CMMC Ecosystem, Roles, and Code of Professional Conduct
Who owns what
CMMC is a DoD program codified in 32 CFR Part 170. Policy and program management belong to OUSD(A&S) and the CMMC Program Management Office; contracting officers and requiring activities use an organization's CMMC status in award decisions. The CMMC Accreditation Body (The Cyber AB) is a private, independent body that accredits C3PAOs and certifies individuals (CCP, CCA, CCI). It does not perform assessments and does not write DoD policy.
The organization seeking certification (OSC) owns its scope, its remediation, and the senior official's annual affirmation. A Certified Third-Party Assessment Organization (C3PAO) employs certified assessors and conducts Level 2 certification assessments. A Certified CMMC Professional (CCP) may serve on a team but cannot lead it; a Certified CMMC Assessor (CCA) can lead an assessment and is accountable for the determinations.
Levels in one line each
Level 1: 15 practices drawn from FAR 52.204-21, annual self-assessment and affirmation. Level 2: 110 NIST SP 800-171 requirements, either self-assessment or a C3PAO certification assessment. Level 3: NIST SP 800-172 requirements, assessed by the Government.
Trap patterns
Role confusion is the most common trick: the Cyber AB does not assess, the C3PAO does not implement fixes, and the contracting officer does not decide whether a practice is met. Conflict of interest is second: an assessor or C3PAO that consulted on the environment it now assesses has lost independence and must disclose and withdraw. Confidentiality covers all CUI seen during the assessment; competence means staying inside the methodology rather than opining beyond the evidence.
Rule of thumb: provider, assessor, consumer - a party may fill only one of those roles for a given environment.