There are 110 controls in CMMC Level 2. But your assessor isn’t scoring those. They’re scoring 320-plus individual assessment objectives. And buried inside each objective, there is usually a single verb that tells you exactly what kind of evidence you need to bring to the table.
When I sat down with the CMMC Level 2 Assessment Guide and cross-referenced every objective against its example evidence column, a pattern emerged: each verb maps to a specific evidence type. I started calling it the CMMC Verb Test, and it has become the single most useful framework I hand clients during readiness work.
The scoring rubric is free. It is public. And after this article, you will know how to read it
Your Assessor Scores Objectives, Not Controls
Unfortunately, everyone says “110 controls.” Vendors say it. Consultants say it. Even some C3PAOs gloss over this. But assessors don’t score controls. They score objectives. Each of those 110 controls breaks down into anywhere from one to ten or more individual assessment objectives, and every single one gets evaluated independently.
Nail five out of six objectives under one control? That control is NOT MET. The whole thing.
Think of it like hurdles. Six one-foot hurdles in a row is a completely different challenge than one six-foot wall. You cannot skip one and make up for it by clearing the others with extra height.
These objectives live in the CMMC Assessment Guide Level 2, built from NIST SP 800-171A. Every objective contains a keyword — a verb — and that verb maps directly to the type of evidence you need. It is almost like a cheat code, except it is not cheating because they published it for you.
Want the complete CMMC Verb Test Field Manual with examples and cross references?
The Documentation Keywords
When one of these verbs shows up in an objective, the assessor needs a written artifact. A real document. Not a config screenshot, not a log dump. A document that says the thing out loud.
Defined
This is the one I see people miss the most. “Defined” means there is a specific value sitting in a document somewhere — a number, a frequency, an actual parameter. When an objective reads something like “the frequency of reviews of access permissions is defined,” the assessor is going to open your policy or procedure and try to find a line that says “quarterly” or “every 90 days.”
What won’t work? “As appropriate.” “Periodically.” “On a regular basis.” Those aren’t defined. Vague fails.
Specified
A close cousin of “defined.” Means you have named something explicitly (a list, a method, a value) and committed to it in writing.
Documented
More straightforward: a formal written record has to exist. SSP, procedure, policy. The artifact is the evidence.
Established
This goes beyond a document. “Established” means a formal program exists; not just a file, but a program with roles, scope, and an owner. There is a huge gap between “we have an incident response plan” and “we have an incident response program established.” One is a PDF. The other is a living, breathing operation with people assigned to it.
Identified
This means a list exists. An inventory. Privileged accounts identified? Show the list. CUI assets identified? Hand over the inventory.
Critical cascade effect: if that list does not exist, the assessor often cannot evaluate the objectives that depend on it. No privileged account list means they cannot verify whether MFA covers all privileged accounts.
One missing artifact cascades into three or four failed objectives.
Described
Written narrative, typically in the SSP. Not just a network diagram with some arrows. Prose explaining how something works.
Developed
A completed artifact. Not the template you pulled off NIST’s website and never filled in. Not a draft with “DRAFT” in the header. A finished document. (I have seem people fail assessments because their policies still said “DRAFT”).
The Golden Rule: A policy can never satisfy an operational keyword. A log can never satisfy a documentation keyword. Match the evidence to the verb. That’s 80% of the battle.
The Operational Keywords
These are the “prove it’s actually running” verbs. The assessor doesn’t want to read about your control here. They want to see it breathing.
Monitored
The thing is happening live. Right now. Logs flowing, dashboards lighting up, alerts configured and actually firing when they should. A SIEM nobody reviews isn’t monitored — it’s abandoned.
Implemented
The technical control actually exists in your environment. Configuration export, GPO, conditional access policy, etc; it’s there and it’s switched on.
Enforced
Not just configured but actively blocking. Having a conditional access policy that requires MFA is “implemented.” Showing that someone who tries to log in without MFA actually gets bounced? That’s “enforced.” The assessor needs to see the denial, not just the rule.
Protected
A protection mechanism covers everything in scope. Not most things. Not the servers but not the workstations. Everything. The word “all” is doing a lot of silent heavy lifting in these objectives.
Performed and Conducted
Both mean the activity occurred and you can prove it. Tickets, records, scan results all exist dated and scoped. “We did a vulnerability scan” is a claim. A scan report with a timestamp and a target list is evidence.
Maintained
This verb wants a pattern over time, not a snapshot you pulled together last Tuesday. Don’t show one backup log from this morning; show three months of them. If your policy says monthly, the assessor expects to see at least three instances. If you stood up your entire compliance program in the last 90 days, “maintained” is going to be a more difficult to show. You’ll need to show the cadence was met after the time the policy became effective.
Tested
Actual test results. No amount of policy language substitutes here. Your IR plan is tested? Where are the tabletop exercise notes? Your backups are tested? Show a dated restore test with an outcome. Did it work or didn’t it?
How DIBFI handles this
DIBFI maps every NIST SP 800-171A objective to its verb-implied evidence type, surfaces the artifact gap before assessment day, and tracks the operational evidence (logs, configs, scan results) on a freshness cadence — so when the C3PAO asks for it, you can produce it in under sixty seconds.
The Context-Dependent Keywords
These last three don’t sit cleanly in either camp. Their meaning shifts depending on what’s around them in the assessment guide. You have to read the neighboring objectives to figure out what they’re really asking for.
