1099 CMMC Assessor Contract Work: What C3PAOs Need to Know Before Staffing Up
C3PAOs can staff Level 2 assessments with independent-contractor CCAs, and DoD said so in the rule. What a contract assessor brings, what the C3PAO can't hand off, and what the agreement should cover.
Search for "1099 CMMC assessor" and you'll find job boards: CCAs looking for contract work. The question on the other side of that search belongs to the C3PAO. Can we staff certification assessments with contractors, and if we do, what are we still on the hook for?
The first answer is yes, and it's in the rule's own preamble. The second takes longer, because most of what matters in an assessment stays with the C3PAO no matter who is on the team.
Yes, contractors are allowed
When DoD finalized the CMMC rule, it addressed this directly: "While a C3PAO may use its own employees to staff an assessment, it also may leverage CCAs and CCPs who are independent contractors, rather than employees of a specific C3PAO" (89 FR 83126).
The Cyber AB's Code of Professional Conduct says the same from the assessor's side. Assessors may "participate on a CMMC Assessment only under the direct employment or contract of an Authorized or Accredited C3PAO" (CoPC v2.0, Appendix B.1(a)). Its first worked conflict-of-interest example is even about "a CCA affiliated with a C3PAO through a consulting/'1099' agreement" (Appendix A, Example A.1).
What a contractor can't do is work outside a C3PAO. A CCA can't take on a certification assessment on their own, and a C3PAO can't treat a contract assessor as a separate firm running part of the assessment.
What a contract assessor brings
Some requirements follow the person, not the employer, so a credentialed contractor arrives with them already met:
Certified by the CAICO, “valid for 3 years from the date of issuance.” Check current status on the Cyber AB Marketplace.
§ 170.11(b)(1)Written in because of contractors: “these independent CCAs and CCPs may not be covered by the C3PAO’s background check requirement.” More in what background-check tier a Lead CCA needs.
89 FR 83126 · § 170.11(b)(3)To “any company or organization employing or contracting you,” including “where an appearance thereof may exist.”
CoPC App. B.1(f)The Lead designation, with the years of experience behind it.
§ 170.11(b)(10)What stays with the C3PAO
The rest doesn't transfer, however the assessor is paid.
Conflicts of interest. The assessor has to disclose. The C3PAO has to decide. The CAP is blunt: managing impartiality and conflicts "cannot be delegated to the Lead CCA or the OSC" (CAP v2.0, 1.14), and the Code adds that "it is the responsibility of the C3PAO alone to ensure COI are disclosed and either mitigated or avoided" (CoPC § 3.3). In the Code's 1099 example, the contractor discloses that his brother works for the client, and the C3PAO removes him from the team and "replaces Larry with another CCA." Disclosure came from the contractor. The fix came from the C3PAO.
The methodology. The Code requires C3PAOs to follow "the procedural requirements and guidance contained within the CMMC Assessment Process" (CoPC § 2.7(b)), and quality reviews must include "observations of the Assessment Team's conduct" (§ 170.9(b)(14)). A contractor follows your process, not their own.
The equipment. Assessors may use only the IT "provided by the authorized/accredited C3PAO that has been engaged to perform that OSA's Level 2 certification assessment," and are "prohibited from using any other IT, including IT that is personally owned" (§ 170.11(b)(7)). A contractor's own laptop can't hold assessment information, however well secured it is.
The records. The C3PAO keeps assessment records for six years, including materials on the "monitoring, education, training, technical knowledge, skills, experience, and authorization of all personnel involved in assessment activities" (§ 170.9(b)(9)). That covers contractors too.
The team. The C3PAO composes the team, proposes the Lead CCA by name, and checks that Lead for conflicts with the client (CAP P.14, 1.12).
What the agreement should cover
Most of what the rules require of a C3PAO and its assessors can be written into the contract, so neither side finds out mid-assessment what was expected. This isn't a template, and your attorney will have their own structure, but these are the points we'd expect it to settle:
- ScopeWorks only on assessments the C3PAO assigns, under its authority and methodology.
CoPC B.1(a), 2.7(b) - ConflictsDiscloses any relationship with each client before assignment, and whenever one arises. The C3PAO decides.
CoPC B.1(f) · CAP 1.14 - EquipmentUses only the C3PAO’s IT for assessment information. No personal devices or cloud.
§ 170.11(b)(7) - ConfidentialityShares no outcomes or advance information with anyone not on that assessment.
CoPC B.1(i), 2.3 - CredentialsKeeps CCA or Lead status and Tier 3 current, and tells the C3PAO of any change.
§ 170.11(b)(1), (3) - RecordsSupports the C3PAO’s six-year records, including competence and authorization.
§ 170.9(b)(9) - No side dealsNo soliciting consulting work from a client during an active assessment.
CoPC 2.2(g) - PayPaid for the work, never for the result.
Our view · see CAP P.20
The last clause is our recommendation rather than a rule. The CAP bars a C3PAO from including "any incentives or bonus payments contingent on the issuance of a Certificate of CMMC Status" in its contract with the client (CAP P.20). Paying an assessor more for a pass would create the same pressure one level down.
The tax question is a separate one
None of the CMMC rules decides whether an assessor is an employee or an independent contractor for tax and labor purposes. The IRS weighs three categories of evidence: behavioral ("does the company control or have the right to control what the worker does and how the worker does his or her job?"), financial, and the type of relationship (IRS). The Department of Labor and many states apply their own tests.
That matters here because CMMC requires the C3PAO to control things those tests look at, including the methodology an assessor follows and the equipment they work on. The rules don't make a contract assessor an employee. They do mean the structure deserves a conversation with employment counsel or a tax adviser before you scale it. When the answer is unclear, the IRS lets either party ask for an official determination with Form SS-8. This post isn't tax or legal advice.
Contractor, bench or hire
Contract assessors make sense when a C3PAO needs specific seats for specific weeks and is ready to run the onboarding, conflict checks and agreements itself. If you'd rather someone else find, vet and conflict-screen the assessors, that's what borrowing a bench is for. And if the gap is a Lead CCA you'll need all year, hiring may still be right. We look at how to tell those gaps apart in how C3PAOs scale capacity without a bad hire.