12.1 CAP Phase 3: Complete and Report Assessment Results

12.1 CAP Phase 3: Complete and Report Assessment Results

Phase 3 is Complete and Report Assessment Results. Phase 2 produced evidence and requirement determinations; Phase 3 turns that work into a complete, quality-reviewed, communicated, and officially reported result. Certificate issuance and POA&M closeout continue in Phase 4.

Compose the results

The assessment team reconciles the validated scope, requirement workpapers, focused samples, evidence references, daily records, provider responsibilities, limited-correction records, and scoring. Each MET result must be supported by all applicable objectives. Each NOT MET result identifies the unmet objective and applies the proper score deduction. N/A needs a documented factual basis rather than a missing artifact.

Final scope and identifiers must match the entity assessed. A report for one CAGE code or enclave cannot silently convey status to an affiliate or excluded network. Material changes discovered during fieldwork are resolved through CAP controls.

CMMC scoring is requirement-based. Level 2 begins at 110 and applies one-, three-, or five-point deductions under the DoD Assessment Methodology, including dependencies where applicable. There is no proportional credit for a subset of objectives. The ratio for conditional status is the score divided by the total number of Level 2 requirements, and every remaining deficiency must also meet §170.21.

Independent C3PAO quality assurance

The C3PAO quality function independently reviews the package. QA checks personnel and authorization, conflicts, scope consistency, required forms, evidence traceability, conclusions, N/A rationale, limited corrections, scoring, POA&M eligibility, and report consistency. Review comments are resolved through a controlled record.

The QA reviewer must be a CCA and cannot be a member of the assessment team being reviewed. That categorical separation allows unsupported determinations or reporting errors to be caught before submission. The Lead CCA answers technical questions and corrects the package when appropriate, but QA retains its assigned responsibilities.

Out-brief

After required quality steps, the C3PAO conducts the out-brief with authorized OSC representatives. It communicates the assessed scope, methodology, findings, score or status, conditional-status implications, reporting sequence, appeals process, record responsibilities, and next steps.

The C3PAO can explain the evidence basis and rule. It must not design remediation, recommend products as part of the conflicted assessment relationship, or negotiate a MET result for promised future work. Questions and disagreements follow the documented process.

Upload to CMMC eMASS

CAP assigns the C3PAO Quality Assurance individual to upload results to CMMC eMASS during Phase 3. Do not assign this automatically to the Lead CCA, a CCP, the OSC, or Cyber AB. CMMC eMASS is the assessment reporting environment; SPRS carries the contractor status and affirmation records used by the program. The OSC's Affirming Official submits an affirmation in SPRS, while C3PAO QA uploads the certification-assessment result in eMASS.

Raw CUI and proprietary artifacts are not indiscriminately uploaded. CAP uses evidence references and NIST-approved hash data so later integrity comparisons are possible while the OSC retains underlying artifacts. The OSC—not the C3PAO—hashes and retains those artifacts for six years. C3PAO QA ensures the required hashing information is represented in the result package.

Appeals

The OSC may use the C3PAO's documented appeals process. An appeal is a controlled, impartial review, not a request to conceal evidence. The organization states its basis; the C3PAO preserves records, uses personnel who satisfy independence requirements, communicates the decision, and follows applicable escalation mechanisms.

Cyber AB, DoD, a contracting officer, or a court may have separate complaint, oversight, contract, or legal processes. Do not assume that every disagreement is a Cyber AB appeal or that an appeal automatically pauses every contractual effect.

Final and conditional paths

When all applicable requirements are satisfied, the result proceeds toward Final status and the certificate steps. When the ratio is at least 0.8 and only eligible deficiencies remain, it may proceed as Conditional with an approved POA&M and 180-day closeout. If the threshold or exclusions fail, a remediation plan cannot manufacture Conditional status.

The role sequence is: CCAs complete determinations under the Lead CCA; C3PAO QA independently reviews; the C3PAO out-briefs the OSC; QA uploads results to eMASS; and appeals follow the controlled process. The Authorized Certifying Official and any closeout work follow in Phase 4.\n\n## Phase 3 quality checklist\n\nBefore reporting, compare the assessment plan, final scope, asset and provider lists, objective workbook, score sheet, Pre-Assessment Form, daily records, and report. Verify that every finding uses the same identifiers and status logic. Confirm that limited corrections are traceable, open requests are resolved, and no raw evidence was copied into an unauthorized reporting field. Recalculate the score independently and reapply every POA&M exclusion. The out-brief record should match the QA-approved result, and the eMASS upload should match both. These reconciliations prevent an administratively polished package from reporting a different entity, scope, or conclusion than the one actually assessed.