What CMMC Assessors Look for in Cloud Environments

When preparing for your organization’s Cybersecurity Maturity Model Certification (CMMC) Level 2 assessment, it is important to remember that your cloud environment is likely where your Certified Third-Party Assessor Organization (C3PAO) will spend the most of their time.

This is because cloud environments are where the gaps most commonly live: from incomplete scoping, SSPs that don’t reflect the reality of an environment, to logging configurations that look right on paper but fail under live testing.

C3PAO assessors follow a structured, evidence-driven methodology and are trained to find the differences between what’s documented and what’s actually running. They do this by examining documentation, conducting interviews with control owners, and testing configurations in real time.

With Phase 2 enforcement beginning November 10, 2026 (and C3PAO slots already filling into 2027), the organizations that will see the best outcomes are those that know in advance exactly what assessors are looking for.

This article will prepare you by covering what assessors evaluate in cloud environments, and which domains organizations most frequently fall short in.

Why the Cloud Adds Complexity to CMMC Assessments

As of December 16, 2024, any Cloud Service Provider (CSP) that stores, processes, or transmits Controlled Unclassified Information (CUI) must meet FedRAMP Moderate authorization or its equivalent.

This was formalized under DFARS clause 252.204-7012, and has been officially integrated into DoD contracts via the CMMC final rule. The importance of this ruling is that it creates a compliance chain that assessors trace very carefully.

It is not solely enough for an organization to implement 110 NIST SP 800-171 controls. Rather, the cloud infrastructure that supports your CUI environment must independently meet these standards, and you must be able to prove that.

At a high level, assessors evaluate three things:

1. Whether your cloud environment is properly scoped
2. Whether security controls are implemented and documented
3. Whether evidence of continuous enforcement over time exists

1. Scoping: Knowing What's In and What's Out

A C3PAO assessor will begin their work by verifying the scope of your assessment.

When it comes to cloud environments, this means they will identify every system, service, or integration that processes, stores, or transmits CUI. In doing so, they will look to confirm that everything within this scope meets its applicable security requirements.

Specifically, assessors check for:

A documented CUI data flow analysis that shows where CUI enters, moves, and is stored
Evidence that cloud services handling CUI are either FedRAMP Moderate authorized or meet FedRAMP Moderate equivalency
Clear identification of CUI assets, security protection assets, and out-of-scope systems
A defined CUI enclave (or, a segmented, controlled environment where CUI is contained)

The most common reasons organizations struggle during assessments are because of scoping failures. CUI has a way of spreading across cloud platforms, collaboration tools, email systems, and shared drives, often beyond where teams think it lives.

Organizations that are best positioned to withstand this phase of the assessment are those that have implemented cloud-based CUI enclaves using platforms like Azure Government (GCC High) or AWS GovCloud, both of which are FedRAMP-authorized environments.

Defining a sound enterprise cloud architecture before the assessment begins is one of the most effective ways to contain scope and reduce the complexity of what assessors need to evaluate.

In the Azure Government environments we manage for defense contractors, CUI boundaries require ongoing governance. New services, integrations, and user roles regularly introduce scoping questions that require answers before they become assessment findings.

2. The System Security Plan (SSP): Your Most Important Document

The one document that can best determine the outcome of a CMMC Level 2 assessment is an organization’s System Security Plan (SSP).

Your SSP describes precisely how your organization implements each of the 110 NIST SP 800-171 controls, including what tools are in use, who owns each control, how CUI flows through your environment, and how your cloud and overall infrastructures fit in together.

Assessors use the SSP as their roadmap. They review it before the assessment begins, and use it throughout to verify that what is documented matches what they observe in practice.

In the SSP, assessors look for:

An accurate network and architecture diagram that depicts cloud services, data flows, and CUI boundaries
A control-by-control narrative that explains how each NIST SP 800-171 requirement is met
Documentation of any cloud service providers’ FedRAMP status or equivalency evidence
A Customer Responsibility Matrix (CRM) if the cloud provider is an External Service Provider (ESP)
An honest accounting of gaps, documented in a Plan of Action & Milestones (POA&M)

An SSP that doesn’t accurately reflect your real environment creates more problems than no SSP at all. Assessors do expect there to be gaps, but do not tolerate misrepresentation.

If your SSP describes controls that are not actually implemented, this is sure to surface during testing and interviews, and can result in a failed assessment or, in the case of federal contracts, exposure under the False Claims Act.

One of the most common issues we encounter when onboarding organizations that are preparing for Level 2 assessments is when an SSP was written to describe an aspirational environment, rather than the actual one.

Closing these gaps and honestly documenting them is almost always the highest-priority item in any readiness engagement we run.

3. Access Control and Identity Management in Cloud Environments

Access control is consistently one of the most evidence-intensive domains in any Level 2 assessment. Assessors want to see that access to CUI in cloud environments is controlled, logged, and enforceable, rather than just defined in policy.

Assessors typically verify that:

Multi-factor authentication (MFA) is enforced for all accounts with access to CUI
Role-based access controls (RBAC) limit exposure to only those who need it
Privileged access is separately managed and monitored
Inactive and terminated accounts are deactivated promptly
Remote access sessions are monitored and encrypted

Assessors evaluate this by testing in real time. They ask control owners to demonstrate their MFA enforcement, show access logs, and prove that unauthorized access attempts are blocked and logged.

