CMMC Assessment Software · NIST SP 800-171

The CMMC assessment platform for C3PAOs and assessment firms

Audora runs your CMMC mock assessments and certification assessments as engagements: scoping, evidence requests, assessment work against each requirement, review, and reporting. Built by auditors, for the assessor’s side of the table, on a platform architected to the same NIST SP 800-171 requirements you assess.

The Audit Process Benchmark: three calls or fewer, with a free sandbox to run a real CMMC assessment in Audora.

For audit firms

You built a CMMC assessment process that works. Audora keeps it from depending on who’s in the room.

Most assessment firms we talk to run CMMC on a process they’ve refined requirement by requirement: objective worksheets for 110 requirements and their 320 assessment objectives, an evidence tracker, an assessment plan, a report template, and a few assessors who know how it all fits together. It works. It also lives in spreadsheets, inboxes, and people’s heads, so it strains as the team grows and breaks when someone leaves. Audora puts that process in one place, so you keep the method and stop paying the manual tax of holding it together.

Audora is the audit management software built for the auditor’s side: one platform that runs your whole engagement and connects the tools your firm already uses.

Two assessors working through an engagement together

How Audora runs your CMMC assessment

One path from scoping to the final report, with every request, finding, and approval in the same file.

1

Scope and plan

  • Guided engagement setup loads your firm’s defaults and templates.
  • Set up a mock assessment or a certification assessment on your own templates.
2

Request evidence

  • Send PBC requests, approve evidence in bulk, and take drag-and-drop uploads from the client.
  • Track every open request in one place, instead of an email thread per requirement.
3

Assess

  • Document assessment work against each NIST SP 800-171 requirement and its assessment objectives.
  • Staff self-claim open work from the Task Queue, and bulk-edit details in the Walkthrough tab.
4

Review

  • Multi-step approvals with a full audit trail on every request, finding, and sign-off.
  • Give your quality reviewer their own role, and name roles to match your CMMC process.
5

Report and sign

  • Edit the .docx report inside Audora with two-way sync to the engagement.
  • Collect e-signatures without leaving the file.

Mock and certification assessments

Run a mock assessment to surface gaps before the real one, then run the certification assessment in the same system.

The work around the engagement

A practice dashboard that flags engagements at risk, with HubSpot and Slack connected, so client and team updates don’t live in a side process.

AI on a process built first

Audora AI drafts walkthrough interview fields from your transcripts. Audora drafts, you keep the judgment.

Security

Assessment data held to the standard you assess

CMMC assessment evidence can include information your clients are contractually bound to protect. Audora’s architecture is built to the NIST SP 800-171 requirements behind CMMC Level 2, and CMMC assessment data gets protection beyond the rest of the platform.

  • A second, database-enforced layer of isolation for CMMC assessment data, so even privileged internal roles can’t read it
  • FIPS-validated encryption in transit and at rest, with customer-managed keys
  • CMMC assessment evidence kept under a 180-day retention-and-purge lifecycle
  • MFA you can enforce across your firm, including with SSO

Consistency

One method on every CMMC assessment, whoever leads it

Your firm’s reading of the assessment guide, your objective worksheets and report templates, and the review points your quality reviewers keep raising go into the engagement template. Every assessor works the same way, review comes back with one answer instead of one per partner, and what your firm knows stays when people move on.

  • Standard worksheets and workpapers across every assessment
  • Review-ready files, with every request, finding, and approval on the audit trail
  • Faster and more consistent at once: automation runs every engagement the same defensible way

Partners and owners

Run more concurrent CMMC assessments with the same team, with engagements at risk and reports projected in one dashboard.

Engagement managers

Standard worksheets and workpapers, one methodology across assessors, and a file that’s ready for quality review.

Seniors and staff

Less re-keying and chasing evidence, more time on the judgment calls.

Audit Process Benchmark

Run a real CMMC assessment in Audora before you decide

In three calls or fewer we learn how your firm runs CMMC assessments, scope Audora to match, and you run an assessment in a free sandbox against your own success criteria. Whether or not you buy, you keep a gap read-out on your process, a Benchmark Summary, and a free QA of one engagement by a working auditor.

