The Post-Dated Approval Memos
Two weeks after the closeout meeting, the OSA VP of compliance emails the C3PAO a dispute: your draft report marks practice 3.4.7, deny-by-exception, 'not met' because 14 firewall rules allow any-to-any traffic between the enclave and the corporate network. The OSA attaches approval memos signed by the CIO and dated three days after the assessment ended, plus a network diagram showing the rules are 'temporary for a migration.' Your field notes show that during the assessment, the network engineer said the rules had been in place for 11 months and no one could find an approval. The report is due to the CMMC PMO in five business days.
1. How should the C3PAO handle the dispute and the post-dated approval memos?
Read the worked answer
Conclusion: The finding stands unless the OSA can show the approval existed at the time of the assessment. The post-dated memos are remediation evidence, not assessment evidence.
- Ratings are based on evidence available as of the assessment. Memos signed three days after the assessment do not demonstrate that approvals existed while the rules were in place.
- The assessor should still check whether earlier evidence exists and was missed: email approvals, change tickets, version history, or a signed exception that predates the assessment. If so, the lead and QA may reconsider.
- The network diagram does not prove 'temporary' status. Field notes show 11 months in place and no approver identified.
- Follow the C3PAO dispute and QA process. Document the OSA submission and the C3PAO rationale in the assessment record.
- Do not make an ex parte change to the report. Any change requires lead and QA review.
2. What should the final report contain regarding this practice and the OSA's response?
Read the worked answer
Final report content:
- The finding: practice 3.4.7 not met, with objective evidence: 14 any-to-any rules, the date observed, the network engineer's statement, and the absence of approval at the time of assessment.
- The OSA response or dispute summary, recorded as an OSA comment or in the dispute record, with the C3PAO rationale for sustaining the finding.
- A risk statement: broad any-to-any rules increase lateral movement and expose CUI; the migration justification does not substitute for a documented exception.
- The post-dated memos should not be presented as assessment evidence. If included, label them clearly as post-assessment remediation information.
- The final rating remains not met.
Post-assessment: The OSA may remediate and request a new assessment. The C3PAO should not promise a different outcome. The PMO receives the final report after QA sign-off, and the assessment record, including the dispute, is retained.