CMMC Certified Professional vs Assessor: who may do what

CMMC Certified Professional vs Certified Assessor: which one can you hire to prepare, and which one can judge?

A defense contractor facing a CMMC requirement in a contract needs to know which credential to buy. A CMMC Certified Professional (CCP) completes CAICO training to advise and consult for organizations seeking assessment, and can join a Level 2 certification assessment only under a CMMC Certified Assessor (CCA). A CCA conducts Level 2 certification assessments for a C3PAO and makes all final determinations. The practical split is simple: a CCP can help you get ready, and a CCA can judge whether you are ready, but the two roles are not interchangeable.

The same person cannot prepare a company and then assess it. Under 32 CFR 170.8, ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within the previous 3 years. The Cyber AB also states that individuals holding both an RP or RPA designation and an assessor certification cannot assess a company they previously helped implement CMMC for. Before you sign with a consultant, ask whether any of their staff could later be placed on your assessment team, and ask for that answer in writing. Your organization still owns its controls, its System Security Plan and its evidence. The consultant helps you prepare them. Only the C3PAO issues the certification outcome.

Before you commit budget to a certification path, confirm the current status with the Department of War. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Check your contract's clause language and the DoW CIO About CMMC page for the current requirement, and ask your contracting officer whether a certification assessment is required for your work before you buy consulting or assessment services.

Which role may do which CMMC task

This table compares what a CMMC Certified Professional, a CMMC Certified Assessor and a CMMC instructor may do, from advising an organization to making final determinations on a Level 2 certification assessment. Read each row as a permission check: a role either may do the task, may take part under another person's authority, or may not do it at all. The main takeaway is that the same person can hold different roles at different times, and the conflict of interest rules decide which ones they can hold for a given company.

Task or attribute	CMMC Certified Professional (CCP)	CMMC Certified Assessor (CCA)	CMMC instructor
Advise and consult organizations preparing for assessment	Yes, after completing CAICO training and testing	Yes, subject to conflict of interest rules for the same company	No, while serving as an instructor
Take part in a Level 2 certification assessment	Yes, only under a CCA who makes all final determinations	Yes, as a team member; the Lead CCA leads the team	Yes, as an assessment team member, subject to conflict of interest rules
Make final determinations on a Level 2 certification assessment	No	Yes, the CCA makes all final determinations	Only if acting as a CCA on the team
Conduct certification assessments for a C3PAO	No	Yes, for a C3PAO	Not as an instructor role
Eligibility for the role	Completes CAICO training and testing	Must be a CCP, hold 3 years of cybersecurity experience and 1 year of assessment or audit experience, and pass a Tier 3 background investigation	Holds instructor certification issued under the CMMC program
Certification term	3 years	3 years	3 years
Path to the next role	Eligible to become a CCA	Not applicable	Not applicable
Confirm before relying on this	Check current status and term with The Cyber AB	Check the experience documentation and background investigation requirements with The Cyber AB	Check instructor rules and any changes after the 2026 suspension of CMMC Phase II

What a person must show before becoming a CMMC Certified Assessor

A CMMC Certified Assessor must clear four gates in sequence: hold the Certified Professional credential, show cybersecurity and assessment experience, meet a foundational qualification, and pass a Tier 3 background investigation. Each gate gives a buyer a specific credential to verify before trusting an assessor's findings.

Hold the CCP credential first

A person cannot become a Certified Assessor directly. They must first earn the CMMC Certified Professional credential by completing CAICO training and testing, which qualifies them to advise and consult. Buyers should ask for the CCP status of each individual on the assessment team, not just the firm's C3PAO authorization, because the assessor credential is built on top of it. Confirm that the status is current in the Cyber AB system before the assessment begins.

At least 3 years of cybersecurity experience

The rule requires a minimum of three years of cybersecurity experience before an individual can be certified as an assessor. This experience is about the security work itself, such as operating controls, administering identity systems, monitoring networks or running security programs, rather than general IT support. Ask for a résumé that shows dated roles and duties mapped to these functions, since a vague job title does not establish the experience.

Assessment or audit experience and foundational qualification

The assessor must also have at least one year of assessment or audit experience and a foundational qualification aligned to the DoD Security Control Assessor work role. Together these show that the person has tested controls against evidence before, not only operated them. A buyer should check that the audit experience involved evaluating controls and documenting findings, since that is the skill a Level 2 certification assessment depends on.

Pass a Tier 3 background investigation

Every assessor must complete a Tier 3 background investigation. This check gives the assessor access to sensitive contractor environments that hold CUI and security documentation, and it is a condition of working on the assessment. Buyers cannot see the investigation result directly, so they should confirm through the C3PAO that the individuals on the team have completed it before work begins.

