The Most Overlooked Requirements in a Full CMMC Certification Assessment
Securing a Department of Defense contract isn’t just about checking boxes—it’s about knowing what really matters inside a full CMMC Certification Assessment. There are deeper, less obvious pieces that make or break compliance, and they’re often buried beneath the obvious checklist items. These overlooked details can derail a CMMC Level 2 Certification Assessment if not handled properly.
Incomplete System Security Plan (SSP) Mappings
An SSP that’s missing mappings is like a puzzle with missing pieces. Many organizations complete their System Security Plan in broad strokes, but don’t explicitly map controls to operational evidence. A CMMC assessor wants to see proof that what’s written on paper matches the practices actually in place. Without this, the assessment doesn’t hold water.
During a full CMMC Level 2 Assessment, it becomes clear that SSPs lacking traceable references to control implementation can’t justify compliance. Simply saying a control is “in place” isn’t enough. Your SSP must directly point to where, how, and by whom those controls are applied—whether in policies, tickets, or technical systems. A CMMC consulting expert would always ensure that this alignment is solid, detailed, and ready for scrutiny.
Unaddressed AC-17 Remote Access Controls
Remote access is a big vulnerability target—and AC-17 is one of the most underestimated control sets. Many organizations either assume their VPN setup covers it or think MFA is enough. But AC-17 has a broader scope: it demands session controls, auditing, and restrictions on non-organization-controlled devices.
For a CMMC Certification Assessment, an assessor will dig into how remote access is actually governed in real-time. Are inactive sessions timed out? Are there role-based restrictions? Is remote access traffic monitored continuously? Overlooking these requirements—or misinterpreting them—can quickly lead to a control failure, especially if remote access is central to the organization’s work model.
Neglected CM-6 Configuration Monitoring Mechanisms
Configuration management isn’t just about locking down settings—it’s about watching for change. CM-6 expects that any alterations to baseline configurations are tracked, reviewed, and validated. Many companies overlook the “monitoring” aspect, assuming that setting the baseline is sufficient.
During a CMMC Level 2 Assessment, evidence of continuous review and logging is key. If a configuration changes—especially in cloud systems—there needs to be a process that catches it and evaluates the risk. A CMMC assessment guide would emphasize the use of automated tools for configuration drift and clear documentation of the remediation process. This is where many otherwise mature security environments stumble.
Missing SC-7 Boundary Defense Implementations
Defending the perimeter isn’t just a firewall game anymore. SC-7 looks at how traffic is routed, filtered, and segmented to prevent unauthorized access. Many defense contractors rely solely on standard firewall rules without properly segmenting networks or inspecting outbound communications.
In a CMMC consulting review, the assessor wants to see detailed, layered controls—things like network zoning, intrusion prevention systems, and traffic analytics. Without these, it’s hard to prove boundary defense is functioning as intended. If an organization doesn’t actively manage and test these boundaries, they’re leaving gaps that SC-7 is meant to close.
Overlooked SI-4 Malicious Code Protection Measures
SI-4 goes beyond antivirus. It calls for detecting, identifying, and responding to malicious activity in real time. Yet many companies stick with basic endpoint protection and call it done. The expectation for a CMMC Level 2 Certification Assessment is higher—there should be behavior-based detection, threat intel feeds, and automatic containment protocols.
Ignoring these capabilities—or lacking alerting and logging on attempted threats—can cost you in an assessment. A mature approach under SI-4 also includes incident simulation and response practice. If your system doesn’t show it can recognize modern malware techniques, that control’s going to be flagged fast.
Unverified RA-5 Vulnerability Scanning Schedules
Scanning is one thing. Sticking to a defined, consistent schedule—and proving it—is another. RA-5 expects not only routine vulnerability scans, but a structured plan outlining when scans happen, how results are handled, and who signs off on remediation.
Assessors reviewing a CMMC assessment guide want proof that scans run on time and that critical findings are followed up within specific timeframes. Ad hoc or reactive scanning doesn’t meet the intent. What trips organizations up most is missing historical scan logs, no documentation of issue remediation, or lacking evidence that findings lead to configuration updates.
Ignored MP-6 Media Sanitization Protocols
MP-6 is easy to forget—until someone loses a USB drive. Sanitization isn’t just about deleting files; it’s about securely erasing or destroying storage so data can’t be recovered. This control often gets overlooked, especially when organizations think encryption is a substitute for sanitization.
In a CMMC Level 2 Assessment, assessors want to know if there’s a written process for destroying old hard drives, wiping cloud-based storage, and logging sanitization actions. Without that, media reuse becomes a data breach risk. A proper CMMC Certification Assessment will require not just procedures—but proof they’re carried out, whether through destruction logs or sanitized asset disposal records.