You now know about the Cybersecurity Maturity Model Certification (CMMC) but let ‘s discuss a little about the different types of people and groups associated within this ecosystem. We are going to break these individuals down into two groups. The organizations registered through the CMMC AB , and the individual people registered through the program (for now we are leaving out other ancillary categories).
Organization
C3PAO’s (Certified Third-Party Auditing Organizations)
- This is a company that has met all CMMC certification criteria and submitted the requisite documents to the CMMC AB to qualify as an organization that can contract directly with a Government Contractor for the purpose of either a pre-assessment or a certified third-party assessment. A C3PAO must always keep its independence and never place itself in a consulting mode. This is the only type of organization that can perform your third-party certification.
- Limited relationship, focused solely on third party assessment with no consultation.
- Certified Assessors and Registered Practitioners can be attached to this company.
RPO’s (Registered Provider Organizations)
- This is an organization that chooses to have a consultative relationship with the Government Contractor. An RPO will employ accredited people that can help in pre-gap reviews and recommend strategies and tactics to remediate those gaps.
- RPO’s have registered with the CMMC and if accepted will appear on the CMMC marketplace.
- F1 Solutions has chosen to go this route and can be found on the RPO marketplace. CMMC-AB | F1 Solutions Inc-RPO | Marketplace
- An RPO cannot act as a third-party assessing organization.
- Registered Practitioners will traditionally be attached to this company. F1 Solutions has several that can be found on the CMMC marketplace.
People
There are 4 distinct levels of a Certified Assessor (individual)
- Certified Professional
- Certified CA-1 Assessor
- Certified CA-3 Assessor
- Certified CA-5 assessor
In order to be a CA-3 assessor one would have to have passed the first two CMMC certifications before sitting for the third. Once they have passed the level 3 assessor testing and requirements, they could then assess any CMMC level up to level 3.
Currently we are still in the phase of the provisional assessor program. Think of this as the beta testing assessor group. Unfortunately, assessments performed by provisional assessors are not fully certified and will require a second assessment for proper CMMC certification.
A Registered Practitioner is a person that has exhibited understanding of the CMMC controls, requirements, and the auditing process. They have submitted all the requisite paperwork and have passed their RP (Registered Practitioner) exams. They will appear on the marketplace as well. F1 Solutions currently has several active RP’s. F1 Solutions is here to help guide you through all your DFARS (Defense Federal Acquisitions Regulation Supplement) and CMMC preparations. Contact us for more information.
F1 Solutions: https://www.f1networks.com/
Jennifer VanderWier/CISO
