During the planning and preparation discussions, a key member of the C3PAO Assessment Team falls ill and is unavailable for the originally scheduled…

The C3PAO and its designated Lead Assessor are responsible for determining the appropriate size and composition of the assessment team based on the assessment's scope. The primary requirement is that the team collectively possesses the necessary competence and qualifications to assess all CMMC practices and objectives within that scope. If a team member becomes unavailable, the Lead Assessor must re-evaluate if the remaining members can still provide full and adequate coverage. If they can, and the OSC agrees to proceed, the assessment can continue. The decision is based on the team's capability, not a fixed roster, ensuring the integrity and validity of the assessment are maintained.

B. The Cyber AB accredits C3PAOs but does not micromanage the staffing of individual assessments. This operational responsibility is delegated to the C3PAO.

C. The OSC is the subject of the assessment and cannot dictate the terms of team composition. This is the C3PAO's responsibility to ensure an objective and valid assessment.

D. Postponement is a possible outcome if the remaining team is no longer sufficient, but it is not mandatory if the team's qualifications can still cover the entire scope.

1. Cybersecurity Maturity Model Certification (CMMC) Assessment Process (CAP) for Level 2, Version 2.1, Section 3.2.1, "Assessment Team Composition": This section states, "The C3PAO is responsible for determining the size and composition of the Assessment Team based on the assessment scope..." This establishes that the C3PAO has the authority and responsibility to ensure the team is adequate, implying they can adjust as needed, provided the team remains competent for the scope.

2. Cyber AB Code of Professional Conduct (CoPC) for CMMC Professionals, Version 2.1, Canon 1, "Responsibility to the Profession": This canon requires certified professionals to "Act with integrity, competence, diligence, and responsibility." A Lead Assessor proceeding with an under-qualified or under-staffed team would violate this principle. Therefore, the decision to proceed hinges on whether the remaining team is still competent to perform the assessment diligently.

3. CMMC Assessment Process (CAP) for Level 2, Version 2.1, Section 3.2.2, "Lead Assessor (LA)": This section outlines the LA's responsibilities, which include "Manages the Assessment Team and oversees the assessment activities." This management function includes ensuring the team is capable of executing the assessment plan, even if the original composition changes.