CMMC Assessment Process - Revision history

David at 01:31, 2 March 2026

2026-03-02T01:31:14Z

← Older revision		Revision as of 01:31, 2 March 2026
Line 1:		Line 1:
	'''Source of Reference: The [https://cyberab.org/Portals/0/CMMC%20Assessment%20Process%20v2.0.pdf?ver=fEk1pUK1Fg26fVtopxv_DA%3d%3d CMMC Assessment Process Version 2.0 document] from [https://cyberab.org/ Cybersecurity Maturity Model Certification Accreditation Body, Inc.]'''		'''Source of Reference: The [https://cyberab.org/Portals/0/CMMC%20Assessment%20Process%20v2.0.pdf?ver=fEk1pUK1Fg26fVtopxv_DA%3d%3d CMMC Assessment Process Version 2.0 document] from [https://cyberab.org/ Cybersecurity Maturity Model Certification Accreditation Body, Inc.]'''

	For inquiries and reporting errors on this wiki, please [mailto:support@~~cmmctoolkit~~.org contact us]. Thank you.		For inquiries and reporting errors on this wiki, please [mailto:support@cmmcwiki.org contact us]. Thank you.

	== DISCLAIMER ==		== DISCLAIMER ==

David at 01:40, 3 April 2025

2025-04-03T01:40:32Z

David at 18:18, 24 February 2025

2025-02-24T18:18:25Z

Show changes

Wikiadmin: /* Close-Out POA&M */

2025-01-26T20:49:09Z

Close-Out POA&M

← Older revision		Revision as of 20:49, 26 January 2025
Line 411:		Line 411:
	'''4.12.''' '''The C3PAO shall follow the procedures and meet the requirements for closing out a POA&M as established in 32 CFR part 170.17(a)(1)(ii)(B).'''		'''4.12.''' '''The C3PAO shall follow the procedures and meet the requirements for closing out a POA&M as established in 32 CFR part 170.17(a)(1)(ii)(B).'''

	'''4.13.''' A quality assurance individual shall conduct a quality assurance review of the POA&M close-out upon completion by the Assessment Team. The C3PAO shall ensure that any individual(s) fulfilling this quality assurance function '''must be a CCA and cannot be a member of the CMMC Assessment Team conducting the POA&M closeout assessment for which they are performing the quality assurance function.''' <ref>32 CFR §170.9(14)</ref>		'''4.13.''' A quality assurance individual shall conduct a quality assurance review of the POA&M close-out upon completion by the Assessment Team. The C3PAO shall ensure that any individual(s) fulfilling this quality assurance function '''must be a CCA and cannot be a member of the CMMC Assessment Team conducting the POA&M closeout assessment for which they are performing the quality assurance function.'''<ref>32 CFR §170.9(14)</ref>

	'''4.14. The C3PAO quality assurance review of the POA&M closeout shall, at a minimum, incorporate quality checks on the accuracy and completeness of the evaluation of all POA&M security requirements as well as the conformance to the required reporting formats and incorporated data fields for each. The C3PAO shall conduct the quality assurance review of the CMMC POA&M closeout '''prior to''' its upload into CMMC eMASS.		'''4.14.''' The C3PAO quality assurance review of the POA&M closeout shall, at a minimum, incorporate quality checks on the accuracy and completeness of the evaluation of all POA&M security requirements as well as the conformance to the required reporting formats and incorporated data fields for each. The C3PAO shall conduct the quality assurance review of the CMMC POA&M closeout '''prior to''' its upload into CMMC eMASS.

	'''4.15. The Assessment Team may choose to offer the OSC a POA&M Out-Brief Meeting, but one is not required. The Assessment Team is required to convey the results of the POA&M closeout in writing and convey the remaining administrative next steps to the OSC.		'''4.15.''' The Assessment Team may choose to offer the OSC a POA&M Out-Brief Meeting, but one is not required. The Assessment Team is required to convey the results of the POA&M closeout in writing and convey the remaining administrative next steps to the OSC.

