Why C3PAOs Should Add Checkpoints and a Mock to the CMMC Assessment Process

The CMMC Assessment Process (CAP) tells a C3PAO exactly how to run an assessment once it starts. It says much less about the stretch between the contract and Phase 1, which is where most assessments are won or lost. We add two things to that stretch for every C3PAO we work with: status checkpoints, and an optional formal mock. We laid out the full process from the OSC’s side in the CMMC assessment process, step by step. This post is the C3PAO’s side: why the two steps pay for themselves, and how to run them without compromising your independence.

What a failed readiness review costs you

Phase 1 ends with a call only the Lead CCA can make: “The Lead CCA shall make the determination as to the readiness of the OSC to proceed” (CAP 1.10). When the answer is no, the week you reserved is gone, and the work isn’t.

And you can’t soften it with help. “Under no circumstances shall the C3PAO… offer any advice, implementation assistance, or recommendations as to how the OSC can improve,” because doing so “would conflict the C3PAO from eventually resuming the suspended CMMC certification assessment” (CAP 1.23). The client leaves unhappy, the team’s week is empty, and the engagement may or may not come back.

The fix is to find out before Phase 1, not at it.

Checkpoints: confirming, not consulting

The CAP already expects you to talk to the OSC before the assessment. The C3PAO “shall work with the Affirming Official and/or the OSC POC to determine the purview and planning details” (CAP P.8), and the two sides “should discuss and agree upon, at a minimum: Availability of personnel… Availability of evidence… OSC’s relevant documentation, including the System Security Plan (SSP)” (P.10). A status checkpoint is that conversation, held more than once.

The line you can’t cross is advice. The Code of Professional Conduct bars “any preparatory, advisory, or consulting activities” for an organization you’ll assess (§ 3.3), and the CAP bars predictions: the team “shall not speculate, intimate, nor make any preliminary determination of the OSC’s likelihood of a successful assessment outcome” (1.11). Neither rule touches confirming status. In practice the split looks like this:

What a checkpoint finds is what the OSC hasn’t done yet: the boundary change from scoping that never made it into the SSP, the MSP whose people haven’t been lined up, the evidence repository nobody has access to. The OSC fixes those with its own people or its readiness partner. You just stop being surprised by them.

What a checkpoint looks like

There’s no prescribed cadence; we hold them as often as the engagement needs, and more often as Phase 1 gets close. A typical one is short, run by the Lead CCA with the OSC’s point of contact, and follows the same agenda every time:

1. Scope. Have the changes agreed at kickoff made it into the SSP, the asset inventory and the network and data-flow diagrams?
2. Providers. Is the customer responsibility matrix settled, and have the ESP’s people confirmed they’ll take part (CAP 1.6–1.8)?
3. Access. Can the team reach the evidence repository and the systems it will need to see?
4. People. Are the control owners, administrators and the Affirming Official available on the assessment dates?
5. Schedule. Does the date still hold, and if it’s slipping, is it better to move it now than at Phase 1?

Each item is a yes, a no, or a date. When the answer is no, the Lead CCA records it and moves on. How to close it is the OSC’s job, or its readiness partner’s.

A formal mock that keeps you eligible

The second addition is an optional mock, run by the same team that will perform the assessment. Many C3PAOs assume a mock rules them out of certifying that client. It doesn’t, if it’s the right kind. The Code says a non-certification assessment creates no conflict when it’s “conducted in a formal fashion and in accordance with the assessment procedures established in 32 CFR Part 170” and the CAP, when you “shall not provide any recommendations, advice, or consultative information as to how the OSA might remediate any discrepancies,” and when the OSA “shall receive a deliverable documenting the official results” (CoPC § 3.4).

Two operational details come with it. Mock results don’t go into eMASS and carry no standing in the program. And you must “retain the results deliverables of all non-certification assessments conducted for the prior three (3) years,” available to the Cyber AB on reasonable request. A mock that slips into advice is consulting, and the rule then bars your team for three years (32 CFR § 170.8(b)(17)(ii)(G)). The difference between the two kinds is covered in what a mock assessment covers.

Contracting and pricing the mock

A mock is a separate engagement from the certification assessment, and it’s worth papering it that way. The CAP already requires a written contract for the assessment (P.17–P.18), and it rules out two things that matter here: no “guarantees” or “promises,” and no “incentives or bonus payments contingent on the issuance of a Certificate” (P.20). So the mock’s price can’t depend on how the real assessment turns out, and no one should describe the mock as a way to make sure the OSC passes.

A clean mock agreement says what it is (a non-certification assessment under CoPC § 3.4), what it isn’t (advice or remediation), what the deliverable will contain, and when it happens relative to the official assessment. Leave enough time between the two for the OSC to fix what the mock finds and resubmit its documents.

Keep the paper trail tidy, too. The rule requires C3PAOs to keep all assessment-related records for six years, including the organizations “for whom consulting services were provided” (§ 170.9(b)(9)), and the Code adds the three-year retention for mock deliverables. A file that shows each checkpoint’s agenda and each mock’s deliverable is also your best evidence that nothing crossed into advice.

How to offer it to an OSC

OSCs don’t need to be sold on passing. They need to understand what the two steps are and aren’t. Three points carry most of the conversation: checkpoints catch slips while there’s still time to fix them, without the assessment team telling them how; a formal mock shows them the real assessment before it counts, from the same people who will run it; and neither step changes the outcome rules, so the certificate they earn is exactly as credible as anyone else’s. We wrote the OSC’s view of the same process partly so C3PAOs have something to send their clients.

Mark DeBry, our Lead CCA, put the case most plainly from experience: kickoffs end with everyone confident, and too often the mock or the assessment arrives with the work unfinished. One OSC backed out three days before its assessment after skipping the checkpoints. His field notes in that post are the best argument we have.

What you get back

Fewer suspensions. A readiness problem found at a checkpoint or a mock costs the OSC a few weeks. Found at Phase 1, it costs you an assessment week and a stack of paperwork.

Cleaner Phase 2. An OSC that has been through a formal mock has its evidence organized and its people briefed, so the CAP’s sampling stays small instead of growing on weak evidence.

Settled gray areas. When the same Lead CCA runs the mock and the assessment, the questions about interpretation get raised early, not on day three of the real thing.

Clients who come back. OSCs remember the C3PAO that told them what it needed, early, and then ran the assessment it said it would.

We recommend both steps to every C3PAO we work with, and our Lead CCAs run them as part of the assessor capacity we provide. If you’re turning work down because your teams are booked, Borrow the Bench explains how that works.

Sources: Cyber AB, CMMC Assessment Process v2.0 (December 2024), P.8, P.10, 1.6–1.11 and 1.15–1.25; Cyber AB, CMMC Code of Professional Conduct v2.0 (December 2024), §§ 2.2(g), 3.3 and 3.4; 32 CFR § 170.8(b)(17)(ii)(G) and § 170.9(b).