11.1 CAP Preliminary Proceedings & Phase 1 Pre-Assessment

11.1 CAP Preliminary Proceedings & Phase 1 Pre-Assessment

CAP 2.0 separates Preliminary Proceedings from the four numbered phases. This matters because older summaries fold contracting and conflict work into “Phase 1 Plan and Prepare” and place a kickoff there. Current CAP names Phase 1 Conduct the Pre-Assessment and places the formal in-brief in Phase 2.

Preliminary Proceedings

Before Phase 1, the C3PAO and organization address whether an engagement can be accepted and framed. Activities include receiving and understanding the assessment request, identifying the correct legal entity and identifiers, defining the intended assessment level and scope context, evaluating conflicts of interest, and establishing the contract and authorized communication.

The parties should distinguish certification assessment from readiness consulting. The C3PAO cannot promise a result, draft missing controls for the OSC, or accept an engagement that violates the Code of Professional Conduct or organizational impartiality requirements. Contract language should cover scope assumptions, locations, schedule, access, safety, confidentiality, records, changes, appeals, and responsibilities without constraining independent findings.

Phase 1: Conduct the Pre-Assessment

Phase 1 determines whether the proposed Level 2 certification assessment is sufficiently defined and ready. Core work includes:

1. Review the System Security Plan. Confirm that it describes the in-scope system, environment, boundaries, connections, implementation of all 110 requirements, and relevant providers. A missing or superficial statement is a readiness risk; the assessment team does not write it for the OSC.
2. Validate the assessment scope. Reconcile contracts and CUI flows with the asset inventory, network and data-flow information, facilities, people, technologies, CSPs, ESPs, enclaves, and the five asset categories.
3. Evaluate evidence readiness. Determine whether objective evidence is expected to be available, current, accessible, and linked to the systems and practices represented in the SSP.
4. Compose the team. Assign a Lead CCA and at least one additional CCA. Add CCAs and eligible CCPs based on size and expertise. Complete credential, Tier 3, competence, independence, and availability checks.
5. Plan assessment execution. Establish the focused sampling approach, locations, remote or onsite activities, interview roles, test safety, secure evidence handling, daily checkpoints, and schedule.
6. Complete the Pre-Assessment Form and quality steps. Capture readiness and required representations, perform the applicable C3PAO quality review, and upload the required pre-assessment record through the authorized process.

Readiness is not a certification finding

A Phase 1 readiness decision determines whether the assessment can proceed. It is not a MET determination for the 110 requirements and does not grant provisional status. An SSP can be complete enough to assess yet describe an unmet requirement; conversely, a polished SSP can fail readiness if it omits systems or conflicts with the inventory.

When critical information is missing, CAP supports resolving, postponing, or declining readiness rather than improvising. The C3PAO should document the reason and apply contract and CAP controls. A CCP or CCA may explain what evidence category is needed but must not cross into designing the OSC's remediation during a conflicted certification engagement.

Scope-validation method

Start with the contract and authorized CUI. Trace CUI through business processes and technical flows. Categorize assets; identify security-protection dependencies; include providers, remote administrators, backups, ticketing, logging, identity, and facilities; then reconcile all sources. If the SSP says one enclave but firewall evidence shows a routable enterprise trust, investigate before declaring the scope ready.

The OSC owns and proposes the boundary. The team validates it. The Lead CCA leads the work, but quality controls and organizational approval still apply.

Team and assignment limits

The minimum is not “two credentialed people.” It is specifically one Lead CCA and at least one other CCA. An eligible CCP may be added and, under current ISACA guidance, may verify Level 1 practices without making final determinations. CCP experience cannot substitute for a required CCA.

The plan assigns Level 2 work to CCAs, defines review and communication, and preserves independence between assessment and later C3PAO QA. A specialist can support a technical area only through the authorized team structure and documentation.

Where the in-brief belongs

After successful Phase 1 readiness and before evidence work in Phase 2, the team conducts the Phase 2 in-brief. It confirms participants, scope, schedule, methods, communication, safety, logistics, and expectations. Do not call it the Phase 1 kickoff gate. Daily checkpoints and the final out-brief also occur later in the CAP lifecycle.

Exam scenario

If the SSP omits twelve requirements, the right conclusion is not automatically a final NOT MET score and not automatic downgrade to Level 1. The gap prevents a defensible readiness conclusion. The team follows CAP to resolve or postpone the pre-assessment. It does not interview around the missing system description or author the statements for the OSC.