Why CMMC Assessors Grade You on 320 Objectives — Not Just 110 Controls

The Gap Most Contractors Don't Know About

You've gone through all 110 NIST SP 800-171 controls. You've marked them implemented, written your System Security Plan, and calculated your SPRS score. You feel ready for your C3PAO assessment. Then the assessor arrives and starts asking questions you didn't anticipate — specific, granular questions about sub-requirements you thought were covered by the control you already marked done.

This isn't a trick or an overreach. It's the expected methodology. C3PAO assessors don't work from NIST SP 800-171. They work from NIST SP 800-171A — the companion assessment guide that breaks every one of those 110 controls into individual "assessment objectives." There are 320 of them. And each one can be marked MET or NOT MET independently.

What an Assessment Objective Actually Is

An assessment objective is the smallest unit of compliance that an assessor evaluates. NIST SP 800-171A defines specific objectives for each control along with the examination, interview, and testing methods the assessor must use to verify each one.

Here's a concrete example. Control AC.L2-3.1.1 reads: "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)." That sounds like one thing to check off. But under 800-171A, this control has multiple objectives:

• [a] authorized users of the system are identified
• [b] processes acting on behalf of authorized users are identified
• [c] devices and other systems authorized to connect to the system are identified
• [d] system access is limited to authorized users
• [e] system access is limited to processes acting on behalf of authorized users
• [f] system access is limited to authorized devices and systems

A C3PAO assessor evaluates each of these separately. If any one of them is not demonstrably met, that objective is marked NOT MET — even if you have strong implementations for the others.

Why Tracking Only 110 Controls Leaves You Exposed

This is where the most common assessment surprises happen. A contractor marks AC.L2-3.1.1 as implemented. They have an Active Directory environment, they manage user accounts, and access to their CUI systems requires credentials. That covers objectives [a] and [d] reasonably well.

But objective [c] asks specifically whether authorized devices are identified and whether system access is limited to those devices. If you haven't documented a device inventory or implemented controls that restrict which endpoints can connect to CUI-bearing systems, the assessor marks objective [c] NOT MET. The whole control isn't failed — but it isn't fully Met either, and the finding goes into your assessment report.

Multiply this across 110 controls and you can see how a contractor who felt 85% ready discovers during the assessment that they have 30 individual objective findings they never anticipated. These aren't assessor overreaches. They're gaps that existed all along — the contractor just didn't know to look at that level of granularity.

What NIST SP 800-171A Rev 2 Actually Says

It's worth being clear about the relationship between the two documents. NIST SP 800-171 is the control standard — it defines the 110 security requirements that protect CUI. NIST SP 800-171A is the assessment methodology — it defines exactly how a qualified assessor verifies whether each requirement is implemented.

Assessors are required to use 800-171A. It's not optional or supplementary. The document specifies three assessment methods for each objective: examine (reviewing documentation and configurations), interview (questioning responsible personnel), and test (exercising the mechanism directly). For each objective, 800-171A lists which combination of these methods is required.

The good news: 800-171A is a free public document available directly from NIST at csrc.nist.gov. You don't need a subscription or special access to read exactly what your assessor will use to evaluate you.

How to Prepare at the Objective Level

The practical shift is moving your compliance tracking from the control level to the objective level. Here's how to do it:

• Download 800-171A. Read through the objectives for each of your highest-risk controls — especially in the Access Control (AC), Identification and Authentication (IA), and Configuration Management (CM) families, where the most objectives exist and the most findings occur.
• Map your implementations to each objective, not just each control. For every objective in 800-171A, ask: what specific technical control, configuration, or documented procedure satisfies this exact sub-requirement? If you can't answer the question, the objective is not ready.
• Document at the objective level. Your SSP implementation statements should be specific enough that an assessor can trace each objective to a concrete artifact. "We use Active Directory" is not enough. "Authorized devices are identified in our CMDB and restricted via Azure AD Conditional Access device compliance policies" gives an assessor something to examine and test.
• Use your compliance tool to track at this granularity. A tracker that only shows 110 controls cannot tell you which of the 320 objectives you're actually ready for. Tracking at the objective level surfaces gaps before your assessor does.

RegulatoryForge's 320 Objectives Tracker

The Objectives Tracker in RegulatoryForge is built specifically for this problem. It loads all 320 NIST SP 800-171A assessment objectives, organized by control family, with a click-to-cycle status for each one (Not Started / In Progress / Met / Not Met) and inline notes for documenting your evidence. The summary view gives you a readiness score by family so you can see exactly where your gaps are before the assessor does.

The Bottom Line

Preparing at the 110-control level is necessary, but it's not sufficient for a successful C3PAO assessment. Assessors work at the objective level — all 320 of them. The contractors who move through assessments without surprises are the ones who can produce a specific, documented answer for every sub-requirement, not just a general statement that the parent control is implemented. Start at the objective level and your assessment will go the way you planned it to.