The Readiness Reviewer Who Wants to Sign Off
You are a CCA employed by a C3PAO. Four weeks before a Level 2 certification assessment of a 150-person defense contractor, the assessment lead assigns you to the team. While reviewing the OSA package, you recognize the name of another CCA on the team: 13 months ago he led a readiness review for the same OSA and delivered a remediation roadmap that prioritized 22 NIST SP 800-171 practices, including the exact enclave redesign now in place. The OSA CISO emails the team: 'Since he already knows our environment, can he just confirm the fixes and sign off on those practices? It will save everyone a week.' Your program manager notes the C3PAO is behind on revenue and says the prior work was 'technical assistance, not consulting.'
1. What does the CMMC Code of Professional Conduct require you to do about this team member's assignment, and why?
Read the worked answer
Conclusion: The other CCA must be recused from assessing any practice affected by his prior readiness work, and the C3PAO must document the conflict and its mitigation.
Reasoning:
- The Code of Professional Conduct requires assessors to be objective, independent, and free of conflicts of interest, and to avoid advisory or consulting relationships with the OSA. A remediation roadmap that prioritized 22 practices and shaped the enclave design is consulting, not neutral gap review.
- The risk is not only actual bias; it is the appearance that the assessor is validating his own design. That undermines confidence in the certification.
- Revenue pressure and the label 'technical assistance' do not change the substance of the work. Recommending and prioritizing fixes creates the conflict.
- Mitigation is not 'he knows the environment, so let him confirm.' The proper mitigation is recusal, reassignment, and disclosure through the C3PAO conflict-of-interest process, with the rationale retained in the assessment file.
2. How should you respond to the CISO's request that the CCA 'confirm the fixes and sign off' on those practices?
Read the worked answer
Response to the CISO: Decline the request, politely but clearly.
- No practice can be 'confirmed' or signed off based on an assessor's prior familiarity. Each practice must be validated with objective evidence collected during the assessment: configuration exports, records, observations, and interviews with current OSA personnel.
- 'Just confirm the fixes' is advisory in effect. It would pre-judge the result and could be seen as the C3PAO providing consulting to the OSA. It also asks a conflicted assessor to validate his own recommendations.
- If the recused CCA has relevant factual knowledge, he may be interviewed as a witness or provide context to the lead, but he must not determine the rating or participate in evidence collection for those practices.
- The team lead should tell the OSA that the schedule will be adjusted and that the assessment will apply the same evidence standards as any other OSA. Document the request and the response in the assessment record.