What questions should you ask a CMMC provider before hiring one?

By Hugh Donatello, LAN Service Group · Reviewed October 17, 2026

Short answer

Ask who will lead the work and what credentials you can verify, whether the firm will stay out of your certification assessment, how it scopes CUI, which NIST SP 800-171 revision it assesses against, how it scores and limits your POA&M, and what you will own at the end. Good answers cite 32 CFR 170 and DFARS 252.204-7012, not sales promises.

Why the questions matter more during the Phase 2 suspension

On July 13, 2026, the Department of War Chief Information Officer suspended the planned November 2026 move to CMMC Phase 2, put all pending CMMC milestones on hold and set up a Reform Task Force to review the program. Until further guidance, new requirement documents may only include CMMC Level 1 (Self) or Level 2 (Self). That puts more weight on your own self-assessment and on the senior official who affirms it, so the quality of the help you hire shows up directly in a score and a signature your company owns.

A CMMC provider can be a consultant that assesses and documents, a managed service provider that runs controls, or a firm that does both. The questions below work for all three. They are drawn from the CMMC rule, 32 CFR Part 170, the DFARS clauses that put it into contracts, and The Cyber AB's description of ecosystem roles.

The questions, and what a good answer sounds like

Send these in writing before a sales call and compare the written answers. A provider that answers precisely and in writing is showing you how it will document your program.

13 questions to ask a CMMC provider (as of October 17, 2026)
Question	Why it matters	A good answer	Source
Who will lead our project, and what credentials or experience can we verify?	The Cyber AB defines consulting roles such as Registered Practitioner and RPO, certified-professional credentials are now handled by ISACA, and 32 CFR 170.8 requires a public list of authorized C3PAOs.	Named people, their credentials or equivalent hands-on experience, and any listing or credential they claim, which you can check yourself.	[1] [3]
Will your firm, or anyone who prepares us, take part in our certification assessment?	The Code of Professional Conduct required by 32 CFR 170.8 bars CMMC ecosystem members who consulted to prepare you from your Level 2 certification assessment within 3 years.	No. The provider prepares you and an independent, authorized C3PAO assesses you.	[3]
Can you certify us, or guarantee that we will pass?	Level 2 certification comes from an authorized C3PAO (or, in limited cases, a DCMA DIBCAC High Assessment), and The Cyber AB says RPOs do not conduct certified assessments.	No one can promise a result. The provider describes how it gets you ready and how readiness is measured.	[1] [3]
How will you decide what is in scope?	Scope drives cost and effort. The rule sets out how CUI assets, security protection assets and out-of-scope assets are treated.	A data-flow based approach that finds where CUI enters, is stored and leaves, and compares an enclave with an enterprise-wide boundary.	[3]
If you manage our IT, are your tools and people inside our assessment scope?	Under 32 CFR 170, a provider whose assets process, store or transmit your CUI or Security Protection Data, such as logs, is an External Service Provider.	Yes, where they touch that data. The provider shows how its remote access and security tools meet NIST SP 800-171.	[3]
How will you handle cloud services that store or process our CUI?	DFARS 252.204-7012 requires cloud services holding covered defense information to meet security equivalent to the FedRAMP Moderate baseline and support incident reporting.	A list of your cloud services, the evidence each one meets the clause, and its customer responsibility matrix in your SSP.	[5]
Which NIST SP 800-171 revision will you assess against?	CMMC Level 2 is built on NIST SP 800-171 Rev 2 and the July 2026 memos keep Rev 2 as the baseline, but DoD's 2026 Unified Agenda lists a planned 32 CFR 170 amendment to move to Rev 3.	Rev 2 today, with documentation that can map to Rev 3 when DoD publishes a transition period.	[3] [8] [4] [9]
How do you score, and how do you treat requirements that are only partly in place?	Under the CMMC Scoring Methodology in 32 CFR 170.24, each requirement is Met, Not Met or Not Applicable, and partial implementation is credited only in limited cases, such as multifactor authentication.	Scoring by the CMMC methodology, with evidence for each of the 110 requirements rather than interviews alone.	[3]
Which gaps can go on a POA&M, and how fast must they close?	Conditional Level 2 status needs a score of at least 80 percent, bars certain requirements from the POA&M and expires if items are not closed within 180 days.	The provider names the excluded requirements, including the System Security Plan, and plans closeout inside 180 days.	[3]
Who signs our affirmation, and how will you support that person?	An Affirming Official from your company affirms continuing compliance after every assessment and annually, in SPRS.	Your senior official signs. The provider gives them evidence they can stand behind and never signs or submits for you.	[3]
Can you support 72-hour cyber incident reporting?	DFARS 252.204-7012 requires reporting cyber incidents to DoD within 72 hours of discovery.	A tested incident response plan, named contacts and clear roles between you and the provider.	[5]
We are a prime. How will you help us manage subcontractors?	DFARS 252.204-7021 requires primes to flow down the right CMMC level and check subcontractors' current status before award.	A process to identify which subcontracts carry FCI or CUI and to check status before award and each year.	[7]
How does the Phase 2 suspension change your plan for us?	The July 13, 2026 memos suspended Phase 2 and set up a Task Force whose mandate includes replacing prohibitive third-party compliance models, while DFARS 252.204-7012 and NIST SP 800-171 Rev 2 remain in effect.	Keep implementing and keep an honest, evidenced self-assessment that will hold up under whatever assessment model DoD adopts, without paying for a rushed certification.	[8] [4] [5]

