2.3 Assessor Roles: CCP, CCA, Lead CCA, QA & Certifying Official

2.3 Assessor Roles: CCP, CCA, Lead CCA, QA & Certifying Official

A certification assessment is not performed by a generic group of “credentialed professionals.” 32 CFR part 170 and CAP assign different authority to the assessment team, Lead CCA, C3PAO quality function, and certifying official. The minimum composition rule is a frequent exam trap.

Minimum Level 2 team

For a commercial Level 2 certification assessment, the assessment team contains at least two people: one qualified Lead CCA and at least one other CCA. Additional CCAs and CCPs may participate. A CCP does not satisfy the second-CCA minimum, even when the CCP has extensive cybersecurity experience. A one-person assessment is also impermissible.

The C3PAO verifies credentials, required Tier 3 determinations, conflict checks, availability, technical competence, and coverage before finalizing the team. Team size beyond the minimum depends on scope, sites, technologies, schedule, and expertise. Focused sampling may reduce redundant testing, but it does not waive the composition rule.

CCP

A CCP has foundational program knowledge and may advise, consult, and make recommendations outside a conflicting assessment relationship. On a formal Level 2 team, current ISACA guidance permits an eligible CCP to verify Level 1 practices and contribute supporting work without making the final determination. This is narrower than the common legacy description that a CCP may independently evaluate all 110 Level 2 requirements.

A CCP can organize authorized evidence, take interview notes, identify scope questions, and communicate observations through the team within the assignment. The CCP cannot act as Lead CCA, replace the required second CCA, make the final Level 2 finding, approve C3PAO quality review, upload a package merely because of the credential, or issue a certificate.

CCA and Lead CCA

A Certified CMMC Assessor (CCA) evaluates Level 2 security requirements using the model, assessment guide, NIST SP 800-171A procedures, scope, and CAP. CCAs collect and assess evidence and participate in determinations within the authorized process.

The Lead CCA directs the assessment-team work. Duties include contributing to feasibility and readiness decisions, leading the in-brief and assessment activities, managing assignments and sampling, resolving team questions, ensuring that evidence supports each determination, overseeing daily checkpoints, and preparing or approving team deliverables assigned by CAP. Leadership does not eliminate the C3PAO's independent quality review and does not turn the Lead CCA into the OSC's consultant.

A Lead CCA should distinguish a team determination from organizational certification. The team evaluates conformity and prepares results. The C3PAO's quality system independently checks the work before official reporting and certificate issuance.

C3PAO quality individual

The C3PAO Quality Assurance individual must be a CCA and cannot be a member of the assessment team for which that individual performs QA. The QA review checks completeness, consistency, scope, personnel qualifications, findings, evidence traceability, scoring, required forms, and resolution of review issues. CAP assigns the C3PAO QA individual the upload of assessment results to CMMC eMASS after the required review and out-brief process.

QA is not a late spelling check. The categorical CCA and team-separation requirements preserve independent review; the QA individual also manages the required quality reviews and appeals process. If QA finds a material gap, the package returns through controlled correction rather than being silently accepted.

Authorized Certifying Official

After the required results, quality review, and reporting steps, the C3PAO's Authorized Certifying Official generates or approves, signs, and issues the CMMC certificate using the authorized template and process. The Cyber AB supplies ecosystem governance and templates but does not personally issue every OSC certificate. The Lead CCA does not issue the certificate solely by leading the assessment.

OSC participants and affirmations

OSC personnel supply accurate information and demonstrate implementation. The OSC's Affirming Official submits the required affirmation in SPRS after the applicable assessment or POA&M closeout and annually thereafter. This role is separate from the C3PAO certifying official. One speaks for the assessed organization; the other issues the assessment organization's certificate.

Decision matrix

Scenario method

When a scenario asks what a CCP should do after noticing a Level 2 issue, do not answer that the CCP issues a final NOT MET result. The CCP should preserve the observation and evidence within the assigned work and bring it to the qualified CCAs or Lead CCA. When asked who uploads results, do not choose the Lead CCA by default; CAP identifies the C3PAO QA individual. When asked who signs the certificate, choose the Authorized Certifying Official, not Cyber AB, ISACA, the contracting officer, or the OSC.

This separation protects impartiality and defensibility. Assessment evidence, team determination, independent quality review, certificate issuance, and contractor affirmation are linked steps, but they are not interchangeable.