CMMC Compliance
A San Antonio subcontractor wins a new DoD contract, buys a SIEM tool and spends $40,000 on a Microsoft GCC High migration — then discovers at their C3PAO assessment that neither addressed the three NIST 800-171 controls actually flagged in their System Security Plan. A CMMC gap assessment is precisely what prevents that outcome.
What a CMMC Gap Assessment Actually Produces (and What It Doesn't)
A CMMC gap assessment is a structured review of your existing security controls measured against all applicable NIST 800-171 practices. It produces a scored gap report and a prioritized remediation roadmap. It does not award certification, and it is not a C3PAO audit — those are separate, later steps.
What the Deliverable Actually Looks Like
- Scored gap report: Each of the 110 NIST 800-171 practices rated as met, partially met, or not met — not a vague narrative summary.
- CUI boundary map: Identification of which systems, users, and network segments are in scope for CMMC, so remediation effort isn't wasted on out-of-scope infrastructure.
- Prioritized remediation roadmap: Findings sequenced by risk and C3PAO scrutiny weight, so your budget addresses the highest-impact gaps first.
- System Security Plan (SSP) review: Assessment of whether your existing SSP accurately reflects actual controls — a frequent disconnect assessors flag immediately.
A gap assessment is one component of the broader CMMC compliance journey. CMMC Compliance Services in San Antonio covers the full path — from gap assessment through remediation, documentation, and C3PAO readiness — for contractors navigating the Defense Industrial Base requirements.
CMMC 2.0 in 2026: Which Level Your Contract Actually Requires
CMMC 2.0 has three levels, and the one your contract requires determines whether a third-party C3PAO assessment is mandatory. Most San Antonio prime contractors and subcontractors handling Controlled Unclassified Information fall under Level 2 — the tier where an independent gap assessment before any C3PAO engagement is essential.
CMMC 2.0 Level Map
| Level | Practice Count | Assessment Type | Typical Applicability |
|---|---|---|---|
| Level 1 — Foundational | 17 practices | Annual self-attestation | FCI-only contracts; no CUI handled |
| Level 2 — Advanced | 110 NIST 800-171 practices | C3PAO third-party assessment (most CUI contracts) | Prime and sub contractors handling CUI — the majority of JBSA and Lackland AFB supply chain firms |
| Level 3 — Expert | 110+ DFARS-enhanced practices | DIBCAC-led government assessment | High-priority programs; DoD-designated |
CMMC 2.0 requirements have been embedded in DoD contracts since 2025. For Level 2 contractors, a C3PAO assessment — conducted by an accredited third-party assessor — is the formal gatekeeping event. A CMMC gap assessment run before that event gives you a practice-level map of where you stand, so the C3PAO engagement becomes a confirmation rather than a discovery process.
Why Skipping the Gap Assessment Wastes Your Remediation Budget
Without a gap assessment, contractors routinely over-invest in visible controls — endpoint detection tools, MFA deployment — while leaving high-risk gaps in access control documentation, incident response plans, and CUI boundary definitions. Those documentation and scoping gaps are exactly what C3PAO assessors scrutinize most closely at Level 2.
The Remediation-Sequencing Problem
The NIST 800-171 domains that San Antonio defense contractors most commonly fail at C3PAO assessment are Access Control (AC), Incident Response (IR), and Identification and Authentication (IA). AC failures are rarely about missing tools — they stem from undocumented least-privilege policies and undefined CUI access boundaries. IR gaps usually mean the incident response plan exists on paper but hasn't been tested or updated to reflect current systems. IA findings often involve MFA gaps on specific system types rather than a missing MFA product.
What Sequenced Remediation Looks Like
- CMMC gap assessment: Produces a scored finding for each of the 110 NIST 800-171 practices, flagged by domain.
- Domain-level prioritization: AC, IR, and IA findings ranked by C3PAO scrutiny weight and remediation complexity.
- Scoped vendor spend: Tool and service purchases tied to specific practice gaps — not category-level guesses.
- Managed cybersecurity implementation: Managed cybersecurity controls deployed against the confirmed gap list, not against assumed risk.
The gap assessment prevents the scenario where a contractor spends heavily on an endpoint detection platform when the actual C3PAO finding will be a missing IR test record or an undocumented access control policy. Sequencing remediations from a scored gap report means every dollar spent addresses a confirmed, documented deficiency.