Ask for written answers. For a self-assessment your company submits the score in SPRS, and your own Affirming Official must make the affirmation, whoever helps you prepare.

Red flags in the answers

Most poor answers fall into a few patterns. Any one of these is a reason to ask more questions before you sign.

A guarantee that you will pass, or a claim that the firm can certify you.
An offer to prepare you and then assess you for certification.
A software tool or template pack sold as compliance on its own.
Assessing you against NIST SP 800-171 Rev 3 as if it were already the CMMC baseline; the rule still uses Rev 2.
Urgency built on the November 10, 2026 date, which the July 2026 memos suspended.
An offer to submit your SPRS score or sign your affirmation.
Vague answers about who will do the work, or credentials and listings you cannot verify.

Questions to answer yourself before you call

A provider can only scope accurately if you know a few things first. Collecting them before the first call also makes the providers' answers easier to compare.

Which contracts and solicitations you hold or are bidding, and which CMMC level and DFARS clauses each one includes.
Whether you receive FCI only, or CUI, and from which customers.
Where that information is stored today: email, file shares, cloud services, laptops or shop-floor systems.
Who in your company would serve as the Affirming Official.
Your current SPRS score, if you have posted one, and when it was last updated.
Which outside IT or security providers already touch those systems.

How to compare providers fairly

Give every provider the same written questions and the same facts about your business, then score the answers on accuracy, specificity and evidence. Ask each for a sample deliverable with client details removed, such as a System Security Plan section or a POA&M extract, and check that it cites specific requirements.

Check any listing in The Cyber AB's CMMC Marketplace, or credential issued through ISACA, yourself rather than relying on a logo. If one provider will both run your IT and prepare your documentation, ask how the two teams keep the SSP aligned with how systems actually operate. Keep the eventual C3PAO completely separate from both.

Common follow-up questions

What is the difference between a CMMC consultant and a C3PAO?

A consultant helps you prepare: scoping, gap assessment, SSP, POA&M and remediation. A C3PAO is an organization authorized to conduct Level 2 certification assessments with certified assessors. The Code of Professional Conduct required by 32 CFR 170.8 bars ecosystem members who prepared you from joining your certification assessment within 3 years.

Does my CMMC provider need to be a Registered Practitioner Organization?

The rule does not require you to hire an RPO. The Cyber AB describes the RPO and Registered Practitioner roles and runs the CMMC Marketplace, so check any listing a provider claims. Weigh the credentials and experience of the people doing your work.

Can my managed IT provider also be my CMMC provider?

Yes. If its tools or people touch your CUI or security data, its services fall inside your assessment scope as an External Service Provider, so ask how it meets NIST SP 800-171 itself. It must not also be your certification assessor.

Do I still need a CMMC provider while Phase 2 is suspended?

You still need to meet DFARS 252.204-7012 and, where required, post a Level 2 self-assessment and an annual affirmation. Whether you need outside help depends on your in-house expertise; the obligation itself did not pause.

What should I own at the end of an engagement?

Your System Security Plan, POA&M, policies, scoring workbook, scoping diagrams and evidence, in editable form. For a self-assessment your company submits the SPRS score, and your Affirming Official signs the affirmation, so you must be able to maintain these without the provider.

Need help with this?

LAN Service Group prepares defense suppliers for CMMC Level 1 and Level 2 with an ISSO-led team: CUI scoping, gap assessment, SSP and POA&M, remediation and ongoing managed IT. We are not a C3PAO and never certify clients; an independent assessor decides the result. Send us these questions and we will answer them in writing.

Talk to LAN Service Group LAN Service Group CMMC services → (888) 281-7243