12.3 CAP Phase 4: Certificate Issuance & POA&M Closeout

12.3 CAP Phase 4: Certificate Issuance & POA&M Closeout

Phase 4 is Issue Certificate and Close Out POA&M. Phase 3 already covered results composition, independent QA, out-brief, and upload to CMMC eMASS. Phase 4 completes certificate and conditional-status work through the correct C3PAO and OSC roles.

Certificate issuance

For a qualifying result, the C3PAO confirms that reporting prerequisites are satisfied and uses the authorized certificate template. The C3PAO Authorized Certifying Official signs and issues the certificate.

The certifying official is not automatically the Lead CCA. The Lead CCA led assessment-team work; the QA individual independently reviewed and uploaded results; the certifying official issues the organizational certificate. The Cyber AB provides accreditation governance and applicable templates but does not personally issue every OSC certificate. ISACA certifies individuals, not OSC Level 2 status.

The certificate represents the named organization, identifiers, assessment scope, level, status, and dates. It does not endorse out-of-scope systems, future acquisitions, products, or affiliates. Marketing must not enlarge its meaning.

Evidence integrity and retention

CAP requires the OSC to create hash values for assessment artifacts using a NIST-approved hashing algorithm and retain the underlying artifacts for six years. Hashes support later integrity comparison without placing every raw artifact in the reporting system. C3PAO QA ensures that required hashing information is represented in the result package.

Do not claim that a C3PAO computes SHA-256 for every artifact. CAP assigns artifact control and retention to the OSC and does not reduce the rule to one named algorithm for all time. Evidence may contain CUI, proprietary configurations, vulnerabilities, or personal data and must remain in authorized storage with access, transmission, and disposal controls.

The C3PAO separately retains all assessment-related records for six years unless the CMMC PMO authorizes another disposition, as required by 32 CFR §170.9(b)(9). Hashing protects integrity; it does not encrypt content, prove truth, or remediate a deficiency.

Final status

When all requirements are MET and the reporting and certificate steps finish, the OSC receives Final Level 2 (C3PAO) status for the assessed scope and applicable three-year period. The OSC's Affirming Official submits the required affirmation in SPRS and repeats it annually.

The affirmation is not signed by the Lead CCA or certifying official. It is the assessed organization's statement that it implemented and will maintain all applicable requirements for every system in the assessment scope. False affirmation creates legal and contractual risk.

Conditional status and closeout

If the initial result meets §170.21 and eligible deficiencies remain, the OSC receives Conditional status with a POA&M. Closeout addresses only the requirements on that original POA&M and must succeed within 180 days of the Conditional Status Date.

For Level 2 C3PAO, an authorized or accredited C3PAO conducts the closeout. It applies all applicable objectives and requires evidence of implemented, operating corrections. A planned setting, purchase contract, or management promise does not prove operation.

After successful closeout, results and quality steps proceed through the authorized process, Final status and certificate records are issued as applicable, and the Affirming Official submits the closeout-related affirmation. If even one item remains unmet at day 180, Conditional status expires.

Role matrix

Annual affirmation versus reassessment

A Final Level 2 certification status is generally valid for three years, subject to continuing implementation and annual affirmation. The yearly event is an affirmation, not a full C3PAO reassessment. A new triennial assessment is required at the end of the period, and material scope or contract changes may require earlier action.

Level 1 differs: the self-assessment itself is annual. Level 2 Self and Level 2 C3PAO assessments are triennial. All statuses require the applicable continuing affirmation. Keep these facts separate.

Closeout evidence example

Suppose a POA&M lists a deficient removable-media restriction. The OSC updates policy, configures endpoint controls, deploys them to the in-scope population, trains users, and creates logs. At closeout, the C3PAO does not merely accept the completed ticket. It examines policy and configurations, selects a focused sample, tests or observes the mechanism as appropriate, and verifies all assessment objectives. Evidence and hash references enter the controlled record. Only a supported MET determination closes the item.

Closing sequence

The assessment team finishes evidence work. QA approves the package and uploads results in Phase 3. In Phase 4, the Authorized Certifying Official signs the certificate. The OSC retains hashed artifacts and the Affirming Official attests in SPRS. If the result was Conditional, the authorized C3PAO reassesses only the listed items within 180 days. That sequence is the exam-safe model.