Summary: CMMC has created a fast-moving market of consultants, MSPs, and “compliance experts,” and not all of them have actually taken a contractor through a real assessment. If you are a DoD contractor or subcontractor evaluating a CMMC partner, past performance is the single best predictor of whether that partner can get you certified without wasted time, wasted budget, or a failed assessment. This post walks through the specific questions to ask any CMMC provider before you sign a contract, why each question matters, and what a credible answer sounds like versus a red flag. Use it as a scorecard. The right partner should welcome these questions, not deflect them.
Why Past Performance Matters More Than Marketing
CMMC 2.0 is still relatively young, and the assessor ecosystem (C3PAOs) is still maturing. That gap between demand and mature supply has attracted a wave of new entrants: IT companies that added “CMMC” to their website within the last year, consultants who took a certification course but have never sat through a live assessment, and MSPs that sell “CMMC-reaady” infrastructure without ever having a client actually pass one.
None of that is inherently disqualifying. Everyone starts somewhere. But if your organization is on a contract timeline, or if you are trying to win new DoD work that requires CMMC Level 2 certification, you cannot afford to be someone’s first attempt. The stakes are too high: a failed assessment costs money, delays revenue, and can put existing contracts at risk.
Past performance is the difference between a partner who is guessing at what a C3PAO will ask for and a partner who has already seen it, corrected for it, and knows exactly where the process breaks down. It is also the difference between a company that talks about compliance in the abstract and one that can show you the actual documents, structures, and decisions that got a real client through.
Below are the questions that matter most, organized in the order a serious buyer should ask them.
Question 1: Have You Actually Gotten a Company Through C3PAO Certification?
This is the single most important question, and it deserves a direct, specific answer. Not “we’re very familiar with the process.” Not “we’ve done a lot of gap assessments.” The question is whether the partner has taken at least one organization all the way through a Certified Third-Party Assessment Organization (C3PAO) assessment for CMMC Level 2, and whether that organization passed.
Gap assessments and readiness work are useful, but they are not the same as sitting across the table from an assessor and defending your System Security Plan (SSP), your Plan of Action and Milestones (POA&M), and your evidence in real time. A partner who has never been through that room does not know what assessors actually push back on, how they interpret ambiguous control language, or where documentation that looks fine on paper falls apart under questioning.
What a strong answer sounds like: A specific number of clients assessed, an honest description of outcomes (including any that needed a second pass or POA&M closure period), and a willingness to describe what they learned from the experience.
Red flag: Vague language like “we’ve helped many clients get compliant” with no mention of an actual completed C3PAO assessment, or an inability to name how many clients have gone through Level 2 specifically.
Question 2: How Many Level 2 Clients Do You Currently Support, and What State Are They In?
Certification is not a one-time event. CMMC Level 2 requires maintaining a security posture over time, including annual affirmations and eventual re-assessment. Ask not just how many clients a partner has certified historically, but how many they are actively supporting today, and in what state those environments are.
This tells you two things. First, it tells you whether the partner has ongoing operational experience with CMMC environments, not just a one-time project. Second, it tells you whether they have the staffing and processes to support you after certification, not just up to the day the assessor leaves.
What a strong answer sounds like: A clear count of current Level 2 clients, a description of how those clients are supported (managed CMMC, enclave, hybrid), and candor about where any of them are in the compliance lifecycle (newly certified, mid-POA&M, preparing for reassessment).
Red flag: A partner who can describe their sales pipeline for CMMC work but cannot describe their actual current client base under active management.
Question 3: Do You Maintain a Shared Responsibility Matrix (SRM), and Can You Show Me One?
A Shared Responsibility Matrix is one of the clearest signals of a partner who understands CMMC operationally rather than theoretically. The SRM defines, control by control, who owns what: which controls are the client’s responsibility, which are the provider’s, and which are shared. Assessors expect to see this laid out clearly, especially when a managed service provider or cloud environment is involved in the client’s CUI boundary.
A partner without a documented SRM is a partner who has not yet had to defend the boundary between their responsibilities and yours in front of an assessor. That ambiguity becomes your problem during the assessment, not theirs.
What a strong answer sounds like: Yes, here is our SRM template, here is how we tailor it to each client’s environment, and here is how we walk clients through it before the assessment so there are no surprises about who owns which control.
Red flag: Confusion about what an SRM is, or a claim that “we handle all the technical controls so you don’t need to worry about it,” which usually signals an incomplete understanding of shared responsibility and a documentation gap waiting to surface during assessment.
Question 4: What Is Your Role, Exactly, Consultant, MSP, or Enclave Provider?
CMMC support comes in different flavors, and a contractor needs to understand which one they are buying. A consultant advises on scope, policy, and documentation but typically does not touch your infrastructure. An MSP manages your IT environment day to day and may implement controls directly. An enclave provider hosts a separate, purpose-built environment specifically scoped to handle Controlled Unclassified Information (CUI), which can dramatically reduce the size and cost of your compliance boundary.
Ask the partner to describe their role plainly, and ask whether they can operate in more than one of these capacities. A provider who only advises but cannot implement leaves you to execute the hardest part yourself. A provider who only manages IT but has never scoped an enclave may push you toward a broader, more expensive boundary than you actually need.
What a strong answer sounds like: A clear description of their model, whether that is managed CMMC, a dedicated enclave, consulting-only, or some combination, along with an honest explanation of what is and is not included.