A three-year certification period

Assessor certification is valid for three years, the same period that applies to instructors and CCPs under the program rules. A credential that has lapsed or is close to expiring means the person cannot lead or sign off on an assessment at that time. Check the expiration date on each individual's record during procurement, and ask the C3PAO how it tracks renewals across its team.

Why a CCP who helped you prepare cannot assess you

A CMMC Certified Professional who helped you prepare for an assessment cannot take part in your Level 2 certification assessment. Under 32 CFR 170.8(b)(17)(i)(G), CMMC ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within the previous 3 years. The rule reaches beyond the individual who wrote your plan. Any ecosystem member who advised your organization on readiness in that window is excluded from your assessment team, so a firm that prepared your environment and a CCP who joins the C3PAO's team for your assessment cannot both be part of the same engagement. Confirm the look-back period against the current eCFR text before you sign anything, because the period is the number that decides which people you can hire.

The Cyber AB adds a stricter position for people who hold both a Registered Practitioner or Registered Practitioner Advanced designation and an assessor certification. In its view, such a person cannot assess a company they previously helped implement CMMC for. That position applies to the individual, so a consultant with dual credentials may be unavailable to assess your organization even if the regulatory look-back has passed. Ask the C3PAO and every consultant on your team to state in writing which roles each person has held for your organization, the dates of those roles, and whether any of those people hold both an RP or RPA designation and an assessor certification. A written answer gives you a record to show a sponsor or contracting officer if questions arise.

Treat the written confirmation as a gating step in procurement, not a formality. Ask the assessor to confirm that no member of the proposed assessment team advised your organization, and ask your consultant to confirm which assessment-related roles it has held for you and which individuals it supplied. Keep these statements with your assessment file and update them if the team changes. If a person you want to use as a CCA has also worked on your remediation, the safe choice is usually to replace that person on the assessment side, and you should plan for that replacement early. Assessors may not be able to tell you how a conflict would be resolved, so put the question to the C3PAO and to The Cyber AB's published guidance before you finalize a schedule.

Who does what on each side of the consulting and assessing line

The defense contractor owns its CMMC environment, its controls and the evidence that shows those controls work. Its leadership carries the obligations that cannot be delegated, including the Affirming Official's responsibility for the accuracy of affirmations and SPRS entries. Consultants and implementation partners can design, configure and document systems, but the contractor decides what is in scope, accepts or rejects recommendations and operates the controls after the assessment ends.

Ownership of controls: The contractor decides how each Level 2 requirement is met in its environment and keeps that decision with its own staff.
Evidence in final form: Policies, logs, configurations and records must exist as finished artifacts. Drafts prepared by an advisor do not count as evidence.
Affirmations and submissions: The Affirming Official signs the affirmations and oversees posting of results. No consultant or assessor can make that statement for the company.
Outsourcing: The contractor can buy implementation labor, managed services and tooling, but it should retain the decisions and sign-off.
Independence: The contractor must keep the assessment team separate from anyone who helped build its environment within the restricted period set by the rule.

Before engaging any firm, confirm in writing which artifacts the firm will produce, which ones your staff must own, and who signs each affirmation.

How the roles connect across a Level 2 certification assessment

The sequence separates readiness work, which consultants and internal staff may do, from the certification assessment, which only a C3PAO team led by a Lead CCA may conduct and decide. Each step closes with a named output so the independence line stays visible from selection to reporting.

Select a C3PAO and confirm independence
The organization chooses a C3PAO authorized or accredited by The Cyber AB and asks it, in writing, to confirm that its assessors have no prior role in preparing your environment. Ask the candidate which people would be on the team and whether any of them have consulted for you, because the rules bar ecosystem members from assessing an organization they served as a consultant to prepare for any CMMC assessment within the previous 3 years. The output is a signed engagement letter and a written independence statement covering named individuals. Confirm current eligibility details against the Cyber AB materials before you sign.
Complete readiness work with staff kept off the team
Your internal staff, a managed service provider or a Registered Practitioner Organization prepare the system security plan, evidence and remediation for the in-scope environment. Consultants may be Certified Professionals or Registered Practitioners, but they must not sit on the assessment team for the same organization within the restricted period. The output is a set of evidence files in final form, with each requirement mapped to the NIST SP 800-171A assessment objectives. Your Affirming Official should sign off that the readiness record reflects the actual system.
Assemble the C3PAO assessment team
The C3PAO forms a team of at least two people: a Lead CCA and at least one other CMMC Certified Assessor. CMMC Certified Professionals may also join, but only under a CCA who makes all final determinations. The organization should receive the roster and confirm that no member previously helped implement CMMC for it. The output is a confirmed team roster and an assessment plan that names who will examine each requirement.
Examine evidence and score each requirement
The assessment team reviews interviews, examinations and tests against the NIST SP 800-171A objectives. A requirement is scored MET only when all applicable objectives are satisfied with evidence in final form, not drafts. Certified Professionals may gather and organize material, but the Lead CCA makes every scoring decision. The output is a scored assessment record that the Lead CCA reviews before any result leaves the team.
Report the outcome through the C3PAO
The C3PAO completes its assessment report and submits the results through the CMMC process so that the outcome is recorded for the organization. The organization receives the report and can address any findings that remain under the applicable rules. The output is the certification outcome issued by the C3PAO, not by your consultant or your internal team. Procedural detail for each phase, including submission and reporting steps, is in The Cyber AB's CMMC Assessment Process v2.0, so confirm the exact phases there before you plan.

