CMMC Level 2 Certification Assessment Appeals Process

1. Purpose

This process establishes the Cybersecurity Maturity Model Certification (“CMMC“) Level 2 Certification Appeals requirements and related process for an Organization Seeking Certification (“OSC“) when undergoing a CMMC Level 2 Certification Assessment by Peak InfoSec (the CMMC 3rd Party Assessment Organization (“C3PAO“)).

2. Key references

  • 32 CFR PART 170—Cybersecurity Maturity Model Certification (CMMC) Program
  • International Organization for Standardization (ISO) / International Electrotechnical Commission (IEC) 17020:2012(E), Conformity assessment — Requirements for the operation of various types of bodies performing inspection
  • The Cyber AB CMMC Assessment Process (“CAP“)
  • The Cyber AB Code of Professional Conduct (“CoPC“)
  • R2002: C3PAO Accreditation Requirements

3. scope

This Process applies to appeals of decisions made by the C3PAO or misconduct by C3PAO staff pertaining to a CMMC Level 2 Certification Assessment of an OSC.

4. key definitions

  • APPEAL: A request by the provider of the item of inspection (OSC) to the inspection body (C3PAO) for reconsideration by that body of a decision it has made relating to that item.
  • ASSESSMENT: The testing or evaluation of security controls to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting the security requirements for an information system or organization. (c.f., 32 CFR 170.4(b) “Assessment”)
  • ASSESSMENT PERIOD: The time from when the OSC provides their final set of artifacts at the start of Phase II or Phase IV of an assessment for C3PAO’s examination until C3PAO completes the Assessment of all Assessment Objectives. The Assessment Period does not include the Security Requirement re-evaluation window specified in 32 CFR §170.17(c)(2).
  • COMPLAINT: An expression of dissatisfaction, other than appeal, by any person or organization to an inspection body, relating to the activities of that body, where a response is expected
  • ERROR: A mistake committed by an Assessor or Lead Assessor such as improperly interpreting the assessment guides or incorrectly recording or interpreting evidence provided by the OSC.
  • LEVEL 2 CERTIFICATION ASSESSMENT: The activity performed by a C3PAO to evaluate the information system of an OSC when seeking a CMMC Status of Level 2 (C3PAO). Also referred to simply as a “Certification Assessment.” (c.f., 32 CFR 170.4(b)(iii) “Level 2 certification assessment”)
  • UNPROFESSIONAL CONDUCT: Actions and behavior that violate the standards or guiding principles of the Cyber AB’s Code of Professional Conduct.

5. Appeals Process

  1. The OSC must submit all appeals in writing to [email protected] no later than 21 days after the final out-brief by the C3PAO. Appeals submitted after this date will not be considered.
  2. To be considered, the submission must include all of the following information:
    1. First and last name of the appellant point of contact;
    2. Full legal name of the appellant organization;
    3. Email address and telephone number of the appellant point of contact;
    4. Statement describing the basis of the appeal, including the grievance in question and any claims of improper procedures or erroneous interpretation of policy or doctrine that may have informed the decision being appealed;
    5. Description of any steps taken to resolve the matter prior to submitting the appeal;
    6. Copy of the written notification of the decision that is being appealed, where one has been issued by the Assessment Team; and
    7. Attachment of any relevant documents or other materials that directly support the position of the appellant.
  3. The C3PAO shall respond to the OSC within one (1) business day, where the response:
    1. Acknowledges receipt of the appeal submission;
    2. Validates that the submission occurred within the 21 calendar day window; and,
    3. If the submission occurred within the 21-calendar day window, the response identifies an individual who was not part of the Assessment Team who will conduct the appeal (the “C3PAO Arbiter“) and their contact information.
  4. The C3PAO Arbiter shall estimate the amount of time involved and other related costs (e.g., travel, legal fees, etc) to investigate and adjudicate the submission.
  5. The C3PAO Arbiter shall submit the estimate to the C3PAO to initiate a Project Change Request (“PCR”) to the OSC’s Certification Assessment contract.
  6. The OSC must provide payment of all fees associated with the PCR before an appeal will be initiated by the C3PAO. The fees paid by the OSC shall be held in retainer by the C3PAO.
  7. The C3PAO will notify the C3PAO Arbiter when the PCR is approved and the C3PAO has received the OSC’s appeal retainer.
  8. The C3PAO Arbiter shall ensure CMMC eMASS has been updated to reflect an appeal has been submitted.
  9. The C3PAO Arbiter shall establish the Appeal Start Date and communicate the Appeal Start Date to the OSC and the assessment team.
  10. Beginning on the Appeal Start Date, the C3PAO Arbiter shall conduct a reevaluation of the item in coordination with the OSC and the assessment team.
  11. In the event the C3PAO Arbiter requires additional information from the OSC or the assessment team, the C3PAO Arbiter may issue a request for such information to the appropriate party.  The party must respond to the C3PAO Arbiter’s request within two (2) business days of the issuance of the request.  Failure by the party to timely respond to the C3PAO Arbiter’s request may result in the C3PAO Arbiter entering a default adjudication against the non responsive party.
  12. The C3PAO Arbiter shall provide updates to the OSC and assessment team no later than close of business on Wednesdays and Fridays until the investigation is complete.
  13. Within 21 calendar days of the Appeal Start Date, the C3PAO Arbiter shall complete their re-evaluation and provide their adjudication decision to the OSC and the assessment team.
  14. The C3PAO Arbiter shall ensure the following information is uploaded to CMMC eMASS:
    1. Any amendments to its original assessment report based upon the findings of its reevaluation
    2. The C3PAO Arbiter’s name
    3. The outcome of the appeal
  16. Upon final determination of the Appeal, the C3PAO Arbiter shall notify the C3PAO of the results. If the results are:
    1. Substantiated: The C3PAO shall return the appeal fees held in retainer to the OSC.
    2. Mutually Caused: The C3PAO shall return the appeal fees held in retainer to the OSC.
    3. Unsubstantiated: The C3PAO shall not return the appeals fees provided by the OSC.

6. appeal withdrawals

An appeal can be withdrawn by the appellant at any time until the C3PAO renders a decision. A request for an appeal withdrawal must be made in writing to the C3PAO. When an appeal is withdrawn, the C3PAO will not accept a future appeal on the same item.

7. appeal impacts to certifications

During an appeal, the C3PAO cannot issue a CMMC Level 2 Certification of Status.