Red flag: A provider who blurs the distinction, or who cannot explain how an enclave might reduce your assessment scope compared to certifying your entire network.
Question 5: Are You Relying on RP, RPA, or RPO Status as Proof of Competency? Ask What It Actually Took to Get It.
A lot of CMMC marketing leans hard on the letters RP (Registered Practitioner), RPA (Registered Practitioner Advanced), and RPO (Registered Practitioner Organization). It is worth understanding exactly what these designations mean before you weigh them.
RP, RPA, and RPO are Cyber AB registration statuses, not competency-based certifications. To get them, an individual or company pays a fee to the Cyber AB, passes a background check, signs the Code of Professional Conduct, and completes the Cyber AB’s own online training modules. There is no requirement to have prior hands-on CMMC implementation experience, no requirement to have worked a real assessment, and no proctored, independently validated exam comparable to what a true professional certification requires. RPO status itself is largely administrative: register, pay, employ at least one RP, renew annually.
That is different from the Certified CMMC Professional (CCP) and Certified CMMC Assessor (CCA) credentials, which require formal coursework and a proctored exam, and which are the credentials actually tied to conducting or supporting a real assessment on the C3PAO side.
None of this means RP, RPA, or RPO status is worthless. It shows a partner has registered with the Cyber AB and agreed to its code of conduct. But it should not be mistaken for proof of experience, and a partner who leads with “we’re an RPO” as their main qualification is leaning on a paid registration, not a track record. Ask them directly: is this designation the extent of your CMMC credentialing, or do you also have CCPs, CCAs, or actual completed assessments to point to?
What a strong answer sounds like: An honest explanation that RP, RPA, and RPO are registration statuses obtained through fees, background checks, and Cyber AB’s own training, paired with real evidence of experience beyond the designation itself, such as CCP or CCA credentials, or better yet, actual clients who have completed assessment.
Red flag: A partner who cites their RP, RPA, or RPO status as if it were a hard-won, competency-tested certification, or who cannot explain the difference between a paid registration and an exam-based credential like CCP or CCA.
Question 6: Can You Show Me a Completed SSP, With Sensitive Details Redacted?
The System Security Plan is the backbone document of any CMMC assessment. It describes your environment, your controls, and how each control is implemented. A partner who has built real SSPs for real clients can show you a redacted example and walk you through its structure. A partner who has only worked from templates downloaded off the internet will struggle to explain how the document should reflect your actual environment rather than a generic boilerplate.
What a strong answer sounds like: A willingness to show structure and format (with client-identifying and sensitive technical details removed), paired with an explanation of how the SSP is built collaboratively with the client rather than handed over as a finished product with no input.
Red flag: Reluctance to discuss the SSP at all, or a document that reads like a copy-pasted template with no evidence of environment-specific tailoring.
Question 7: How Do You Handle Scoping, Especially the FCI/CUI Boundary?
Scoping is where many CMMC engagements go wrong before they even start. Overly broad scoping drags your entire network into the assessment boundary, driving up cost and assessment time. Overly narrow scoping creates gaps that a C3PAO will catch and reject. A partner with real experience will ask hard questions early about where Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) actually live in your environment, how they flow, and where they can be isolated.
What a strong answer sounds like: A structured scoping methodology, specific questions about data flow and system boundaries, and a clear rationale for how they would define your assessment boundary before any technical work begins.
Red flag: A partner who skips scoping discussion entirely and moves straight to selling a platform, tool, or fixed-price package.
Question 8: What Happens If We Do Not Pass the Assessment?
No credible partner will promise a guaranteed pass, and you should be skeptical of anyone who does. What matters is their process for handling a Plan of Action and Milestones (POA&M) if gaps are identified, and how they support remediation within the allowed closure window.
What a strong answer sounds like: A clear description of their POA&M remediation process, realistic timelines, and honesty that outcomes depend on your environment, your evidence, and the assessor’s independent judgment, not on the partner alone.
Red flag: Guarantees of certification success, which no legitimate provider can make since the C3PAO, not the consultant or MSP, makes the final determination.
Question 9: Can I Talk to a Reference Who Has Actually Been Assessed?
Ask for a reference conversation with an existing client who has completed, or is actively going through, a CMMC Level 2 assessment with this partner. Case studies and testimonials on a website are marketing. A live conversation with another contractor about what the process was actually like is due diligence.
What a strong answer sounds like: A willingness to arrange the introduction, even if it takes a few days to coordinate with the reference client’s own schedule and comfort level.
Red flag: Resistance, delay tactics, or an inability to produce any reference at all.
Putting It Together: A Short Scorecard
When you sit down with a prospective CMMC partner, you are really testing for three things: proven experience (have they done this before, successfully), operational maturity (do they have the documentation and processes that a real assessment requires), and honesty (do they tell you the truth about risk, timelines, and what is outside their control). A partner who scores well on all three questions above is worth serious consideration. A partner who dodges even one or two of them is a risk you do not need to take on a compliance deadline that affects your contract eligibility.
The Next Best Action
If you are evaluating CMMC partners for your organization, bring this list of questions into your next discovery call, whoever you are talking to. If you would like a second opinion on a partner’s answers, or want to walk through your own scoping and readiness questions with a Hawaii-based team that lives in the DoD contractor community here and in Guam, Intech Hawaii is glad to have that conversation. If you are located in Honolulu, Hawaii or Guam, you should book a discovery call and bring your toughest questions. That is exactly how this evaluation should go.
