CMMC Evidence: What Assessors Want to See

You’ve implemented security controls. You’ve written your System Security Plan. Added your CMMC evidence. Now comes the moment of truth: proving to an assessor that everything you’ve documented actually exists in your environment. For many defense contractors, evidence collection is where CMMC preparation gets real—and where many organizations stumble.

Understanding what assessors want to see isn’t about gaming the system. It’s about demonstrating, clearly and completely, that your organization genuinely protects Controlled Unclassified Information (CUI) the way you claim. This guide breaks down what counts as valid evidence, how to organize it, and the common pitfalls that trip up even well-prepared contractors.

Why Evidence Matters in CMMC Assessments

The Cybersecurity Maturity Model Certification (CMMC) exists because the Department of Defense (DoD) got tired of contractors claiming compliance without proof. For years, defense contractors self-attested to meeting security requirements under Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012. Many organizations checked boxes on paper while their actual security implementations told a different story.

CMMC changes this dynamic by requiring verification. At Level 2, a CMMC Third-Party Assessment Organization (C3PAO) will examine your environment, interview your personnel, and review your evidence to confirm that you’ve actually implemented the 110 security requirements in National Institute of Standards and Technology (NIST) Special Publication 800-171.

Your evidence serves as the bridge between documentation and reality. Your System Security Plan (SSP) describes what you do. Your evidence proves you actually do it.

The Three Types of Assessment Evidence

CMMC assessors evaluate your compliance using three methods defined in NIST Special Publication 800-171A: examine, interview, and test. Understanding these methods helps you prepare the right types of evidence.

Examine

Examination involves reviewing documents, configurations, and records. This is where your written policies, system configurations, log files, and other artifacts come into play. Assessors will examine evidence to verify that your documented procedures align with security requirements and that your systems are configured as described.

Examples of examination evidence include written policies and procedures, system configuration screenshots, network diagrams, access control lists, audit log samples, and training completion records.

Interview

Interviews allow assessors to verify that personnel understand and follow security procedures. Assessors will speak with people across your organization—not just IT staff—to confirm that security practices are understood and consistently applied.

You can’t hand an assessor a document for this one. Instead, you prepare by ensuring your team genuinely understands your security program. If your policy says employees must report security incidents within 24 hours, your employees should be able to explain that process without consulting a manual.

Test

Testing involves assessors actively verifying that controls function as intended. They might attempt to access a system without proper credentials, verify that audit logs capture specific events, or confirm that vulnerability scans run on schedule.

Evidence for testing often overlaps with examination evidence—configuration files, log outputs, scan results—but the assessor verifies functionality rather than just reviewing documentation.

What Good Evidence Looks Like

Not all evidence is created equal. Assessors can quickly distinguish between evidence that demonstrates genuine compliance and evidence that’s been hastily assembled to check a box.

Specific and Dated

Good evidence is specific to your environment and includes timestamps or version information. A screenshot of your password policy configuration is more compelling than a generic policy document. A vulnerability scan report dated last Tuesday proves ongoing practice; an undated document proves nothing about current operations.

When collecting evidence, include dates wherever possible. For configurations, capture when the screenshot was taken. For policies, include version numbers and approval dates. For logs and reports, ensure timestamps are visible.

Complete and Contextual

Evidence should tell a complete story. A screenshot of an access control list means little without context explaining what system it’s from and what it demonstrates. A training completion report should identify the training topic, who completed it, and when.

Consider adding brief annotations to evidence artifacts explaining what they demonstrate. This isn’t about spinning the evidence—it’s about helping assessors quickly understand what they’re looking at.

Authentic and Verifiable

Assessors are trained to spot fabricated or manipulated evidence. They’ll cross-reference documents, compare configurations across systems, and ask probing questions during interviews. Evidence that contradicts other evidence or doesn’t match what they observe in your environment raises serious red flags.

The best approach is simple honesty. Present your actual configurations, real logs, and genuine practices. If something isn’t fully implemented, document it in your Plan of Action and Milestones (POA&M) rather than faking evidence.

Evidence by Security Domain

NIST SP 800-171 organizes its 110 security requirements into 14 families. Here’s what assessors typically want to see for each domain:

Access Control

Assessors want evidence that you limit system access to authorized users and control what those users can do. Prepare access control policies, user account listings with role assignments, privilege access documentation, session timeout configurations, and remote access procedures. Screenshots of Active Directory group policies, identity management dashboards, and VPN configurations often prove valuable here.

Awareness and Training

Prove that your workforce understands their security responsibilities. Training completion records, training materials, acknowledgment forms for acceptable use policies, and records of role-based training for privileged users demonstrate compliance. Keep records showing who completed what training and when.

Audit and Accountability

Show that you track and review system activity. Provide audit policy configurations, sample audit logs demonstrating required events are captured, log retention evidence, audit review procedures, and records showing regular log reviews actually occur. Assessors often want to see that audit logs are protected from tampering and that someone actually looks at them.

Configuration Management

Demonstrate that you control and document system configurations. Baseline configuration documents, change management procedures, change request records, configuration monitoring evidence, and software installation restrictions all matter here. Network diagrams and hardware/software inventories support this domain as well.

Identification and Authentication

Prove that users and devices are properly identified before gaining access. Evidence includes password policy configurations, multi-factor authentication (MFA) settings, account lockout configurations, and procedures for managing authenticators. Screenshots showing MFA enforcement and password complexity requirements configured in your systems make strong evidence.

Incident Response

Show that you’re prepared to detect, report, and respond to security incidents. Incident response plans, evidence of incident response testing or exercises, actual incident reports (redacted if necessary), and incident tracking logs demonstrate capability. If you’ve had security incidents, documentation showing how you handled them—following your procedures—provides powerful evidence.

