If your engineering team ships software or handles data for a defense contractor, at some point "CMMC" is going to land on your roadmap whether you asked for it or not. Most write-ups on this topic are aimed at compliance officers. This one's for the engineers who'll actually implement the controls.
Who's Actually in the Room
When a company (an OSC Organization Seeking Certification, in CMMC-speak) starts preparing for assessment, a few different roles show up:
- RP (Registered Practitioner) — an individual consultant who helps you prepare. Not an assessor.
- RPO (Registered Practitioner Organization) — the firm that employs RPs.
- CCP (CMMC Certified Professional) works the assessment side.
- C3PAO the accredited third-party org that runs the official, certifying assessment.
From a dev team's perspective, the RP is usually who you'll actually interact with day-to-day. They're not grading you; they're the one running the gap analysis against your current setup access controls, logging, encryption at rest/in transit, incident response docs, the works — and flagging where your implementation doesn't match documented policy (or where policy doesn't exist yet).
The Gap That Actually Trips Teams Up
A pattern that shows up constantly: teams have the technical control in place but no evidence trail proving it's consistently enforced. You might have the right IAM policies, but if there's no audit log showing they've been reviewed on a schedule, that's a finding. CMMC cares as much about demonstrable process as it does about the underlying tech.
A decent RP will walk your stack, map what you have against the relevant practice families for your target level, and hand you a prioritized list: here's what's missing technically, here's what's missing on the documentation side, here's what's a genuine gap vs. what's just undocumented.
Timeline Note for 2026
Worth flagging if you're scoping work against a deadline: the Department of War suspended CMMC Phase II requirements in July 2026 pending a broader program review. Phase I obligations are unaffected. If your project plan cites a hard November 2026 Phase II date, double check that against current Cyber AB guidance before you commit sprint capacity to it a lot of older articles online haven't caught up with this.
Practical Takeaway
If you're the engineer who's going to be in the room with an RP, come prepared with:
- Current architecture diagrams (not the ones from 18 months ago)
- Whatever audit logging you already have configured
- A honest list of where policy exists only in someone's head
That last one saves everybody time. RPs aren't there to catch you out — they're there to help you close gaps before an actual C3PAO assessor does it for you, less gently.
I went into more detail on the RP vs RPO vs CCP vs C3PAO distinctions, plus a comparison table, in the full CMMC Registered Practitioner guide if you want the deeper reference.
Top comments (0)