Knowing and accounting for this is critical for organizations that have been treating identity and access management as a documentation exercise rather than an operational practice.

4. Audit Logging and Continuous Monitoring

The absence of complete, reliable audit logs is another frequently cited gap in CMMC assessments. Adherence to CMMC requires for logs to be collected, protected, reviewed, and retained in ways that support forensic investigation and ongoing compliance monitoring.

In assessments of cloud environments, this means that auditors will seek to verify that logging is enabled across all relevant services, in addition to servers and endpoints. Cloud platform activity logs, identity event logs, configuration change records, and access logs all fall within scope.

In this domain, assessors check that:

Audit logs are enabled across all in-scope cloud services and systems
Logs are stored securely and are tamper-proof
Log retention meets the required timeframes
There is a defined process for reviewing logs and responding to anomalies
SIEM or monitoring tools are in place and configured to generate alerts

Continuous monitoring is also increasingly a focus area for assessors evaluating CMMC maturity. Beyond passing the assessment, organizations must demonstrate that controls are being maintained and improved over time.

5. Incident Response: Having a Plan Is Not Enough

A documented incident response plan is a CMMC Level 2 requirement, but assessors go further than confirming that a document exists.

They evaluate whether your team knows the plan, if it covers cloud-specific scenarios, and whether it includes the mandatory reporting requirements listed under DFARS 252.204-7012.

Key elements assessors look for are:

A documented incident response plan that includes cloud-specific procedures
Evidence of tabletop exercises or incident response testing
Defined escalation paths, roles, and reporting responsibilities
Confirmation that the cloud provider supports cyber incident reporting under DFARS requirements

Incident response involves an additional layer of complexity in cloud environments. If a CUI breach occurs in a cloud service, the organization must be able to identify the scope of the incident, preserve forensic evidence, and report it to the DoD within 72 hours.

Assessors will verify that your incident response procedures follow these protocols and that your cloud provider’s agreements support forensic access.

6. Configuration Management and Vulnerability Remediation

Cloud environments are dynamic. Services are updated, configurations change, and new resources are spun up regularly. Assessors look to see whether your organization has a structured approach to managing that change, and whether security configurations are maintained in a known, documented state.

When it comes to security configurations, assessors check that:

A configuration baseline exists for all cloud resources in your scope
Changes to cloud configurations go through a change management process
Vulnerability scanning is performed regularly and gets documented
Critical vulnerabilities are remediated within clearly defined timeframes
Patch management procedures cover cloud-hosted operating systems and applications

For organizations that rely on manual processes for configuration management, it can be difficult to demonstrate the level of consistency assessors expect. Stronger evidence approaches for ongoing compliance include agent-based automation and configuration-as-code.

For clients running CUI workloads in Azure Government, we implement configuration baselines using Azure Policy and Defender for Cloud. These tools provide continuous drift detection and automated remediation, which generate audit-ready evidence trails that assessors expect to see.

The Assessor Capacity Challenge: Why Timing Matters

Organizations that are currently preparing for CMMC Level 2 assessments face a practical challenge that goes beyond the technicalities. Right now, there are fewer than 600 Certified CMMC Assessors who serve an estimated 80,000 contractors that require certification.

Furthermore, approximately 80 authorized C3PAOs are available, and many of them are already booked months in advance. Because of this, organizations that get in touch to book C3PAOs today are frequently being told that the earliest available slots are in Q1 or Q2 of 2027.

For contracts with award dates in late 2026, this timeline creates a direct eligibility risk. Phase 2 enforcement on November 10, 2026, makes C3PAO certification mandatory for new DoD contracts involving CUI. This means that SPRS profiles that don’t reflect a valid Level 2 certification will result in bids being rejected at source selection.

Before Your C3PAO Arrives: A Quick Self-Assessment

Ahead of scheduling your assessment, your organization should run the following tests:

Can your organization demonstrate the following?

A current CUI data flow diagram that accurately reflects your cloud environment, including all services that store, process, or transmit CUI
An SSP that describes your actual environment (not an aspirational one) with gaps documented honestly in a POA&M
FedRAMP Moderate authorization or documented equivalency for every cloud service in scope
MFA enforced across all accounts with CUI access, that are testable in real time
Centralized audit logs enabled across all in-scope cloud services, stored securely and retained per requirements
A configuration baseline for all cloud resources in scope, with change management and drift detection in place
An incident response plan that explicitly covers cloud-specific scenarios and DFARS 72-hour reporting

Addressing weaknesses in the specific areas where assessors consistently find gaps in cloud environments in advance of a C3PAO audit will save you effort in the long run.

Getting Assessment-Ready With the Right Partner

For organizations that handle CUI in cloud environments, CMMC assessment readiness is a technical, operational, and documentation challenge. It requires expertise in both cloud architecture and federal compliance frameworks, and it requires a considerable amount of time.

AISN brings direct experience in designing and managing CMMC-aligned cloud environments for defense contractors, government agencies, and regulated organizations. We cover everything from Azure Government deployments and multi-cloud architecture, to identity and access management, to ongoing compliance monitoring.

If your organization is preparing for a C3PAO assessment or beginning to scope your CMMC cloud environment, contact our team to start the conversation.