Controlled
First question: am I controlling a technical object or a process? If it’s a technical thing (network traffic, session behavior, information flow) the assessor wants to see the config. But if it’s a process or a category, check the objectives sitting right next to it. Nine times out of ten you’ll find a “defined” sub-objective there, meaning you need the written rule AND the enforcement mechanism.
Authorized
Almost always a two-parter. You need an approval record (i.e. someone with authority formally signed off) AND the technical system actually restricts things to only what was approved. For remote access and wireless, authorization has to happen before the connection gets established. You can’t let someone connect to your VPN and then decide whether they should be there.
Reviewed
“Reviewed” almost never flies solo. Look at the objectives around it and you’ll typically find a companion that says “a defined review process exists.” The assessor is checking two things: is the review process documented, and did reviews actually happen according to that process? Who was looking at it? When? What did they do when they found something?
Quick Reference: The CMMC Verb Test at a Glance
Documentation Verbs
Operational Verbs
Context-Dependent Verbs
The Same-Story Test
Matching evidence to verbs is the bulk of the work. But there’s one more layer: every objective gets evaluated through three methods — Examine, Interview, and Test. Your paperwork, your people, and your actual systems all have to tell the same story.
If any two of those contradict each other, you have a problem.
Here’s what that looks like in practice. SSP says: “MFA is required for all remote access to the CUI enclave.” Conditional access policy screenshot shows MFA required for VPN sign-in, applied to all users. Consistent so far. Then during the interview, the IT manager says: “Oh yeah, MFA is on for VPN. We’ve got a couple legacy apps that still do basic auth but we’re working on migrating those.”
That’s a NOT MET. The SSP wrote a check the environment can’t cash. “All remote access” are the words in the document. The assessor has to verify them. When the interview reveals exceptions the SSP didn’t account for, that’s a contradiction — and contradictions fail.
The lesson: the SSP creates the test. Make sure you can pass the test you wrote for yourself. If your environment has exceptions, your SSP needs to account for them. Don’t overclaim. Describe what you actually do, then make sure you actually do it.
What to Do Next
Pick a single control in your environment — whichever one you’re most nervous about. Pull up the CMMC Assessment Guide Level 2 (it’s free on the DoD CIO website). Find the objectives underneath that control and run the Verb Test:
-
- For every documentation keyword — does the written artifact actually exist? Is it in final form?
-
- For every operational keyword — could you prove right now, today, that it’s working across all in-scope systems?
-
- Hit it with the Same-Story Test. If your SSP says one thing, your IT team says something different, and your configuration shows a third — you’ve got a gap.
The rubric is public. The verbs are telling you exactly what to bring. Now you know how to read them.
Frequently Asked Questions
Where do these verbs come from? NIST SP 800-171A and the CMMC Assessment Guide Level 2 (v2.13, DoD-CIO-00003) define each assessment objective and the example evidence the assessor is expected to walk. The verbs in those objective statements are the rubric.
If I get the verb wrong, is it always a finding? Almost always. The assessor’s job per the CAP is to evaluate each objective against the methods (Examine, Interview, Test) appropriate to the verb. Bringing a policy when the verb demands operational evidence — or vice versa — fails the objective.
Does “defined” really require an explicit number? When the objective uses “defined” with a parameter — frequency, threshold, value — yes. “Periodically” is not a defined frequency. “Quarterly” is. The assessor will look for the explicit value in your policy or procedure.
What if the objective uses two verbs? Both apply. “Authorized and reviewed” means you need the approval record (authorized), the technical enforcement (authorized), and the documented review process plus dated review records (reviewed). Both verbs add evidence requirements; neither replaces the other.
How long does the Verb Test take to apply? For a single control, 15–30 minutes. For all 110 controls and ~320 objectives, plan a multi-week pass with a CCA or RPO who can sanity-check your evidence-to-verb mapping.
Does the Verb Test apply to Level 1? Level 1’s 15 requirements come from FAR 52.204-21 and the Level 1 Assessment Guide uses the same verb conventions. The framework holds, with a much smaller scope.
Closing thought
Stop arguing about “what the assessor wants to see” and start reading what the rubric already says. The verbs are the contract. Bring the policy when the verb demands a policy. Bring the log when the verb demands a log. So the next time you open the Assessment Guide, can you tell me — control by control, objective by objective — what type of evidence the verbs are asking for?
A³ Vallum runs CMMC readiness engagements that walk every objective verb-by-verb and surface the evidence gaps before the C3PAO does. If your readiness review is six to twelve months out, reach out for a CCA’s read on what your verbs are actually asking for.
About DIBFI
DIBFI is a guided CMMC readiness platform built around the 320 NIST SP 800-171A assessment objectives — every objective tied to its verb-implied evidence type, with a live evidence locker, freshness tracking, and “Ask an Assessor” guidance when you need a CCA’s read on a specific control.
Sources
-
- CMMC Assessment Guide — Level 2, v2.13 (September 2024), DoD CIO (DoD-CIO-00003)
-
- NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information — assessment objectives and methods (Examine, Interview, Test)
-
- NIST SP 800-171 Revision 2, Protecting CUI in Nonfederal Systems and Organizations — the 110 security requirements
-
- CMMC Assessment Process (CAP) v2.0, December 2024, The Cyber AB
-
- 32 CFR Part 170, CMMC Program rule
-
- FAR 52.204-21, Basic Safeguarding of Covered Contractor Information Systems (Level 1)