Maintenance

Demonstrate controlled system maintenance practices. Maintenance policies, records of maintenance activities, evidence of controlled maintenance tools, and procedures for remote maintenance sessions support this domain. If vendors perform maintenance remotely, show how you supervise and control those sessions.

Media Protection

Prove you control removable media and protect information on storage devices. Media policies, evidence of media sanitization procedures, encryption configurations for portable storage, and media tracking logs matter here. If you prohibit removable media, show how that prohibition is technically enforced, not just written in policy.

Personnel Security

Show that you screen personnel and manage access when employment ends. Background check procedures, personnel screening records, termination checklists, and evidence of timely access revocation when employees leave demonstrate compliance. Transfer procedures showing access adjustments when personnel change roles also apply.

Physical Protection

Demonstrate that you control physical access to systems. Physical access policies, visitor logs, badge access records, and evidence of physical access controls like badge readers or locked server rooms support this domain. If CUI exists in physical form, document how you protect those physical assets.

Risk Assessment

Prove that you regularly assess and address security risks. Risk assessment procedures, completed risk assessments, vulnerability scan results, and evidence of risk remediation activities demonstrate ongoing risk management. Regular vulnerability scanning reports with evidence of remediation actions show this isn’t a one-time exercise.

Security Assessment

Show that you periodically evaluate your security controls. Assessment plans, assessment reports, and evidence of remediation following assessments demonstrate continuous improvement. This connects directly to your POA&M and shows you’re actively managing your security posture.

System and Communications Protection

Demonstrate network and communications security. Network architecture diagrams showing boundary protections, firewall configurations, encryption settings, and evidence of network segmentation support this domain. If you use cryptography, document what algorithms and key lengths you’ve implemented.

System and Information Integrity

Prove you identify and correct system flaws, monitor for threats, and protect against malicious code. Patch management procedures and evidence of timely patching, malware protection configurations, intrusion detection evidence, and security alert handling procedures all apply. Show that you actually apply patches promptly and respond to security alerts.

Organizing Your Evidence

A well-organized evidence package saves time during assessment and demonstrates organizational maturity. Consider these approaches:

Map Evidence to Requirements

Create a matrix linking each NIST SP 800-171 requirement to the specific evidence artifacts that demonstrate compliance. This traceability helps assessors quickly find what they need and helps you identify gaps before the assessment.

Use Consistent Naming Conventions

Name files clearly and consistently. “AC-3.1_AccessControlList_FileServer_2024-11-15.png” tells assessors exactly what they’re looking at. “Screenshot4.png” does not.

Maintain a Central Repository

Store evidence in a secure, organized location that assessors can access during the assessment. Whether you use a shared drive, a governance risk and compliance (GRC) platform, or a dedicated evidence management system, ensure everything is easy to navigate.

Keep Evidence Current

Evidence has a shelf life. A vulnerability scan from six months ago doesn’t prove your current practices. Establish procedures to refresh evidence regularly, particularly for operational activities like log reviews, vulnerability scanning, and access reviews.

Common Evidence Mistakes

Policies without implementation evidence. Written policies are necessary but not sufficient. Assessors want proof that policies are implemented and followed. A password policy document doesn’t demonstrate compliance—password configuration screenshots combined with the policy do.

Generic evidence that isn’t organization-specific. Screenshots from vendor documentation or generic templates don’t prove your implementation. Every piece of evidence should clearly relate to your specific environment.

Missing dates and context. Undated evidence doesn’t demonstrate current compliance. Always include timestamps and explanations of what evidence demonstrates.

Inconsistent evidence. If your SSP says you review logs weekly but your evidence shows monthly reviews, you have a problem. Ensure evidence aligns with your documentation.

Last-minute evidence collection. Rushing to collect evidence before an assessment often produces incomplete or inconsistent artifacts. Build evidence collection into your ongoing operations so you’re always assessment-ready.

Building an Evidence-Ready Culture

The best approach to evidence is treating it as a byproduct of good security operations, not a separate compliance activity. When your organization genuinely implements security controls as part of daily operations, evidence naturally accumulates.

Train your team to document security activities consistently. When someone reviews access logs, they should record that review. When someone approves a change request, that approval should be captured. When someone completes security training, completion should be tracked.

This approach transforms evidence collection from a painful assessment preparation exercise into a natural output of your security program. When assessment time comes, you’re gathering existing records rather than scrambling to create them.

---

Need Help Preparing Your CMMC Evidence?

Getting your evidence organized and assessment-ready takes time and expertise that many defense contractors don’t have to spare. At Greypike, a veteran-owned company, we help government contractors navigate the complexities of CMMC compliance—from understanding what assessors expect to organizing evidence that demonstrates genuine security maturity. If you have questions about evidence requirements or need support preparing for your assessment, reach out to our team. We’re here to help you succeed.

---

Sources

1. CMMC Program Final Rule – Department of Defense CMMC program requirements and assessment procedures
   https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-A/part-170
2. NIST Special Publication 800-171 Revision 2 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
   https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final
3. NIST Special Publication 800-171A – Assessing Security Requirements for Controlled Unclassified Information
   https://csrc.nist.gov/publications/detail/sp/800-171a/final
4. CMMC Model Overview – Cybersecurity Maturity Model Certification official documentation
   https://dodcio.defense.gov/CMMC/
5. DFARS Clause 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting
   https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
6. CUI Registry – National Archives guidance on Controlled Unclassified Information categories and handling
   https://www.archives.gov/cui