What to Look for in a Gap Assessment Provider (and the Questions to Ask)
A CMMC-specific gap assessment requires hands-on familiarity with NIST 800-171, DFARS 252.204-7012 (the DFARS clause that first mandated CUI protection requirements for defense contractors), and CMMC 2.0 scoping rules — not a generic cybersecurity audit adapted for defense. Provider selection determines whether the deliverable is actionable or shelf-ware.
Provider Evaluation Criteria
- CMMC 2.0 scoping experience: Can they define your CUI boundary — identifying which assets, networks, and personnel are in scope — before starting the practice review?
- Deliverable format: A scored, practice-level report against all 110 NIST 800-171 requirements is the standard. A vague narrative summary won't support C3PAO preparation.
- Remediation capability: Does the provider hand you findings and disappear, or can the same team execute remediation? The handoff gap between assessor and implementer is where remediation plans stall.
- On-site capacity: CUI boundary scoping often requires physical review of server rooms, workstations, and network segments — a remote-only assessment may miss in-scope assets.
- Defense contractor familiarity: Ask specifically whether they have assessed firms operating under DFARS 252.204-7012 and whether they understand how prime/sub relationships affect CUI scope.
Why Integrated Assess-Then-Remediate Matters
Unlike national compliance consultancies that deliver a spreadsheet and move on, TechSage Solutions — San Antonio-based and providing IT support for San Antonio defense contractors from Boerne to New Braunfels — pairs gap assessment findings directly with managed IT and cybersecurity remediation. The team that identifies your gaps owns fixing them, which eliminates the handoff problem that stalls most CMMC remediation plans. That integrated model is a structural capability that pure consulting firms operating remotely cannot replicate.
Frequently Asked Questions
What is the difference between a CMMC gap assessment and a C3PAO assessment?
A CMMC gap assessment is an internal diagnostic — it identifies which NIST 800-171 practices you currently meet and which you don't, producing a remediation roadmap. A C3PAO assessment is a formal third-party audit conducted by an accredited assessor organization that results in an official CMMC Level 2 certification. The gap assessment prepares you for the C3PAO; it does not replace it.
How long does a CMMC gap assessment take?
Duration depends on your organization's size, the complexity of your IT environment, and how well-documented your existing controls are. For a small-to-medium defense contractor, a thorough practice-level assessment against all 110 NIST 800-171 controls typically takes several weeks from kickoff to final scored report delivery.
Do I need a gap assessment if I'm only targeting CMMC Level 1?
CMMC Level 1 requires only 17 practices and allows annual self-attestation, so a full 110-practice gap assessment is not required. However, if your contracts handle any Controlled Unclassified Information — or if you expect future contracts to — a Level 2 gap assessment now avoids a more costly scramble when contract requirements escalate. Confirm your CUI status before assuming Level 1 applies.
How much does a CMMC gap assessment cost?
Cost varies by scope — the number of systems in your CUI boundary, the depth of documentation review, and whether on-site work is required. A practice-level gap assessment for a small-to-medium defense contractor is typically far less than the cost of a remediation mistake made without one. Request a scoped quote based on your specific environment.
What happens after the gap assessment — who fixes the findings?
With many consulting-only providers, remediation is your problem — they hand you findings and exit. TechSage Solutions keeps the same team engaged through remediation, implementing the managed IT and cybersecurity controls that address scored gaps. This is covered under TechSage's CMMC Compliance Services in San Antonio, which spans assessment through C3PAO readiness.
Can a gap assessment tell me if I'll pass my formal CMMC audit?
A gap assessment gives you a strong indication of readiness — but it cannot guarantee a C3PAO outcome. C3PAO assessors apply their own judgment and may weight evidence differently. What a thorough gap assessment does is surface the most likely failure points so you can address them before the formal assessment, reducing the risk of findings that delay certification.
Is a CMMC gap assessment the same as a NIST 800-171 self-assessment?
A NIST 800-171 self-assessment is an internal scoring exercise a contractor performs and reports via SPRS — it uses the same 110-practice framework but relies on self-reported data. A CMMC gap assessment is conducted by an independent provider who validates your controls against evidence, identifies blind spots, and produces a remediation roadmap a self-assessment rarely delivers.
Find Out Exactly Where Your CMMC Gaps Are Before Your Next Contract Requires Certification
When you request a consultation through TechSage's CMMC Compliance Services page, a San Antonio-based advisor maps your current controls against NIST 800-171, identifies your highest-risk gaps, and gives you a sequenced remediation roadmap — so your budget goes to the fixes that actually matter.
Schedule Your CMMC Gap Assessment Consultation
