Audit of the DoD’s Process for Authorizing Third Party Organizations to Perform Cybersecurity Maturity Model Certification 2.0 Assessments

Rec. 1: The DoD OIG recommended that the DoD Chief Information Officer, in coordination with the Defense Industrial Base Cybersecurity Assessment Center Director, develop and implement a quality assurance process that will ensure that all requirements in the Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) authorization process are successfully met before a candidate C3PAO is authorized to perform Cybersecurity Maturity Model Certification Level 2 assessments.

Rec. 2.c: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify that the quality control leads (QCL) for every authorized Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) meet the certification requirement within 30 days of the date of this report, and, for any of the C3PAO's QCLs who are not certified, revoke the authorization for those C3PAOs to perform CMMC Level 2 assessments until the C3PAOs provide support the QCLs are certified

Rec. 2.e: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify the employment status of the CMMC certified assessors and certified quality control leads of all previously authorized Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAOs) using the methodology defined in Recommendation 2 .d within 30 days of the date of this report and revoke the C3PAO's authorization to perform CMMC Level 2 assessments if the employment status cannot be verified.

Rec. 5.b: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director:

Develop and implement a process to ensure Cybersecurity Maturity Model Certification Third?Party Assessment Organizations (C3PAO) immediately notify both the CMMC Program Management Office and Cyber Accreditation Body of any changes associated with any of the requirements in the C3PAO authorization process.