Assessment Methods

Make documents, people, and system behavior tell the same story

How CMMC Level 2 assessors use Examine, Interview, and Test, and how an organization can prepare evidence and owners without scripting or manufacturing answers.

Use the evidence map Prepare interview owners

Examine: inspect documents, mechanisms, and activities

Interview: ask people who operate or oversee the process

Test: exercise the relevant mechanism or activity

The assessor selects methods needed for sufficient confidence

Examine finds the documented and observable record

Potential objects include policies, procedures, plans, diagrams, configurations, logs, tickets, inventories, records, mechanisms, and activities. The list in assessment procedures is a selection set, not a requirement to produce every listed object.

Interview connects evidence to actual responsibility

The strongest interview preparation is not a memorized script. It is a clear owner model and access to current evidence. Staff should be able to explain what they do, when they do it, what system or record shows it, and what happens when an exception occurs.

Test checks behavior, not marketing language

A test may exercise the mechanism or observe the process under assessment conditions. The evidence coordinator should identify the responsible operator and required access, while the technical owner and assessor control the test.

What the work produces

Concrete, client-owned operating records

Method-aware objective map

Document and mechanism index

Interview-owner roster

Test operator routing

Open access and scheduling needs

Responsibility boundary

Facts, not verdicts

Gridex coordinates evidence and people. Gridex does not coach false answers, control assessor sampling, or operate systems outside the agreed role.

Questions buyers ask

Frequently asked questions

Must an assessor use all three methods for every objective?

No. The guide allows flexibility. The assessor selects methods and objects needed to reach sufficient confidence.

Can one artifact support multiple objectives?

Yes. The organization should map actual support relationships rather than create artificial one-file-per-objective packages.

Primary references

Source context

DoD CMMC Level 2 Assessment Guide v2.13 Defines assessment objectives, evidence expectations, MET and NOT MET findings, and Examine, Interview, and Test methods. NIST SP 800-171A (2018) Assessment procedures underlying the current CMMC Level 2 assessment-objective model. NIST has since published SP 800-171A Rev. 3, which CMMC has not yet adopted.

Start with one bounded scope

Bring the evidence state you actually have.

Gridex will map the operating work, the human judgment boundary, and the safest next step.

Use the evidence map →