CMMC Ecosystem, Roles, and Governance
Who owns what
The CMMC program is a Department of Defense program. Policy, requirements, and the contract clause (DFARS 252.204-7021) come from DoD, and the program is codified in 32 CFR Part 170, with the CMMC Program Management Office sitting under OUSD(Acquisition & Sustainment). DoD's own Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) performs the government-led Level 3 assessments.
The Cyber AB is the sole accreditation body recognized by DoD. It does not assess contractors. It accredits Certified Third-Party Assessment Organizations (C3PAOs), certifies individual assessors (CCP, CCA, LCCA), licenses training and publishing partners, and administers the Code of Professional Conduct.
Know the credential ladder
- CCP (Certified CMMC Professional): entry-level; may serve on an assessment team but cannot lead, sign, or independently certify.
- CCA (Certified CMMC Assessor): performs assessment activities on a team.
- LCCA (Lead CMMC Assessor): leads the team and signs the assessment report.
- Registered Practitioner (RP): an advisory/consulting credential employed by a Registered Practitioner Organization (RPO); it is not an assessor credential and carries no certification authority.
Traps
The exam loves role confusion. Watch for: "The Cyber AB certifies Level 2 contractors" (false - C3PAOs do), "CCPs may sign reports" (false), "a C3PAO may also remediate the weaknesses it finds" (false - conflict of interest), and "RPOs certify" (false - they advise).
Rule of thumb
DoD makes the rules and assesses Level 3; The Cyber AB accredits and certifies people; C3PAOs assess and certify Level 2; RPOs consult but never certify. If an answer choice gives a consultant assessment authority, it is wrong.