Are There Really Too Few CMMC Assessors?

Transcript

Jacob: All right, folks. It is August of 2026, and everywhere you look — every story you read, every post on LinkedIn — everybody keeps saying the same thing: there aren’t enough CMMC assessors. There’s just one problem. That’s not true. It’s not true compared to observed demand every month since November of 2025. It’s not true compared to DoD’s own estimates about how much assessment capacity they would need per year as CMMC starts to roll out. And then, at peak demand, the real question is: how much Level 2 assessment capacity exists compared to the number of contractors that are actually ready to complete an assessment? And when you look at DoD’s own numbers from July of 2026, the assessor shortage narrative that they’re making completely falls apart. And that’s what we’re going to talk about today.

Jason — we’ve said it before, we’ve said it for months. Before the suspension of CMMC Phase 2, the CMMC ecosystem was sitting on a ton of excess assessment capacity each month. And as we’re going to talk about in the episode, that continues to be true through July. So the DoD CIO has a real pickle on her hands here, because after this suspension we’re going to have more capacity. We already had too much. So what’s the problem?

Jason: Well, my first problem is that every time I hear ecosystem assessor capacity as the excuse as to why things aren’t going the way they’re going, it’s usually coming from the perspective of “we don’t want to implement the controls for CMMC because we can’t get an assessor” — but we haven’t even started the journey yet. I’ve said it once and I’ll say it again, and as many times as I have to until everybody hears it: the fact of the matter is that, in the organizations I talk to, more people — more organizations — are scared that DIBCAC’s going to come calling to assess their implementation than there are organizations I run into that are trying to find a C3PAO to conduct an assessment for them because they’re ready. That is the facts. That is what’s happening right now. But we’re still at this thing where there’s not enough assessors, even though assessors are showing the ability and the capacity to fill over a thousand assessments in a month. It’s crazy.

Jacob: We started talking about this before the suspension. We’re going to keep talking about this through the suspension, and we’re especially going to call back on all these numbers once the review is complete and the DoD publishes their new plan, because everybody knows that the real problem is readiness, not assessment capacity. And so, I was half expecting — I wouldn’t be surprised, I would totally understand it — the DoD came out and said, “Look, we know everybody’s not ready, so we’re going to extend Phase 1 to give people more time, because we’re being nice to you and we want as many contractors as possible to achieve Level 2.” Totally understandable. Instead, what they did was say, “There isn’t enough assessment capacity, so we’re not going to require third-party assessments.” And by their own numbers, that’s not true. So I don’t know what their plan is after the end of the review, but we’re going to keep doing these episodes with the updated numbers, so that we have a good thing to compare to once the task force releases their findings.

Jason: Yeah. Nobody has an issue with people standing on business, if they’re standing on business on truthful premises, right? If the facts exist to back it up, that’s good. But when you’re saying “this is the math that’s justifying our excuses here,” and then we go to do the math and the math isn’t mathing — like, the math isn’t mathing. By the DoD’s own statement, the DoD CIO said the math isn’t mathing. So let’s take a look at the math and see if it maths or not.

Jacob: Huh. Okay. So, first things first: July capacity was underutilized. This sounds familiar, because it seems to be the same story every month. As of July of 2026, the maximum possible number of assessment teams is about 433. If everyone who is a certified assessor was capable and actively working assessments, you could put together a maximum theoretical ecosystem of 433 teams. But we know — everybody knows — not everybody who is a certified assessor is working as an assessor. They’re not working assessments. They work at companies, whatever reason. So we can’t use the maximum number. So we’re going to use a conservative estimate and assume that only half of the possible teams we could put together are actually working, available, and possible to put together, and that that number of teams will only complete two assessments per month. So that leaves us with 216 theoretical teams as of July of 2026 that could complete, theoretically, 433 assessments per month. That is the half-capacity estimate. If we take the total possible number, 50% of that would give us 216 assessment teams able to complete 433 assessments per month. That’s a lot, but it’s only half of what you theoretically could put together. We don’t want to sit here and say, “Oh, there’s thousands and thousands of assessments per month,” because we know that’s not actually true. So don’t come after us, right?