	'''4.16. In the event the C3PAO refutes the findings of the CMMC Assessment Team during the POA&M closeout, they retain the right to appeal the findings, results, and/or CMMC Level 2 Status decision. The process and timelines for administering and adjudicating a POA&M closeout appeal are identical to those of established in Phase 3, with the exception that the assessment appeals process of the Phase 4 C3PAO that closed out the POA&M is controlling and shall be followed.		'''4.16.''' In the event the C3PAO refutes the findings of the CMMC Assessment Team during the POA&M closeout, they retain the right to appeal the findings, results, and/or CMMC Level 2 Status decision. The process and timelines for administering and adjudicating a POA&M closeout appeal are identical to those of established in Phase 3, with the exception that the assessment appeals process of the Phase 4 C3PAO that closed out the POA&M is controlling and shall be followed.

	'''4.17. Upon conclusion of the POA&M closeout and quality assurance review, the C3PAO shall submit the POA&M closeout results to CMMC eMASS. If the POA&M was satisfactorily closed out, the C3PAO shall then issue a FINAL Level 2 Certificate of CMMC Status, utilizing the same procedures and following the same requirements as established above in activities 4.1 through 4.9.		'''4.17.''' Upon conclusion of the POA&M closeout and quality assurance review, the C3PAO shall submit the POA&M closeout results to CMMC eMASS. If the POA&M was satisfactorily closed out, the C3PAO shall then issue a FINAL Level 2 Certificate of CMMC Status, utilizing the same procedures and following the same requirements as established above in activities 4.1 through 4.9.

	== Notes ==		== Notes ==
	<references />		<references />

Wikiadmin: /* Close-Out POA&M */

2025-01-26T20:48:35Z

Close-Out POA&M

← Older revision		Revision as of 20:48, 26 January 2025
Line 411:		Line 411:
	'''4.12.''' '''The C3PAO shall follow the procedures and meet the requirements for closing out a POA&M as established in 32 CFR part 170.17(a)(1)(ii)(B).'''		'''4.12.''' '''The C3PAO shall follow the procedures and meet the requirements for closing out a POA&M as established in 32 CFR part 170.17(a)(1)(ii)(B).'''

	'''4.13.''' A quality assurance individual shall conduct a quality assurance review of the POA&M close-out upon completion by the Assessment Team. The C3PAO shall ensure that any individual(s) fulfilling this quality assurance function '''must be a CCA and cannot be a member of the CMMC Assessment Team conducting the POA&M closeout assessment for which they are performing the quality assurance function.'''<ref>32 CFR §170.9(14)</ref>		'''4.13.''' A quality assurance individual shall conduct a quality assurance review of the POA&M close-out upon completion by the Assessment Team. The C3PAO shall ensure that any individual(s) fulfilling this quality assurance function '''must be a CCA and cannot be a member of the CMMC Assessment Team conducting the POA&M closeout assessment for which they are performing the quality assurance function.''' <ref>32 CFR §170.9(14)</ref>

	'''4.14. The C3PAO quality assurance review of the POA&M closeout shall, at a minimum, incorporate quality checks on the accuracy and completeness of the evaluation of all POA&M security requirements as well as the conformance to the required reporting formats and incorporated data fields for each. The C3PAO shall conduct the quality assurance review of the CMMC POA&M closeout '''prior to''' its upload into CMMC eMASS.		'''4.14. The C3PAO quality assurance review of the POA&M closeout shall, at a minimum, incorporate quality checks on the accuracy and completeness of the evaluation of all POA&M security requirements as well as the conformance to the required reporting formats and incorporated data fields for each. The C3PAO shall conduct the quality assurance review of the CMMC POA&M closeout '''prior to''' its upload into CMMC eMASS.

Wikiadmin: /* PHASE 4 – CLOSE-OUT POA&MS AND ASSESSMENT (IF NECESSARY) */

2025-01-26T20:47:37Z

PHASE 4 – CLOSE-OUT POA&MS AND ASSESSMENT (IF NECESSARY)

