Two Sides of the Table: Why the Team That Prepares You Can't Certify You

Every CMMC Level 2 certification has two sides of the table. On one side, the people who help you get ready: they find your gaps, tell you how to close them, and help you write it down. On the other, the people who decide whether you met the requirements. CMMC doesn’t let one team sit on both sides for the same organization, and the reason is simple. Nobody should be grading their own advice.

That separation shapes who you hire, in what order, and what you can ask each of them. It’s also narrower than people often assume.

What the rule actually says

The independence rule sits in the CMMC regulation itself. It requires a conflict-of-interest policy that will “prohibit CMMC Ecosystem members from participating in the Level 2 certification assessment process for an assessment in which they previously served as a consultant to prepare the organization for any CMMC assessment within 3 years” (32 CFR § 170.8(b)(17)(ii)(G)).

Four details in that sentence do most of the work.

It’s per client. The bar applies “for an assessment in which they previously served as a consultant.” An assessor who helped one company prepare can assess a different company next month. A C3PAO can do readiness work, too: the rule requires C3PAOs to keep records on “organizations for whom consulting services were provided” (§ 170.9(b)(9)). It just can’t then certify those organizations for three years.

It covers the whole C3PAO. The Cyber AB’s Code of Professional Conduct (CoPC) applies the bar “to the C3PAO as an organization as well as to all of its Assessment Team members” (CoPC v2.0, § 3.3). Swapping in a different assessor doesn’t fix a conflict the C3PAO itself holds.

“Consulting” is read broadly. The same section covers “any preparatory, advisory, or consulting activities for any type of CMMC assessment.” Its own example: someone who helped with a Level 1 self-assessment two years earlier stays off the Level 2 team until the three years are up. Another example in the Code goes further: a C3PAO that only sold the organization CMMC policy templates 18 months earlier is conflicted, because templates are “a form of advisory activity” and the C3PAO would be “evaluating the effectiveness” of its own products (CoPC Appendix A.2).

It ends. The proposed rule had no time limit. DoD’s final rule bounded it at three years (89 FR 83168). You may still find untimed versions of the rule on secondary pages; the regulation is what binds.

Why the line exists

The Department put its reason in the rule’s preamble: the conflict rules exist “to reduce the possibility that a member of the CMMC Ecosystem acting in one capacity may bias, or be biased by, clients that are paying them to perform another CMMC related service” (89 FR 83125).

Picture it from the assessor’s chair. If they designed your boundary, they’re now judging their own scoping call. If they wrote your access control policy, a NOT MET is a finding against their own work. And if you’re paying them for both, every judgment call carries a commercial question with it. The rule removes that question, and that’s what makes a certificate worth something to the primes and contracting officers who rely on it.

What a C3PAO can still do before your assessment

Separation doesn’t mean your C3PAO has to stay silent until Phase 1. The Code draws the line around advice, not contact:

The formal mock is the interesting case. A C3PAO can run one without creating a conflict when it’s conducted “in a formal fashion” under the assessment procedures, the C3PAO gives no “recommendations, advice, or consultative information,” and you get a deliverable with the results (CoPC § 3.4). We cover the trade-off in what a mock assessment covers.

The line holds during the assessment, too. If it’s suspended at the readiness review, the C3PAO can’t offer remedial advice, because doing so “would conflict the C3PAO from eventually resuming” it (CMMC Assessment Process v2.0, 1.23). The Code also bars assessors from “soliciting business or… future consulting engagements with clients during active certification assessments” (§ 2.2(g)).

Who checks for conflicts

Not you, and not the Cyber AB. Under the CMMC Assessment Process (CAP), C3PAOs are “ultimately responsible for managing impartiality,” and that responsibility “cannot be delegated to their CMMC Assessment Team or the OSC” (CAP P.12). The C3PAO screens each team member before the assessment (1.14), and the In-Brief has to “reconfirm the absence of, or disclose, any organizational or individual conflicts of interest” (2.5). The Code adds that the Cyber AB won’t pre-clear a situation for anyone: it won’t “issue a COI ‘opinion’” (§ 3.3).

What you can do is make the screening easy. Keep a list of everyone who has advised you on CMMC in the last three years, firms and individuals, including the ones who sold you templates or tools, and give it to every C3PAO you talk to. A conflict surfaced at the first call is a swap; one surfaced at the In-Brief is a delay.

Setting up your own side of the table

The rule doesn’t say who your readiness help has to be. It can be your own staff, your MSP, a Registered Practitioner, or a readiness firm with Certified Assessors on staff. A few things are worth deciding deliberately:

1. Hire for both sides on purpose. Choose the readiness team first, and treat the C3PAO as a separate decision made with the conflict list in hand. Our checklist for choosing a C3PAO covers that second decision.
2. Know what your readiness people can’t do later. Anyone who helps you prepare, including a CCA who works for C3PAOs on other engagements, sits out your certification assessment for three years. That’s the rule working, not a gap in their service.
3. Keep them in the room. The CAP’s own definition of your point of contact for the assessment allows “a contractor, consultant, or advisor, such as a CMMC Registered Practitioner.” Your readiness team can sit on your side of the table through the assessment. They just can’t sit on the other.
4. Use the right mock at the right time. Advisory early, while you still need help with fixes. Formal, from the C3PAO, once the work is done.

Where we sit

1st Defense works on both sides of the CMMC ecosystem, which is exactly why we take the line seriously. We do readiness and continuous compliance work for organizations preparing for assessment, and our Lead CCAs and CCAs also perform Level 2 assessments for C3PAO partners, under the C3PAO’s authority. The CCAs who provide your readiness or ongoing compliance support won’t serve on your C3PAO assessment team, and we abide by the Code of Professional Conduct and manage conflicts of interest on every engagement. If you’re on the readiness side of that line now, our readiness and advisory work is where to start.

Sources: 32 CFR Part 170, § 170.8(b)(17)(ii)(G), § 170.9(b)(2) and (b)(9); 89 FR 83092 (October 15, 2024), preamble at 83125 and 83168; Cyber AB, CMMC Code of Professional Conduct v2.0 (December 2024), §§ 2.2(g), 3.3, 3.4 and Appendix A.2; Cyber AB, CMMC Assessment Process v2.0 (December 2024), P.12, 1.14, 1.23, 2.5 and the definition of the OSC point of contact.