Preparing for a CMMC Level 2 assessment when you already run SP 800-53

CMMC Level 2 is now being written into US defence contracts, and many contractors facing it already operate NIST SP 800-53 controls, for federal work, FedRAMP or simply as their control library. That is a strong starting point: every CMMC Level 2 practice traces to SP 800-53 through NIST's own mapping, as our Appendix D analysis shows.

Of the 110 CMMC practices, 109 (99%) map to something in 800-53, 0 are only loosely related and 1 have no mapping in our data. Open the gap report →

So the controls are mostly there. What isn't automatic is the scoping, the documentation and the assessment itself.

Step 1: scope the CUI environment

CMMC applies to the systems that process, store or transmit Controlled Unclassified Information, and the assets that protect them. Map where CUI enters, where it lives and who touches it. A tight, well-documented boundary (often an enclave) reduces the number of assets the assessor must examine. An 800-53 authorisation boundary for a federal system is rarely the same as your CUI boundary.

Step 2: write the System Security Plan for that boundary

The SSP (CA.L2-3.12.4) describes the boundary, the environment and how each of the 110 requirements is implemented. Reuse your 800-53 control descriptions, but rewrite them for the CUI environment and use CMMC's practice identifiers; assessors work practice by practice.

Step 3: check the Rev 2 wording

CMMC is pinned to SP 800-171 Revision 2. Where your 800-53 implementation is broader, it usually satisfies the practice; where Rev 2 is specific (FIPS-validated cryptography for CUI, session locks, specific audit content), check the detail.

Step 4: map evidence to assessment objectives

Assessors test each practice against assessment objectives, examining documents, interviewing people and testing mechanisms. For each practice, list the evidence you already produce for the matching 800-53 controls, and fill the holes. Our requirement pages show the 800-53 controls each practice comes from.

Step 5: self-assess honestly and score it

Run the DoD assessment methodology yourself first, and calculate the score. Fix what fails. Limited plans of action are allowed for some requirements but must be closed within 180 days, and some requirements can't be deferred at all.

Evidence assessors expect

For each practice, assessors look for three kinds of evidence: documents (policies, procedures, the SSP), interviews with the people who perform the practice, and tests or demonstrations of the mechanisms. Typical requests include:

• account lists and access approvals for CUI systems (AC.L2-3.1.1, 3.1.2);
• MFA configuration for privileged and network access (IA.L2-3.5.3);
• audit log configuration, retention and review records (AU.L2-3.3.1, 3.3.2);
• baseline configurations and change records (CM.L2-3.4.1 to 3.4.3);
• vulnerability scan results and remediation (RA.L2-3.11.2, 3.11.3);
• incident response plan and test records (IR.L2-3.6.1, 3.6.3);
• encryption settings showing FIPS-validated modules where CUI is protected (SC.L2-3.13.11).

Most of these already exist in an 800-53 environment; the work is collecting them for the CUI boundary and labelling them by practice. Each practice page, for example AC.L2-3.1.1, lists the 800-53 controls whose evidence can be reused.

Key takeaways

• An 800-53 baseline gives you most of CMMC Level 2's substance.
• The work is scoping CUI, writing the SSP and mapping evidence to each practice.
• Self-assess honestly against DoD's methodology before the real assessment.

Common pitfalls

• Scope creep: CUI spreading to email, file shares and laptops outside the enclave.
• Shared services: identity, logging and management tools that touch the CUI environment are in scope too.
• External service providers: cloud services that handle CUI must meet the appropriate federal requirements, typically FedRAMP Moderate or equivalent.
• Inheritance claims without evidence: if a control is inherited from a provider, keep their documentation.

The CMMC vs SP 800-53 comparison lists every practice with its source controls, and the gap analysis exports them as a tracker.

Questions

Who assesses CMMC Level 2?

Depending on the contract, either the contractor itself (self-assessment) or an authorised CMMC Third-Party Assessment Organization (C3PAO). Most contracts involving CUI require the third-party certification assessment.

What is a System Security Plan?

A document describing the system boundary, environment, and how each security requirement is implemented. It is required by SP 800-171 (CMMC practice CA.L2-3.12.4) and is the first thing assessors read.

Can a cloud provider's FedRAMP authorisation cover CMMC practices?

It can cover the practices the provider implements for you, as inherited controls, if the provider meets the required baseline and you keep its documentation. You remain responsible for your own configuration, users and data within the service.