CMMC Assessment Process (CAP)

INTRODUCTION TO THE CMMC ASSESSMENT PROCESS (CAP)

The Cybersecurity Maturity Model Certification (CMMC) Program is the U.S. Department of Defense’s (DoD) initiative for the assessment and certification of conformance to established security requirements by companies and organizations within the Defense Industrial Base (DIB).2 Specifically, CMMC is designed to safeguard Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) that is processed, stored, and/or transmitted during the performance of DoD contracts.

The CMMC Program is overseen by the Office of the DoD Chief Information Officer (ODCIO) and administered by the CMMC Program Management Office (CMMC PMO). The Cyber AB is the designated sole Accreditation Body for the CMMC Program. The Cyber AB supports the CMMC Program through a no-cost contract with DoD’s Washington Headquarters Services (WHS).

Most of the official CMMC doctrine and documentation is provided within the Code of Federal Regulations (CFR) or by DoD and the National Institute of Standards and Technology (NIST) within the Department of Commerce. For example, the actual CMMC Level 2 security requirements themselves are codified within the NIST Special Publication 800-171, Revision 2 (NIST SP 800-171 R2), “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations”. The CMMC Scoping Guides and Assessment Guides that are developed, maintained, and published by DoD provide supplemental guidance and insight consistent with authoritative references for establishing the assessment boundaries as well as for evaluating the implementation of CMMC security requirements, respectively.

The CMMC Assessment Process (CAP), by comparison, is the official procedural guide for CMMC Third-Party Assessment Organizations (C3PAOs) conducting a CMMC Level 2 certification assessment (herein also referred to as an “assessment”) of an Organization Seeking Certification (OSC). The CAP is published and maintained by The Cyber AB and reviewed and approved by the CMMC PMO. It is intended as a resource for the entire CMMC Ecosystem, as well as for companies and organizations within the DIB.

The purpose of the CAP is to ensure the consistency and integrity of CMMC Level 2 certification assessments. Adherence to the CAP is required by C3PAOs and their CMMC Certified Assessors (CCAs) and is an element of the C3PAO Accreditation Scheme. The CAP is not to be confused with references to a generalized CMMC “assessment process” that appear in the Code of Federal Regulations (CFR), Title 32, part 170.

How to Use the CAP

The CAP applies only to the conduct of CMMC Level 2 certification assessments.

The CAP must be used in concert with the authoritative CMMC source material—32 CFR part 170 and those documents included by reference therein—as well as the supplemental CMMC guidance published by DoD. It neither replaces nor supersedes any requirements or directions contained in those documents. Moreover, the CAP does not reproduce nor reinterpret any of the rules, provisions, or procedures from either authoritative references or DoD supplemental guidance. Rather, it cites and references those documents throughout. Accordingly, C3PAOs and their CMMC Assessment Teams will need active access to the authoritative documents, along with the CAP, when conducting a CMMC Level 2 certification assessment.

The CAP addresses pre-assessment “preliminary proceedings” that are then followed by the actual assessment process, which is organized across four (4) phases and describes the required activities, roles, and responsibilities of CMMC assessment participants in each.

The four phases are:

• Phase 1: “Conduct the Pre-Assessment”;
• Phase 2: “Assess Conformity to Security Requirements”;
• Phase 3: “Complete and Report Assessment Results”; and
• Phase 4: “Issue Certificate and Closeout POA&M”.

These four phases have been designed to support each CMMC Level 2 certification assessment meeting the following objectives:

• Achieve the highest possible accuracy, fidelity, and quality of CMMC Level 2 certification assessments conducted by C3PAOs;
• Maximize consistency to ensure that CMMC Level 2 certification assessments conducted by C3PAOs and their CMMC Certified Assessors follow the same procedures, sequencing of activities, and production of verifiable results; and
• Instill trust and confidence in the CMMC Program by providing effective, transparent, and efficient CMMC Level 2 certification assessments that are well-planned, executed in consistent fashion, and accurately reported.

The CAP provides a logical and practical sequencing of activities and actions throughout the four phases of the assessment process to ensure procedural coherence for the parties. In certain sections of the process, a precise sequence of specific actions may be explicitly mandated in the document. In these instances, the text will make clear the necessity of following certain procedures in a manner of specific order. In all other aspects of the CAP, the C3PAO and the OSC have the latitude and flexibility to conduct the CMMC assessment with a reasonable approach of their own when applied to the general sequencing of actions throughout the preliminary proceedings and four phases.

ROLES AND RESPONSIBILITIES

A CMMC Level 2 certification assessment requires the active engagement, communication, and attention of several key individuals or organizations, which may include:

As defined in 32 CRF §170.4:

• Organization Seeking Certification (OSC)
• Affirming Official
• CMMC Third-Party Assessment Organization (C3PAO)

‒Assessment Team members

• Accreditation Body (The Cyber AB)
• CMMC Assessor and Instruction Certification Organization (The CAICO)

Other relevant individuals not directly defined in 32 CRF §170.4:

• Authorized Certifying Official: A designated official employed by the C3PAO and registered with The Cyber AB who is eligible to serve as the issuing authority and signatory for the CMMC Level 2 Certificate of CMMC Status provided to the OSC. C3PAOs may designate more than one Authorized Certifying Official.
• Lead CCA: The CMMC Certified Assessor (CCA) who satisfies the requirements of 32 CFR §170.4(b)(11) and who oversees and manages a dedicated Assessment Team on behalf of the C3PAO for the conduct of a CMMC Level 2 certification assessment. The Lead CCA serves as the counterpart to the Affirming Official. Lead CCA is a formal qualified designation issued by the CAICO. A Lead CCA may oversee multiple Assessment Teams across concurrent CMMC Level 2 certification assessments.
• OSC Point of Contact (OSC POC): The individual within or on behalf of the OSC who provides daily coordination and liaison support between the OSC and the Assessment Team. The OSC POC does not necessarily have to be an employee of the organization that is being assessed, but rather could be a contractor, consultant, or advisor, such as a CMMC Registered Practitioner (RP).
• quality assurance (QA) individual: An individual who manages the C3PAO’s quality assurance reviews for a CMMC Level 2 certification assessment, which includes observing the Assessment Team’s conduct and management of the assessment. A QA individual also manages a CMMC appeals process that might be initiated by an OSC. 4 A QA individual must be a CCA and cannot be a member of an Assessment Team for which they are performing a quality assurance role. A QA individual is also responsible for the uploading of assessment information into the CMMC instantiation of eMASS.