# Defense Contractors Flag CMMC Assessment Gaps

A reported CMMC Level 2 engagement passed despite discrepancies between the System Security Plan (SSP) and collected evidence, weak documentation, and concerns that cloud service providers storing CUI lacked FedRAMP Moderate authorization or an equivalent basis. The account also raises concerns about assessor technical capability and incentives, but does not establish that assessment rules were violated. Practitioners distinguish a findings-only mock assessment from consulting that includes remediation advice, noting that the same C3PAO may conduct both under that distinction.

- Contractors should keep SSPs aligned with actual system configurations and maintain evidence that demonstrates controls are implemented, not just documented in policy.
- For CUI hosted by cloud service providers, verify and document the provider’s FedRAMP Moderate authorization or other applicable basis; the reported client declined to address this concern.
- Organizations can treat findings and remediation after an assessment as continuing compliance work, while distinguishing mock assessments that provide findings only from consulting that advises on remediation.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 02, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- Defense Industrial Base Cybersecurity Assessment Center (DIBCAC)

### Vendors
- Kailash Consult ()

### Key Quotes
> There were a lot of instances where our client submitted written policy as evidence and the auditors accepted it as it meeting the control. For example, they had a policy stating that computers lock out after 15 minutes of inactivity, but didn't take a screenshot of the enforcement in Intune. The auditors just took their word for it.
> — Original poster

> I’ve been through nearly 50 assessments with customers and never failed, no matter how bad the environment was that I was brought into help the customer represent. Most assessors I sat with would literally let you fix the controls and the SSP during the assessment.
> — Commenter (self-described as having supported nearly 50 assessments)

> A mock assessment is fine as long as no consulting is done. The result of the mock is met/not met for each objective and that's it.
> — Commenter

### Sources
- [My first audit experience was completely unserious and its left a terrible impression of this space](https://www.reddit.com/r/CMMC/comments/1xm5qda/my_first_audit_experience_was_completely) - reddit-cmmc