@@ Line 368: / Line 368: @@
 '''3.28.''' Should the OSC refute or oppose the adjudication decision of their Assessment Appeal by the C3PAO, they may elevate their appeal to The Cyber AB. The OSC must elevate its appeal to The Cyber AB within fifteen (15) business days of receiving the adjudication decision of their Assessment Appeal by the C3PAO in writing. '''All Assessment Appeals decisions rendered by The Cyber AB are final.''' The Assessment Appeals Process of The Cyber AB may be found on www.cyberab.org.
-= PHASE 4 – CLOSE-OUT POA&MS AND ASSESSMENT (IF NECESSARY) =
+= PHASE 4 – ISSUE CERTIFICATE AND CLOSE OUT POA&M =
-The purpose of this phase is to allow OSCs that received a Conditional CMMC Level 2 Certification during Phase 3 to close out all practices validated on Plans of Action and Milestones (POA&M) during the C3PAO Assessment. With the introduction of CMMC v2.0, practice deficiencies that were documented prior to the CMMC Level 2 Assessment or created because of deficiencies found during the Assessment that meet the CMMC Scoring with DoD Assessment Scoring Methodology will be corrected post-Assessment. The final OSC POA&M must be validated in Phase 2 by the Lead Assessor and C3PAO prior to upload of the Assessment results into CMMC eMASS in Phase 3.
+'''The final phase of the CMMC Level 2 certification assessment centers on the C3PAO issuing a CMMC Level 2 Certificate of CMMC Status to the OSC, as well as closing out any Plan of Action and Milestones (POA&Ms) that might exist.'''
-== 4.1 Perform POA&M Close-Out Assessment ==
+'''The completion of Phase 4 brings the CMMC Level 2 certification assessment to its formal conclusion.'''
-=== 4.1.1 Update POA&M Closeout ===
+== Generate Certificate of Status ==
-If all practices on the POA&M Review result in a score of “MET,” the Lead Assessor will close out the Assessment using the steps in Phase 3, paragraph 3.2.2-3.2.4. Accordingly, the Lead Assessor will recommend the OSC be granted a CMMC Level 2 Final Certification.
+'''4.1.''' Upon receipt from CMMC eMASS of the confirmation of CMMC Level 2 Status (FINAL or CONDITIONAL), the UID, and CMMC Status Date following the submission of the certification assessment results, a quality assurance individual shall generate the Certificate of Status for approval and issuance to the C3PAO.
-=== 4.1.2 Update POA&M – OSC Reapply ===
+'''4.2.''' The C3PAO shall only use the standardized CMMC Level 2 Certificate of CMMC Status templates (FINAL and CONDITIONAL) that are approved and provided by The Cyber AB.
-== 4.2 Support POA&M Close-Out Assessment Appeal Resolution ==
+'''4.3.''' All C3PAO-generated Certificates of CMMC Status must be approved and signed only by an Authorized Certifying Official that is on file with The Cyber AB.
-The C3PAO holds the final interpretation authority for validating the OSC’s CMMC POA&M Close-Out findings. If the OSC feels that technical error or an ethical violation compromised the process, the OSC can submit an appeal using the Assessment Appeals Process outlined in Appendix N.
 == Notes ==
 <references />

Wikiadmin: /* PHASE 3 – REPORT RECOMMENDED ASSESSMENT RESULTS */

2025-01-26T20:35:38Z

PHASE 3 – REPORT RECOMMENDED ASSESSMENT RESULTS

Show changes

Wikiadmin: /* Address Cloud Service Providers */

2025-01-26T20:20:58Z

Address Cloud Service Providers

← Older revision		Revision as of 20:20, 26 January 2025
Line 275:		Line 275:
	::* Intact: each element of the BoE is presented in full and is not missing any critical sections, pages, or material information; and		::* Intact: each element of the BoE is presented in full and is not missing any critical sections, pages, or material information; and
	::* Established Periodicity: any element that has a temporal requirement (e.g., must be completed annually) has been completed within the specified timeframe.		::* Established Periodicity: any element that has a temporal requirement (e.g., must be completed annually) has been completed within the specified timeframe.
	::: If the Assessment Team determines that all elements of the cloud service offering’s BoE are complete, intact, and within the established periodicity, then FedRAMP Moderate Equivalency of that cloud service offering has been verified for the CMMC Level 2 certification assessment and shall be denoted as such in the assessment results.		:: If the Assessment Team determines that all elements of the cloud service offering’s BoE are complete, intact, and within the established periodicity, then FedRAMP Moderate Equivalency of that cloud service offering has been verified for the CMMC Level 2 certification assessment and shall be denoted as such in the assessment results.
	: '''2.21.2.''' In reviewing the BoE, the Assessment Team is not evaluating the CSP’s cloud service offering for conformance to the FedRAMP Moderate standard. Nor is the CMMC Assessment Team conducing a qualitative examination of any element of the BoE, including testing results. Rather, the CMMC Assessment Team is conducting a review of the BoE to verify that it is complete, intact, and within established periodicity.		: '''2.21.2.''' In reviewing the BoE, the Assessment Team is not evaluating the CSP’s cloud service offering for conformance to the FedRAMP Moderate standard. Nor is the CMMC Assessment Team conducing a qualitative examination of any element of the BoE, including testing results. Rather, the CMMC Assessment Team is conducting a review of the BoE to verify that it is complete, intact, and within established periodicity.

