The on-site week is the visible part of the assessment, but the total engagement spans roughly 90 days from final pre-assessment activities through the formal report.
The on-site week (typical, small organization)
Per the Wrightbrained Assessment Preparation Master Guide:
| Day | Activity |
|---|---|
| Day 1 | Document review — SSP, network diagrams, asset inventory, policies and procedures, evidence catalog walkthrough. |
| Days 2-4 | Interviews and observations — assessor interviews with the CISO, IT administrator, end users, HR, and facilities; live demonstrations of MFA, audit log generation, account deactivation, patch deployment, etc. |
| Day 5 | Findings review — the assessor team consolidates determinations, conducts an exit briefing with the OSC, and identifies any clarifications still needed. |
The assessment team
Per the APREP master guide and the CAP v2.0, assessment teams typically include 2-4 assessors:
- A Lead Assessor who plans the assessment, leads team coordination, and is responsible for the final assessment report.
- One or more CMMC Certified Assessors (CCAs) who conduct the per-practice evaluations under the Lead Assessor's direction.
- Sometimes a CCP (CMMC Certified Professional) in a support role.
What extends the duration
- Larger asset count. More CUI Assets and SPAs to evaluate means more practice-by-practice work.
- Complex multi-site or multi-cloud architectures. Each distinct assessment scope component adds time.
- Poor evidence organization. If the assessor cannot find evidence for an objective, it becomes a finding or extends the day.
- Unprepared interview subjects. Re-interviews and follow-up sessions extend the week.
- Significant POA&M items. Assessor needs to verify each open item is documented correctly.
The wrapping timeline
The APREP master guide's pre-assessment timeline:
- 90 days before: Conduct self-assessment, identify gaps, begin remediation.
- 60 days before: Complete POA&M for known gaps, finalize SSP, conduct mock assessment.
- 30 days before: Evidence organization and labeling, staff preparation, logistics planning.
- Assessment week: The 3-5 day on-site engagement above.
- After assessment: Address findings, receive the formal report, submit final score to the CMMC system of record.
Common errors
- Treating the on-site week as the whole engagement. Pre-assessment and post-assessment work routinely take longer than the on-site week.
- Booking the assessor at the last possible date for a contract deadline. No buffer for findings, no buffer for scheduling slips, no buffer for POA&M closeout.
- Skipping the mock assessment 60 days out. The mock surfaces evidence gaps, interview gaps, and scope gaps when there's still time to fix them.
Sources
Prepare for the on-site assessment week.
The CMMC Compliance Engine includes the APREP-MASTER-01_Assessment_Preparation_Master_Guide plus the 14 domain-specific APREP guides (APREP-AC-01 through APREP-SI-01) covering document review, interviews, and observations.
Get the CMMC Compliance Engine