However, we have this 433-assessments-per-month capacity in July. Only 207 Level 2 assessments were completed and awarded a Level 2 certification in July. That means that in July, the ecosystem only utilized 48% of the conservative half-capacity model here. This is not an ecosystem behaving like there are tens of thousands of assessment-ready contractors that are somehow trapped behind this bottleneck of there not being enough assessment capacity. It’s just not true. They didn’t even use half of the assessment capacity that was available in July.

Jason: Let’s get this first thing out of the way, right? No matter how safely we estimate, and no matter how much we reduce the number to be on that safe side, people are going to hate anyways on what we have to say — the math that we’re trying to do here. The only thing I want to add to this is that this is the maximum amount of assessment teams that are capable by the way the rule is written right now, and the way the assessments have to go right now. Imagine if, as suggested, they take away the need for all these assessors to go into these assessments, and we start matching some other assessment schemes. How many more can we do in a month, and how many more are going to be underutilized here?

Jacob: Hey, let’s say the DoD could press a magical button and the assessors don’t need a tier-three background check, and now all of a sudden you double the number of assessors, you triple the number of assessors. Let’s say you need fewer assessors per assessment team, and you quintuple the number of assessments. Is that going to magically make the number of Level 2 certifications per month go up? No, because you already have too many assessors compared to the demand for Level 2 assessments per month, because the contractors aren’t ready to go through the assessment. So there’s lots of ways you could make more assessors, more assessment teams, more efficient assessment teams. You could automate huge parts of assessments, or assessments entirely. You could expand capacity dramatically. You’re still not going to induce a bunch of new Level 2 assessments, because the assessment capacity isn’t the constraint.

Jason: Yeah. The only thing that’s going to go up is the number of unutilized assets.

Jacob: Exactly. Exactly. Which makes this whole thing so curious. And this isn’t just July, right? So, the capacity in July — this was the ninth month in a row where monthly assessment capacity was underutilized. So this underutilization thing was not isolated to just the latest numbers from July of 2026. Since Phase 1 began in November of 2025, actual certification output has only used about half of this conservative 50% model. So if you look at the numbers since November of 2025, there are now 1,924 Level 2 certifications. That’s a lot. That’s a 235% increase since November, by the way. That’s a ton of Level 2 certifications. We’re going to talk about how that compares to DoD’s own estimates here in a little bit, but you’re sitting at almost 2,000 Level 2 certifications. But the total amount that we could be at, if we had fully leveraged half of the available assessment teams out there since November, would be 3,371. That means we’re missing almost 1,500 Level 2 certifications that you would expect to see out there and awarded since November of 2025, if the ecosystem was fully booking every available assessment slot from every available assessment team — if only half of them were working. It cannot be true that there isn’t enough assessment capacity if the conservative version of that capacity is missing half of the certs that should have been awarded.

Jason: I just don’t understand what numbers are being used to justify this assessor shortage. Is it just word of mouth? Is it a game of telephone? I don’t get it. And we are being very modest in our estimations here. The math we’re using, the numbers we’re using, is eliminating half of the available assessors, and you’re still not even occupying half of what they are capable of doing. And like I said, these aren’t our numbers. These aren’t our numbers. These are the numbers from the Cyber AB town hall every month, published straight out of DoD’s eMASS system. So what numbers are being utilized for the number one argument coming from certain organizations within the government being assessor limitations — and then everything being said after that has nothing to do with assessor limitations whatsoever?

Jacob: This is my question, and so let’s get into it. Let’s talk about DoD’s own estimates in the rulemaking about how many assessments they said they would need per year during the phased rollout, and then at the peak demand for Level 2 certifications per year. These are their numbers, right? So, first of all, just to get this out of the way and repeat it again: we are way beyond DoD’s wildest dreams about how many assessments it could support in the first two years of the CMMC program. In their rule that created the CMMC regulation, they thought that in the first 12 months they would get 517 Level 2 certifications. We had 575 Level 2 certifications in the first month of the first year. So you absolutely smashed the number of Level 2 certs that they thought the ecosystem could support in the first 30 days, compared to the first 12 months. They thought that in the second year of the program rollout they would get 2,599 Level 2 certifications. We’re going to be at 2,600 certifications in the next four months, by November of 2026 — which ironically was the start of year two. So we’re on track to end up with as many certs by the start of year two that they thought they were going to end up with by the end of year two.

