DODIG-2025-056 - Recommendation D-2025-0056-D000CR-0001-0002.c

Rec. 2.c: The DoD OIG recommended that the Cybersecurity Maturity Model Certification (CMMC) Program Management Office Director direct the contracting officer to modify the contract with the Cyber Accreditation Body to require the Cyber Accreditation Body (Cyber AB) to:

Verify that the quality control leads (QCL) for every authorized Cybersecurity Maturity Model Certification Third?Party Assessment Organization (C3PAO) meet the certification requirement within 30 days of the date of this report, and, for any of the C3PAO's QCLs who are not certified, revoke the authorization for those C3PAOs to perform CMMC Level 2 assessments until the C3PAOs provide support the QCLs are certified