Wikiadmin: /* Address Cloud Service Providers */

2025-01-26T20:20:43Z

Address Cloud Service Providers

← Older revision		Revision as of 20:20, 26 January 2025
Line 275:		Line 275:
	::* Intact: each element of the BoE is presented in full and is not missing any critical sections, pages, or material information; and		::* Intact: each element of the BoE is presented in full and is not missing any critical sections, pages, or material information; and
	::* Established Periodicity: any element that has a temporal requirement (e.g., must be completed annually) has been completed within the specified timeframe.		::* Established Periodicity: any element that has a temporal requirement (e.g., must be completed annually) has been completed within the specified timeframe.
	:: If the Assessment Team determines that all elements of the cloud service offering’s BoE are complete, intact, and within the established periodicity, then FedRAMP Moderate Equivalency of that cloud service offering has been verified for the CMMC Level 2 certification assessment and shall be denoted as such in the assessment results.		::: If the Assessment Team determines that all elements of the cloud service offering’s BoE are complete, intact, and within the established periodicity, then FedRAMP Moderate Equivalency of that cloud service offering has been verified for the CMMC Level 2 certification assessment and shall be denoted as such in the assessment results.
	: '''2.21.2.''' In reviewing the BoE, the Assessment Team is not evaluating the CSP’s cloud service offering for conformance to the FedRAMP Moderate standard. Nor is the CMMC Assessment Team conducing a qualitative examination of any element of the BoE, including testing results. Rather, the CMMC Assessment Team is conducting a review of the BoE to verify that it is complete, intact, and within established periodicity.		: '''2.21.2.''' In reviewing the BoE, the Assessment Team is not evaluating the CSP’s cloud service offering for conformance to the FedRAMP Moderate standard. Nor is the CMMC Assessment Team conducing a qualitative examination of any element of the BoE, including testing results. Rather, the CMMC Assessment Team is conducting a review of the BoE to verify that it is complete, intact, and within established periodicity.

