under a CMMC assessment