The Consultant Who Wanted to Grade Her Own Work
Ridgeline Advisory is a 30-person security consultancy. It is a CMMC Registered Practitioner Organization and has spent 14 months helping a client, Cascade Fabrication, build its Level 2 program: writing the system security plan, configuring the enclave, and running mock assessments. Cascade's board now asks Ridgeline to also perform Cascade's C3PAO certification assessment, saying it would save six weeks and $60,000 and that nobody knows the environment better. Ridgeline's managing partner wants to accept, assigning the same two consultants who did the remediation, one of whom just earned the Certified CMMC Professional credential. A second issue has surfaced: Ridgeline's training division wants to advertise a CMMC Certified Assessor prep bootcamp and to issue its own CMMC certificates to attendees who complete it. The partner asks what is permissible before he signs the statement of work.
1. Can Ridgeline perform Cascade's certification assessment? Explain the conflict-of-interest rule and what a permissible arrangement looks like.
Read the worked answer
No - and knowing the environment well makes the conflict worse, not better.
The ecosystem separates advice from assessment. A C3PAO must be independent of the organization it assesses: it cannot assess an OSC to which it, or an affiliate, has provided CMMC consulting or remediation within the cooling-off period set in the Cyber AB's conflict-of-interest requirements. Quoting a specific duration to the client without checking the current policy is a mistake; the point is that 14 months of SSP writing, enclave configuration, and mock assessments sit squarely inside the prohibition.
Two things the partner is missing:
- Ridgeline is an RPO, not an accredited C3PAO. Even with no conflict, it could not issue a certificate. Only an accredited C3PAO, using credentialed assessors, can conduct a Level 2 certification assessment.
- The conflict travels with individuals. The two consultants - including the newly credentialed CCP - cannot serve on an assessment team for Cascade during the cooling-off period, even if a different C3PAO hires them specifically for that engagement.
Permissible arrangement: Ridgeline finishes remediation, documents the environment, and hands off to an independent C3PAO that Cascade contracts directly. Ridgeline can support Cascade's response to findings, but must have no role in the assessment itself.
2. What can Ridgeline's training division legally advertise and issue, and what must it stop doing?
Read the worked answer
Training is a licensed activity in its own right.
CMMC training that leads to a CCP or CCA credential must be delivered by a Cyber AB Licensed Training Provider using licensed instructors. The credential and the exam belong to the Cyber AB; a training company cannot issue 'CMMC certificates' to attendees, and doing so misrepresents the attendees' status to employers and to OSCs.
What must stop: issuing in-house 'CMMC certificates'; describing a bootcamp as producing a 'CMMC Certified Assessor' when completion confers no credential; and any use of Cyber AB or DoD marks that implies endorsement.
What Ridgeline can do:
- Apply to become an LTP if it wants to deliver credential-bearing training - licensed instructors, approved curriculum, and the Cyber AB's quality requirements apply.
- Sell clearly labelled non-credential training (for example, 'CMMC fundamentals for programme managers') provided the marketing states it does not lead to a Cyber AB credential.
- Tell attendees accurately that CCP eligibility requires completing licensed training and passing the Cyber AB exam - an unlicensed course does not satisfy that prerequisite, which is exactly why the misleading advertisement would also harm the students.
The commercial upside of the bootcamp does not offset the risk to Ridgeline's RPO status and its standing under the Cyber AB code of conduct.
3. Cascade wants to keep its six-week schedule. What should Ridgeline tell the board?
Read the worked answer
Be direct about what the schedule depends on and where Ridgeline can add value.
- The assessment date is set by the C3PAO's calendar, not by Ridgeline's familiarity. Independent C3PAOs book out; Cascade should contract one now and ask for an assessment readiness review before committing to a certification date.
- The evidence handoff is the real time-saver. Ridgeline can prepare an assessor-ready package: current SSP, control matrix mapped to the 110 requirements, asset inventory, configuration evidence, and a log of open items with owners. A well-prepared OSC shortens an assessment more than an assessor who already knows the site.
- The mock assessment stays legitimate. Ridgeline, as a consultant, can run readiness assessments. What it cannot do is convert that familiarity into an assessment role.
- Six weeks may be optimistic regardless. If the readiness review surfaces unresolved gaps, Cascade faces a choice between postponing and accepting findings - and a POA&M path has its own constraints (a minimum score and a closeout window).
Telling the board the truth about independence costs Ridgeline a fee but preserves Cascade's ability to obtain a valid certificate - which is the only outcome the board actually needs.