Ecosystem Roles: Assessors, Practitioners, Instructors
The Ecosystem Roles domain tests who is credentialed to do what, and where the independence lines fall. Items typically present a person or firm and ask which activities are permitted.
The accreditation body
The Cyber AB is the sole accreditation body recognized by DoD. It accredits C3PAOs and Licensed Training Providers, certifies individual professionals, and publishes the CMMC Assessment Process that assessors follow. It does not assess contractors and does not issue CMMC certificates.
Assessors
- C3PAO: an accredited firm that contracts with a contractor to perform a Level 2 certification assessment.
- CCP (Certified CMMC Professional): entry credential earned through training and exam; contributes to assessment teams but does not lead them.
- CCA (Certified CMMC Assessor): leads assessments; requires the CCP plus additional experience and sponsorship by a C3PAO.
- DIBCAC assessors: government personnel who assess Level 3 only.
Practitioners
Registered Practitioners and Registered Practitioner Organizations are consultants who prepare contractors - gap analysis, SSP writing, remediation. They register with the Cyber AB and are bound by its ethics requirements, but they may never conduct certification assessments.
Instructors
Licensed Training Providers deliver the official CCP and CCA courses, and their instructors must be approved by the Cyber AB. Teaching is a separate role from assessing; an instructor credential does not authorize assessments.
Worked example
A consultant spends eighteen months helping a defense firm write its SSP and close gaps. The firm's C3PAO later asks her to join its assessment team for that client. She must decline: she has a conflict of interest, and only a CCA working through the accredited C3PAO can assess. She could join a C3PAO and assess different clients after the conflict window clears.
Traps that cost marks
- Treating a Registered Practitioner Organization as an assessor.
- Assuming the Cyber AB performs assessments.
- Believing a CCP alone can lead an assessment team.
- Assuming instructor status confers assessment authority.
- Forgetting that conflicts apply to individuals as well as firms.