So, in total, at the peak demand — DoD, we’ll link it below — they estimated that they would need 16,610 Level 2 certs per year once the program was fully up and running. Not 80,000 per year, right? Not 80,000 by November of 2026. Never once has that been a scenario where they thought they would need to support 80,000, 100,000 per year. November was not a deadline. There is no scenario where you needed that many per year. They said, based on the number of contract awards per year, you would need 16,610 per year at the maximum. So that means, to support that number of assessments per year, assuming each assessment team is only running two assessments per month, you would need about 693 active teams. That would require a total pool of about 3,500 certified assessors, if we’re assuming that at any given time half of them aren’t running or working on assessments. So at the current compound growth rate we’re watching right now in the ecosystem, we would reach that number by the end of 2027.

Jason: That’s next year. That’s next year.

Jacob: That’s almost perfectly in line with the DoD’s estimate for the phased rollout. They didn’t know if the ecosystem was going to scale properly. They said, “We think that it’s going to scale.” It scaled way faster than they estimated through Phase 1 into Phase 2, and then, based on when they need their maximum capacity, by the end of 2027 — that’s a year from now. So even under these conservative assumptions, assessment capacity scales toward DoD’s estimated peak demand before the market is able to demonstrate that they are outpacing that demand. So the DoD, the Small Business Administration, NDIA, all these news outlets are like, “There’s not enough assessors and the ecosystem’s not scaling.” It’s not true.

Jason: No, it’s not. Because the expectation of the DoD for the amount of certifications to be issued in year one — 517 — each month at 50% capacity, 1,447 assessment slots are just left unoccupied, getting dusty. Nobody’s checking in. Nobody’s getting their implementations checked out. That’s almost one-third of the available unused slots is what they expected in one year. And then, truthfully, the year-two output is two months’ worth of 50% capacity, again left wide-open slots for the assessors that’s needed here. I hate to harp on this again, but the expectation for 693 active teams — roughly what’s needed to fill that — and 3,500 assessors is for the end of the entirety of the run. That’s what the expectation was, realistically, as they say. The momentum train that was happening was ready to blow that completely out of the water.

Jacob: Yeah. So, based on these numbers, they could have moved the phased rollout to the left. They could have shortened the phases based off of capacity — let alone extend the phases to give people more time — because they have increased capacity compared to what they estimated in the rule. So it’s like, okay, if they want to be nice and say “we’re going to give people more time,” that’s a different story. But they’re saying they suspended assessments because there’s not enough. And that’s just not true. It hasn’t been true at any point during the phased rollout whatsoever. And this sort of gets to a bigger question. Okay, we’re starting to hear that people are backing out of assessments, and we’re starting to hear that C3PAOs are laying off assessors. Their announcement of the suspension was in the middle of July, so these numbers don’t quite capture any slowdown that would result as a result of the news. We won’t see that until we see August, September, October numbers. It could be the case that the DoD’s plan to help the assessor shortage — which never existed — inadvertently starts to slow down the growth of the ecosystem that they said they needed to grow. So I’m very curious to know what the task force is going to say when they release their findings and their plan, because if you had just said nothing, then the ecosystem would have continued to scale faster than the DIB was able to take advantage of it.

Jason: Yeah, the offense could be humming along as good as possible, and one interception ruins the momentum. The interception—

Jacob: There was momentum. It’s just crazy to me.