Book a Workshop Not ready for a workshop? Talk to our team

CMMC guide

CMMC levels, Level 2 assessments, and where the program stands

For defense contractors preparing for CMMC, and for anyone who wants a quick reference. Your assessor makes the final call on scope and approach, and program details can change, so check the official sources linked below.

What is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) program verifies that defense contractors protect Federal Contract Information and Controlled Unclassified Information. It’s set out in 32 CFR Part 170 and builds on requirements contractors already had, mainly FAR 52.204-21 and NIST SP 800-171. Certification assessments at Level 2 are performed by Certified Third-Party Assessment Organizations (C3PAOs), accredited by the Cyber AB.

What are the three CMMC levels?

Level 1

Protects Federal Contract Information (FCI) with the 15 basic safeguarding requirements in FAR 52.204-21. Annual self-assessment.

Level 2

Protects Controlled Unclassified Information (CUI) with the 110 requirements in NIST SP 800-171 Rev. 2. A self-assessment or a certification assessment by a C3PAO, depending on the contract, every three years with an annual affirmation.

Level 3

Adds selected NIST SP 800-172 requirements for the most sensitive programs. Assessed by the government’s DIBCAC, on top of a Level 2 certification.

Where does the CMMC rollout stand?

As of October 2026:

  • Phase 1 began November 10, 2025. Applicable solicitations started including Level 1 and Level 2 self-assessment requirements.
  • Phase 2 is suspended. On July 13, 2026, the Department of War suspended Phase 2, which would have made C3PAO certification a condition of award for many contracts involving CUI starting November 10, 2026, and launched a review of the program.
  • Existing obligations remain. Phase 1 self-assessments, DFARS 252.204-7012, and NIST SP 800-171 still apply.
  • Certification is voluntary for now. During the suspension, new solicitations can include only Level 1 or Level 2 self-assessment requirements, and C3PAO requirements are being removed from active contracts. Organizations can still choose a C3PAO certification assessment.

Check the Department of War CIO’s CMMC site for the current status before planning around a date.

Who needs CMMC?

Defense contractors and subcontractors that handle FCI or CUI on Department of War contracts. Requirements flow down from primes to subcontractors that handle the same information.

You likely need it if you
  • Hold or bid on contracts that include the CMMC clause
  • Handle CUI for a prime contractor
  • Store, process, or transmit FCI on a defense contract
It may not apply if
  • You only sell commercial off-the-shelf (COTS) items
  • None of your defense work involves FCI or CUI

What does a Level 2 assessment cover?

  • Scoping. The assessment scope is set from the CUI environment, with assets categorized as CUI assets, security protection assets, contractor risk managed assets, specialized assets, or out of scope.
  • System security plan. How each requirement is implemented in the scoped environment.
  • 110 requirements in 14 families. From access control and audit and accountability through system and information integrity, each with assessment objectives drawn from NIST SP 800-171A, 320 in total.
  • Assessment methods. Assessors examine documents and records, interview people, and test mechanisms to determine whether each objective is met.
  • Scoring and POA&Ms. Some unmet requirements can go on a plan of action and milestones. A minimum score earns conditional status, and the POA&M must close within 180 days to reach final status.

How does a Level 2 certification assessment run?

  1. Define the CUI environment and the assessment scope, and finalize the system security plan.
  2. Run a mock or readiness assessment, then remediate gaps.
  3. Plan and prepare the assessment with the C3PAO: scope, evidence, logistics, and schedule.
  4. Conduct the assessment: examine, interview, and test against each objective.
  5. Report results, which the C3PAO submits to the government’s system of record.
  6. Close any POA&M items within 180 days, then maintain the certification with annual affirmations and reassess every three years.

How often is CMMC assessed?

A Level 2 certification is valid for three years, with an annual affirmation of continued compliance from a senior official. Conditional status lasts 180 days, while open POA&M items are closed. Level 1 and Level 2 self-assessments are entered in SPRS, the government’s supplier risk system.

Why get assessed?

  • Contracts that include the CMMC clause require the matching level before award.
  • Primes need subcontractors that handle CUI to meet the same level, so it keeps you in their supply chain.
  • An independent assessment backs up the NIST SP 800-171 compliance you already affirm.

Working with an assessor on your CMMC assessment?

Assessment firms that run on Audora give their clients a collaboration dashboard: open requests, uploads, and comments in one place, instead of a thread of emails and spreadsheets.