How to Build an ATO-Grade Evidence Package for CMMC Level 2

Before I founded AeoliTech, I spent years at Los Alamos National Laboratory helping systems achieve Authority to Operate under NIST 800-53 High. That is the most rigorous federal security baseline there is. When you carry a system through ATO at a national laboratory, you learn very quickly what separates a defensible evidence package from a pile of screenshots that an assessor will tear apart in the first hour. Those lessons translate directly to CMMC Level 2, and they are the reason our clients pass their C3PAO assessments on the first attempt.

What I Learned at LANL

At Los Alamos, the assessment process was unforgiving. The assessors were not consultants trying to help you pass. They were security professionals whose job was to find every weakness in your implementation. If your evidence was ambiguous, they interpreted it against you. If your documentation had gaps, they assumed the worst. If your staff could not explain how a control worked during an interview, the control was marked as not implemented regardless of what your SSP said.

NIST 800-53 High has over 400 controls. CMMC Level 2 has 110. The scope is smaller, but the assessment rigor under CMMC is converging toward what I experienced at LANL. C3PAO assessors are trained to use the same Examine, Interview, and Test methodology. They are looking for the same things: evidence that controls are not just documented but implemented, operating, and effective.

The Difference Between Checkbox and Defensible

A checkbox evidence package says: "We have a policy." A defensible evidence package says: "We have a policy, here is when it was approved, here is who approved it, here is evidence that staff were trained on it, here is a log showing the policy is enforced technically, and here is a recent audit showing the enforcement is working."

Evidence Organization: The LANL Method

At LANL, we organized evidence by control family, then by individual control, then by assessment objective. Every piece of evidence was tagged with metadata: the date it was collected, the system it came from, the person who collected it, and which specific assessment objective it satisfied. This sounds like overkill until you are sitting across from an assessor who asks for evidence of AC-2(3) and you can produce it in under 30 seconds.

evidence-package/
  AC - Access Control/
    AC.L2-3.1.1 - Authorized Access Control/
      EXAMINE/
        AC.L2-3.1.1_policy_v3.2_approved_2026-03-15.pdf
        AC.L2-3.1.1_azure-ad-conditional-access-export_2026-04-01.json
        AC.L2-3.1.1_access-control-list_fileserver01_2026-04-01.csv
      INTERVIEW/
        AC.L2-3.1.1_interview-guide_sysadmin-role.md
      TEST/
        AC.L2-3.1.1_unauthorized-access-attempt-log_2026-04-01.png
        AC.L2-3.1.1_least-privilege-verification_2026-04-01.pdf
    AC.L2-3.1.2 - Transaction & Function Control/
      ...
  AU - Audit & Accountability/
    AU.L2-3.3.1 - System Auditing/
      EXAMINE/
        AU.L2-3.3.1_siem-configuration-export_2026-04-01.json
        AU.L2-3.3.1_audit-policy-gpo-export_2026-04-01.html
        AU.L2-3.3.1_log-retention-policy_v2.1.pdf
      ...

This structure does three things. First, it demonstrates organizational maturity to the assessor before they even look at the content. Second, it makes the assessment faster because the assessor can find what they need without asking you to dig through a shared drive. Third, it forces you to identify gaps before the assessment because empty folders are impossible to ignore.

What Assessors Look for in the First 10 Minutes

Every assessor I have worked with, at LANL and in the CMMC ecosystem, forms an initial impression within the first 10 minutes of reviewing your evidence package. That impression colors the entire assessment. Here is what they look for:

Common Evidence Failures I Have Seen

After years of building evidence packages and reviewing others, these are the failure patterns that come up again and again:

How LANL Rigor Applies to CMMC L2

The LANL ATO process taught me that evidence quality is a function of process maturity, not effort. Organizations that have mature processes produce good evidence naturally because the evidence is a byproduct of how they operate. Organizations that lack mature processes have to manufacture evidence, and manufactured evidence always looks manufactured.

For CMMC Level 2, this means the best preparation is not assembling an evidence package. It is building the operational processes that generate evidence continuously. When your access reviews happen on schedule and are documented, you have evidence for AC controls. When your vulnerability scans run weekly and findings are tracked to closure, you have evidence for RA and SI controls. When your incident response team conducts tabletop exercises quarterly, you have evidence for IR controls.

Building Your Evidence Package: A Practical Guide

Here is the process I recommend, based on what worked at LANL and what I have refined through dozens of CMMC engagements:

The Bottom Line

The evidence package is where most CMMC assessments are won or lost. Not because the controls are hard to implement, but because proving implementation to a third party requires a level of documentation discipline that most organizations have never needed before. The lessons from LANL are simple: be specific, be current, be organized, and let your evidence tell a story of operational maturity rather than last-minute compliance.