All right, so wrapping this up. We’re doing this series of episodes on assessment capacity. We can link to the other ones before. You can go look at the numbers yourself. You can go look at the Cyber AB town hall numbers. You can go look at the statements from the DoD. You can look at their estimates in the rule. We’re just compiling it here for everybody to check out. So the assessor shortage narrative is really making three mistakes. First, people are treating the number of C3PAOs as the total assessment capacity. Guys, that’s never been true. Assessments can run multiple assessment teams. The actual assessment capacity metric is the total number of actual assessment teams you could field at any given time and the number of assessments they could run. Second, people are treating phased demand as instantaneous demand. The DoD never estimated that they would have to have every single company that needed a Level 2 cert to achieve their Level 2 cert by the end of the first year of the phased rollout. That was the point of the phased rollout — to phase in the demand for these assessments over time as the ecosystem scaled up. The ecosystem has scaled up faster than they thought it could. So the phased demand should actually be shorter. And—

Jason: I still think that a majority of the authoritative opposition toward what’s going on with the assessment capacity — coming from a government position saying there’s not enough assessors — goes under the impression that that is actually true. That second point you just made is actually true, where it’s instantaneous demand for November — lack of understanding of the program, and there’s no way you’re going to do the 80,000 in November when this thing goes live.

Jacob: Yeah. Yeah. And then third, right — the third mistake here — people are assuming that contractors are ready, and that they’re standing around waiting for an assessment. We’ve said it. I don’t have to go back and look at the first time we said it on the show — it’s probably two years ago. The problem with saying that there aren’t enough assessors is you’re basing it on the idea that everyone is ready for an assessment. And we all know that’s not true. And so, like you said at the beginning, let’s say you press a bunch of magic buttons and then you suddenly quintuple the number of assessors — it still won’t fix the readiness problem. Inadvertently, by blaming the assessment capacity issue and suspending assessments, you actually cause people to slow down their readiness preparation, which ends up making the problem worse. So the data does not support the claim that there aren’t enough assessors. It has never supported the claim that there aren’t enough assessors. The data shows that assessment capacity is growing, that actual certification output remains below even conservative capacity estimates for how many assessments can run per month and per year. The ecosystem, based on the data, isn’t even fully utilizing the 50% capacity model under very conservative estimates, and contractors are still struggling with implementing the requirements of DFARS 7012 while blaming CMMC assessment capacity — which is a completely different issue. And it’s sad to see the DoD and the headlines and the SBA confuse these issues and slow down the thing that they claim to want to achieve. It doesn’t make any sense. The numbers don’t line up. And I have no idea what they’re going to do when they get done with this task force, because they have set themselves back by wanting to try to fix the problem.

Jason: Yeah. So, but what if they come out and there’s a fix, and there’s no justified problem to fix it? They’re like, “Hey, you said assessment capacity is there. Here is our supporting evidence to back it up” — but there’s no supporting evidence. Wouldn’t you make those numbers up?

Jacob: Well, yeah. And that’s what I’m waiting to see. Is there some new estimate that they didn’t publish? Do they have some new data that wasn’t in the rule about how many assessments are needed? They keep saying there’s not enough assessors, there’s not enough capacity. According to your numbers and your estimates, there’s way more than enough. So how many do we need? Is there some new estimate somewhere? They keep going around giving interviews and statements and presentations saying there’s not enough. How many do we need? Because you have the numbers to map out when you’ll get to whatever that new estimate is — and it’s going to be before the ecosystem is ready to utilize that capacity.

Jason: I hate to be the one of the two of us that points out that the estimation we’re making does nothing but help their argument, right? Like, we are cutting — “hey, we estimate half the people just aren’t going to be worth anything for the assessments.” We’re trying to help your argument here, and we still can’t make your argument.

Jacob: Yeah, I mean — I just don’t know. So if you guys know where the estimate is, let us know. We’re going to do these numbers again in August. We’re going to do them again in September. And we’re doing this for a reason, because everybody out there said, “Okay, we’re pausing the program because there’s not enough assessors.” That implies that we’re going to come up with a solution for more assessors and more capacity — and that was never the problem to begin with. And we got the receipts from these episodes, which is why we’re making them. So, do you think this is a conservative enough model that these numbers make sense to everybody? Let us know down in the chat. We got plenty of time to calibrate, because the numbers don’t change once they get reported. So, like, subscribe, tell your friends to not believe everything they read in the headlines, and do the math for themselves, because the stories don’t always add up. And we’ll see you next week.

Jason: See you next week.