Wikiadmin: /* Address Cloud Service Providers */

2025-01-26T20:20:11Z

Address Cloud Service Providers

← Older revision		Revision as of 20:20, 26 January 2025
Line 272:		Line 272:
	'''2.21.''' If the OSC represents that the CSP cloud environment supporting them within their CMMC Assessment Scope is not FedRAMP Authorized '''but meets the security requirements of FedRAMP Moderate (or higher) equivalency,''' the Assessment Team shall determine if equivalency has been attained in accordance with '''current DoD CIO policy on equivalency at the time of the OSC’s Level 2 certification assessment.'''<ref>32 CFR §179.17(c)(5)(ii)</ref>		'''2.21.''' If the OSC represents that the CSP cloud environment supporting them within their CMMC Assessment Scope is not FedRAMP Authorized '''but meets the security requirements of FedRAMP Moderate (or higher) equivalency,''' the Assessment Team shall determine if equivalency has been attained in accordance with '''current DoD CIO policy on equivalency at the time of the OSC’s Level 2 certification assessment.'''<ref>32 CFR §179.17(c)(5)(ii)</ref>
	: '''2.21.1.''' During the OSC’s CMMC Level 2 certification assessment, the Assessment Team shall verify that the CSP’s FedRAMP Moderate Equivalency body of evidence (BOE), as presented by the OSC, is complete, intact, and within the established periodicity, as required. The Assessment Team shall employ the following definitions when reviewing the BoE:		: '''2.21.1.''' During the OSC’s CMMC Level 2 certification assessment, the Assessment Team shall verify that the CSP’s FedRAMP Moderate Equivalency body of evidence (BOE), as presented by the OSC, is complete, intact, and within the established periodicity, as required. The Assessment Team shall employ the following definitions when reviewing the BoE:
	:: * Complete: all required elements of the BoE have been compiled and presented to the C3PAO for review;		::* Complete: all required elements of the BoE have been compiled and presented to the C3PAO for review;
	:: * Intact: each element of the BoE is presented in full and is not missing any critical sections, pages, or material information; and		::* Intact: each element of the BoE is presented in full and is not missing any critical sections, pages, or material information; and
	:: * Established Periodicity: any element that has a temporal requirement (e.g., must be completed annually) has been completed within the specified timeframe.		::* Established Periodicity: any element that has a temporal requirement (e.g., must be completed annually) has been completed within the specified timeframe.
	:: If the Assessment Team determines that all elements of the cloud service offering’s BoE are complete, intact, and within the established periodicity, then FedRAMP Moderate Equivalency of that cloud service offering has been verified for the CMMC Level 2 certification assessment and shall be denoted as such in the assessment results.		:: If the Assessment Team determines that all elements of the cloud service offering’s BoE are complete, intact, and within the established periodicity, then FedRAMP Moderate Equivalency of that cloud service offering has been verified for the CMMC Level 2 certification assessment and shall be denoted as such in the assessment results.
	: '''2.21.2.''' In reviewing the BoE, the Assessment Team is not evaluating the CSP’s cloud service offering for conformance to the FedRAMP Moderate standard. Nor is the CMMC Assessment Team conducing a qualitative examination of any element of the BoE, including testing results. Rather, the CMMC Assessment Team is conducting a review of the BoE to verify that it is complete, intact, and within established periodicity.		: '''2.21.2.''' In reviewing the BoE, the Assessment Team is not evaluating the CSP’s cloud service offering for conformance to the FedRAMP Moderate standard. Nor is the CMMC Assessment Team conducing a qualitative examination of any element of the BoE, including testing results. Rather, the CMMC Assessment Team is conducting a review of the BoE to verify that it is complete, intact, and within established periodicity.

← Older revision		Revision as of 01:40, 3 April 2025
Line 100:		Line 100:
	* MP.L2-3.8.4[a]: Media containing CUI is marked with applicable CUI markings.		* MP.L2-3.8.4[a]: Media containing CUI is marked with applicable CUI markings.
	* MP.L2-3.8.4[b]: Media containing CUI is marked with distribution limitations.		* MP.L2-3.8.4[b]: Media containing CUI is marked with distribution limitations.
	* PE.L1-3.10.1[b]: Physical access to organization systems is limited to authorized individuals.		* PE.L2-3.10.1[b]: Physical access to organization systems is limited to authorized individuals.
	* PE.L1-3-10.1[c]: Physical access to equipment is limited to authorized individuals.		* PE.L2-3.10.1[c]: Physical access to equipment is limited to authorized individuals.
	* PE.L1-3-10.1[d]: Physical access to operating environments is limited to authorized individuals.		* PE.L2-3.10.1[d]: Physical access to operating environments is limited to authorized individuals.
	* PE.L2-3.10.2[a]: The physical facility where organizational systems reside is protected.		* PE.L2-3.10.2[a]: The physical facility where organizational systems reside is protected.
	* PE.L2-3.10.2[b]: The support infrastructure for organizational systems is protected.		* PE.L2-3.10.2[b]: The support infrastructure for organizational systems is protected.
	* PE.L2-3.10.2[c]: The physical facility where organizational systems reside is monitored.		* PE.L2-3.10.2[c]: The physical facility where organizational systems reside is monitored.
	* PE.L2-3.10.2[d]: The support infrastructure for organizational systems is monitored.		* PE.L2-3.10.2[d]: The support infrastructure for organizational systems is monitored.
	* PE.L1-3.10.3[a]: Visitors are escorted.		* PE.L2-3.10.3[a]: Visitors are escorted.
	* PE.L1-3.10.3[b]: Visitor activity is monitored.		* PE.L2-3.10.3[b]: Visitor activity is monitored.
	* PE.L1-3.10.5[b]: Physical access devices are controlled.		* PE.L2-3.10.5[b]: Physical access devices are controlled.
	* PE.L1-3.10.5[c]: Physical access devices are managed.		* PE.L2-3.10.5[c]: Physical access devices are managed.
	* SC.L2-3.13.12[b]: Collaborative computing devices provide indication to users of devices in use.		* SC.L2-3.13.12[b]: Collaborative computing devices provide indication to users of devices in use.