An OSC has recently obtained an ISO 27001 certification and a FedRAMP Authorization to Operate (ATO) for its information systems. During the initial…

The CMMC framework does not grant automatic reciprocity, credit, or exemption based on other certifications like ISO 27001 or a FedRAMP ATO. While the evidence and controls implemented for these achievements are valuable and can likely be reused to demonstrate compliance with CMMC practices, they do not substitute for a formal CMMC assessment. The Lead Assessor must independently verify that each CMMC practice is met according to the CMMC Assessment Process (CAP). The assessor's professional responsibility is to clearly communicate this established policy to the Organization Seeking Certification (OSC) and manage expectations for the assessment.

A. "Disregarding the claim" is unprofessional. The assessor must actively inform the OSC of the correct policy to set proper expectations for the assessment.

B. The policy on reciprocity is already established. Consulting the Cyber AB is unnecessary and demonstrates a lack of fundamental knowledge by the assessor.

C. Accepting the claim and granting credit violates the CMMC assessment methodology, as there is no provision for automatic reciprocity from other certifications.

1. CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.0, The Cyber AB, December 2022. Section 2.2, "Assessment Inputs," details the required documentation for an assessment. It does not list other certifications as a substitute for providing objective evidence for each CMMC practice. The entire document outlines a process of direct verification.

2. DoD, CMMC 2.0 Program, "FAQs", (dodcio.defense.gov/CMMC/FAQ/). The DoD frequently clarifies that CMMC is the single verification standard for protecting CUI. While based on NIST standards that overlap with others, it requires its own specific assessment and certification. For example, the FAQ "How does CMMC 2.0 relate to NIST SP 800-171?" clarifies the direct linkage and assessment against those specific controls, not against other frameworks.

3. The Cyber AB, "Code of Professional Conduct (CoPC)", Version 2.1, November 2022. Canon 2, "Perform professional services only in the areas of their competence and exercise due professional care," requires assessors to be knowledgeable of CMMC policies, including the lack of reciprocity, and to apply them correctly. Granting unapproved credit would be a violation.