How the Phase II suspension changes the choice of CCP or CCA support

The Department of War suspended CMMC Phase II on 13 July 2026, so a Level 2 C3PAO certification is no longer the near-term requirement it was scheduled to become. That changes the question buyers should ask. Instead of hiring a Certified Assessor to be ready for an assessment, most defense contractors now need to decide whether a CMMC Certified Professional is worth engaging for readiness work now, whether a C3PAO assessment will be needed later, or both. The suspension also opened a 60-day review by a CMMC Reform Task Force, so the timing of any later milestone is not settled.

Phase I obligations did not change. Self-assessments, SPRS postings, annual affirmations and the DFARS 252.204-7012 obligations remain in place, and they are the obligations that apply to your contracts today. The DoW CIO *About CMMC* page says implementation may only require self-assessments at Levels 1 and 2 for now, while the eCFR text of 32 CFR 170.3(e) still carries the original four-phase schedule. Confirm which text your contracting officer relies on before you commit budget to a certification-driven plan. A CCP can help you prepare a credible self-assessment, but a CCP cannot issue a certification or make final determinations.

Before you buy support, ask each contracting officer whether the solicitation or contract requires a current CMMC status at Level 2, and whether a self-assessment score posted in SPRS is sufficient. Then match the support to the answer. If you need readiness work now, scope a CCP-led engagement with written deliverables and check that the advisor is not planning to join your later assessment team. If you expect a C3PAO assessment later, ask the assessor firm early how it will handle any consultant who helped you prepare, since the consulting ban runs for three years. Get the decision in writing so the timeline is tied to a contract requirement rather than a rumored date.

How to check a CCP, CCA or consulting firm before you sign

Before you sign with anyone, confirm credentials, firm designations, team independence, instructor conflicts and scope. Each check ties back to the rules that separate consulting from assessing, so a mistake here can cost you an assessment rather than just money.

Confirm individual credentials with The Cyber AB

Ask for each person's full name and certification type, then look up their current status in The Cyber AB directory yourself rather than relying on a slide or a resume. A CMMC Certified Professional may advise and consult and may join a Level 2 assessment under a CCA, but only a CMMC Certified Assessor can conduct a certification assessment. Certifications last 3 years, so check that the credential has not lapsed. Ask the individual, in writing, which role they will hold on your engagement.

Confirm the firm's RP or RPO designation

Ask whether the firm is a Registered Practitioner Organization and whether its staff hold Registered Practitioner or Registered Practitioner Advanced designations. These are Cyber AB designations for implementation consultants, not assessment credentials, and a firm holding one is not authorized to issue a CMMC assessment result. Check the designation status in the Cyber AB directory and ask which named people on the proposal hold it.

Ask whether the same people would assess you

Ask directly whether anyone on the consulting team could later sit on your assessment team. Under 32 CFR 170.8, ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within the previous 3 years. The Cyber AB also says that people holding both an RP or RPA designation and an assessor certification cannot assess a company they helped implement CMMC for. Get the answer in writing, with the names of anyone who would be excluded.

Check instructors for a consulting conflict

If the proposed people teach CMMC courses, ask whether they are also offering consulting on the same engagement. Under 32 CFR 170.12, CMMC instructors may not provide CMMC consulting services while they serve as instructors. An instructor may still serve on an assessment team, subject to conflict of interest rules, so confirm that no one is both instructing and advising your organization. Ask the firm to name any instructor on the team and state how that person's role is separated from the consulting work.

Get the scope in writing before work starts

Require a written scope that lists the deliverables, the named people doing the work, what the firm will not do, and who owns each evidence artifact. A consultant can prepare your system security plan and evidence, but the Affirming Official must own the attestation, and an assessor cannot make promises about the result. Ask the firm to confirm that its scope excludes assessment decisions. Treat any guarantee of a passing score or certification as a warning sign.

