top of page

CMMC Update 11/2/2020

ISOP has registered as a Registered Provider Organization (RPO) and has Registered Practitioners (RP) who have passed the RP training as part of the ISOP’s team. An RP must be associated with a RPO and are qualified to do the CMMC Maturity Level 1 implementation (evaluate existing and/or create the required documentation for the CMMC assessor to do a CMMC assessment/audit.)

ISOP has also registered as a CMMC Third-Party Assessor Organization (C3PAO) and has CMMC assessors (CA) registered with ISOP that are trained and qualified to do CMMC assessments/audits. The C3PAO is authorized to enter into a contract with organizations to be assessed and the Certified assessors. The certified assessors are independent contractors that have passed the appropriate CMMC Training.

RPs and CPs may prepare an organization for the assessment/audit, but cannot be part of the assessment/audit team.

The current timeline, as stated in the training, is in 2021 the DoD will release only 15 RFPs that require ML-3 assessment (this has been a moving target and may still change). The ML-3 certification is required at contract award; not during the bid/selection process. It is estimated that, for the 15 ML-3 RFPs, roughly 850 subcontractors will only require ML-1 certification. However, the prime may demand their subs be ML-3.

Below are the various levels of assessors:

Certified Professional

  • Authorized to participate as an assessment team member under the supervision of a Certified Assessor

Certified CA-1 Assessor

  • Credentialed to conduct CMMC ML- assessments

  • Authorized to supervise Certified Professionals in the conduct of ML-1 assessments

Certified CA-3 Assessor

  • Credentialed to conduct CMMC-AB ML-1 and ML-3 assessments

  • Authorized to supervise Certified Professionals and CA-1 Assessors in the conduct of ML-1 and ML-3 assessments

Certified CA-5 Assessor

  • Credentialed to conduct CMMC assessment at all maturity levels

  • Authorized to supervise Certified Professionals in the conduct of any maturity level assessments

ISOP Solutions has become a C3PAO and an RPO so that we can fully support all activities from CMMC implementations to Certification by using an assortment of qualified RPs and Assessors.


bottom of page