost estimate from thread: - "Expect to spend $100k per 100 employees-ish" (Reasonable_Rich4500, 7 up) - For 220 employees: roughly $200-250k total

Solo IT survival tips: - Get exec support immediately — CFO, FSO, HR, Head of Operations all need to be involved - Offload to MSP/consultant; don't try to do it all while running helpdesk - Consider GRC platform if forced to do it yourself - Build enclave for 80 CUI-touching employees, not all 220

Cross-Tenant Collaboration (GCC High ↔ Commercial)

Source: https://old.reddit.com/r/CMMC/comments/1rr2t5w/

Question: How do enclave users (GCC High) collaborate with non-enclave users (commercial)?

Answers: - Cross-tenant collaboration IS supported between GCC High and commercial tenants (inbound + outbound guest access) - Don't need both PreVeil AND GCC High — pick one architecture - Two-tenant "sovereign ground" approach is viable but requires documentation - Get CRM from Microsoft for both commercial and government tenants; understand what's inherited vs. your responsibility

Most Commonly Flagged Controls / Pain Points

From community discussion:

Source: r/CMMC thread titles and comments, Jan-Mar 2026