Questions buyers ask about CMMC Certified Professionals and Assessors

Can a CMMC Certified Professional assess my company?

No. A CMMC Certified Professional (CCP) cannot lead or issue a Level 2 certification assessment on its own. Under 32 CFR 170.13, a CCP may take part in a Level 2 certification assessment only under a Certified Assessor (CCA), and the CCA makes all final determinations. A CCP's role is to advise and consult, after completing CAICO training and testing. Confirm the current text in the eCFR entry for 32 CFR 170.13 and check any individual's status with The Cyber AB before you rely on it.

Can the consultant we hired become our assessor?

Generally no, for the same company. Under 32 CFR 170.8, a CMMC ecosystem member may not take part in a Level 2 certification assessment of an organization it served as a consultant to prepare for any CMMC assessment within the previous three years. The Cyber AB also states that people who hold both an RP or RPA designation and an assessor certification cannot assess a company they helped implement CMMC for. Ask any consultant in writing whether its staff will be eligible to assess you, and keep implementation and assessment staff separate from the start.

What experience must a CMMC Certified Assessor have?

A CCA must hold a CCP certification and meet several experience and eligibility requirements under 32 CFR 170.11. The rule requires at least three years of cybersecurity experience, at least one year of assessment or audit experience, and a foundational qualification aligned to the DoD Security Control Assessor work role. The assessor must also complete a Tier 3 background investigation. These requirements shape who your C3PAO can staff, so ask which assessors are proposed and how each qualifies, then verify their status through The Cyber AB.

How long are CCP and CCA certifications valid?

Both certifications last three years. Under 32 CFR 170.13 and 170.11, a CCP or CCA must maintain the credential over that period, and the eCFR text governs the renewal details. Instructor and assessor certifications are also valid for three years under 32 CFR 170.12. Because certifications expire, check status at the time of your assessment rather than relying on a credential shown in an older proposal.

Do I need a CCA on my team if I self-assess?

No. A Level 2 self-assessment is performed by your organization, and the affirming official is responsible for the results and the Affirming Official's attestations. A CCA is required only for a Level 2 certification assessment, which a C3PAO conducts. Self-assessments still have to follow the NIST SP 800-171A assessment objectives, and a requirement counts as MET only with final evidence. If your contract requires a certification assessment, the C3PAO's assessors must hold CCA status, and you should confirm the current requirement, since the DoW has suspended Phase II milestones.

Can an instructor also consult for us?

No. Under 32 CFR 170.12, a CMMC instructor may not provide CMMC consulting services while serving as an instructor. An instructor may still serve on an assessment team, subject to conflict of interest rules. If a training provider's instructor offers to advise your team, ask how that role is separated from the course and confirm the arrangement against the eCFR text before signing any statement of work.

What does a CCP do for us that a CCA cannot?

A CCP can advise and consult with your organization in preparing for assessment, which is the work a CCA is not positioned to do for a company it may later assess. Under 32 CFR 170.13, a CCP also completes CAICO training and can take part in certification assessments under a CCA. The effort and cost of consulting depend on your environment, how much evidence exists, and whether your team can own the work. Ask any consultant to define the deliverables, who performs them, and how the engagement stays clear of the assessment team.

How DeployOpen prepares your systems and evidence without taking the assessor's role

DeployOpen is a Chainscore Labs company that plans, implements and documents self-hosted open-source platforms inside your own infrastructure. For CMMC, we prepare systems, controls and evidence so your team and your assessor can work from a clear record. We do not issue assessment reports or certificates, and we do not assess your environment.

How we scope

Engagements are fixed-scope, with the systems, boundaries and deliverables agreed in writing before work starts.
We confirm which CMMC Level 2 requirements the agreed systems must satisfy, mapped to NIST SP 800-171A objectives your team can check.
Scope also records who is paid for what, so consultant work is kept separate from the C3PAO assessment team you select.

How we build

We plan, implement, customize, integrate and harden self-hosted open-source platforms in your own cloud accounts, data centers or air-gapped networks.
We configure logging, access control, configuration baselines and backups so each control leaves evidence in final form.
We run security testing against the agreed boundary and record findings, so your team decides which remediation to accept.

How we hand over

We document system configurations, procedures and evidence collection steps in a form your staff can operate after handover.
Your Affirming Official and team own the controls, the system security plan and every attestation made to the government.
Ask your assessor, not us, whether a given artifact meets the objectives of the requirement it is meant to support.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after the initial engagement closes.
Ask for a written statement of which tasks an implementation partner performs and which an independent assessor performs.
Confirm with The Cyber AB and your contracting officer the current status of CMMC requirements before you commit to a timeline.

CMMC Certified Professional vs Certified Assessor