Overbooked? How C3PAOs Scale Assessor Capacity Without a Bad Hire

"We're booked" rarely means every assessor at a C3PAO is busy. More often it means one seat can't be filled for the weeks a client wants. Sometimes there's no Lead CCA free. Sometimes there's a free CCA who can't be used, because they once helped that client prepare.

Hiring looks like the fix, and sometimes it is. But under CMMC, a hire can go wrong in ways that have nothing to do with how good the person is. This post is about finding the real gap first, and about the three ways a CMMC hire goes wrong.

Count seats, not people

Start with what one Level 2 certification assessment has to have. The rule sets the floor: "an Assessment Team must include at least two people: a Lead CCA… and at least one other CCA" (32 CFR § 170.9(b)(12)). Quality assurance is a separate seat: the person doing it "must be a CCA and cannot be a member of an Assessment Team for which they are performing a quality assurance role" (§ 170.9(b)(13)).

So the minimum is three CCAs, one of them a Lead, and one of them kept off the team. Certified Professionals (CCPs) can add hands: they "can participate as a CCP on Level 2 certification assessments with CCA oversight where the CCA makes all final determinations" (§ 170.13(a)). They help with the work, but they don't count toward the CCAs the rule requires.

Before anyone writes a job post, name the seat that's empty. "We need more assessors" leads to a general hire. "We can't staff a Lead for March" or "our QA reviewer keeps landing on the team" leads to a specific fix, and sometimes it's one you already have.

Levers you already have

Let a Lead oversee more than one team. The CMMC Assessment Process (CAP) says plainly that "a Lead CCA may oversee multiple Assessment Teams across concurrent CMMC Level 2 certification assessments" (CAP v2.0, Roles and Responsibilities). If your Lead is the bottleneck but your CCAs aren't, that's room you may not be using. It isn't a license to spread a Lead thin: the C3PAO still has to run quality reviews that include "observations of the Assessment Team's conduct" (§ 170.9(b)(14)), and a thinly supervised team will show.

Rotate quality assurance. Any CCA who isn't on a given team can review it. Two teams running in the same month can review each other's work, as long as nobody reviews their own.

Use CCPs where they help. Evidence logistics, note-taking and preparing artifacts for review all go faster with a CCP on the team. A CCA still makes every determination.

None of this adds a CCA. But if the gap was a scheduling gap rather than a headcount gap, it may close it.

Three ways a CMMC hire goes wrong

When the gap really is people, a hire can still disappoint. The common ways have little to do with whether the person is good.

1. They're conflicted out of the clients in your queue

The independence rule bars anyone from a certification assessment where they "previously served as a consultant to prepare the organization for any CMMC assessment within 3 years" (§ 170.8(b)(17)(ii)(G)). The Code of Professional Conduct reads it broadly. Its own example is someone who helped an organization prepare for a Level 1 self-assessment two years ago, who "would be precluded from serving on a C3PAO Assessment Team" for that organization's Level 2 assessment (CoPC v2.0, § 3.3).

That makes experienced hires from consulting practices tricky. The CCA who knows the regional defense base best may be conflicted out of exactly the clients in your queue. The Code lists other relationships that need disclosure too: a financial interest in the client, a teaming relationship, prior employment by the client, and family or close friendship. A hire from a large prime may be conflicted out of their former employer for that reason alone.

The check is yours to make. The CAP says managing conflicts "cannot be delegated" to the Lead CCA or the client (CAP 1.14), and the Code says neither the Cyber AB nor the CAICO "will provide impartiality advice or issue a COI 'opinion'" (CoPC § 3.3). Run a candidate's last three years against your pipeline before the offer, not after.

2. You hired a CCA to fix a Lead shortage

A CCA can't simply become a Lead after a few assessments. The Lead designation needs "at least 5 years of cybersecurity experience, 5 years of management experience, 3 years of assessment or audit experience," plus an Advanced-level DoD 8140 qualification such as CISSP or CISA (§ 170.11(b)(10)). If the empty seat is the Lead, a strong CCA hire adds capacity everywhere except where you needed it. We cover the full path in how long it takes to become a Lead CCA.

3. They can't start on day one

A credentialed assessor still has to be brought into your operation before they're useful:

• Your IT, and only yours. Assessors may "only use IT, cloud, cybersecurity services, and end-point devices provided by the authorized/accredited C3PAO," and are "prohibited from using any other IT, including IT that is personally owned" (§ 170.11(b)(7)). Every new person needs your devices and accounts set up before their first assessment.
• Your process. The CAP ties team composition to the personnel procedures your ISO/IEC 17020 accreditation requires (CAP 1.13), and you have to keep records of "monitoring, education, training, technical knowledge, skills, experience, and authorization of all personnel involved in assessment activities" for six years (§ 170.9(b)(9)).
• Tier 3 for anyone without one. Every CCA already holds a favorable Tier 3 determination, but anyone else "participating in the Level 2 certification assessment process" needs one too (§ 170.9(b)(3)). The Cyber AB told its August 2026 Town Hall that DCSA's process "takes exceedingly long to adjudicate." If your plan is to grow assessors from your own staff, that clock starts long before their first assessment.

None of this argues against hiring. It argues for counting the months before a hire covers a seat, and for knowing which seat it will cover.

Match the fix to the gap

Once you know the seat and the timing, the choice is usually clear:

The C3PAOs that grow without regrets tend to do it in that order: find the empty seat, use the room the rules already give them, and then add people to cover a specific gap.