The Certification Assessment Readiness Review (CA-RR) aims to determine whether the OSC and the Assessment Team are ready to conduct the assessment…

The Certification Assessment Readiness Review (CA-RR) is a procedural milestone focused on the operational readiness to conduct the CMMC assessment. Its purpose is to confirm that both the Organization Seeking Certification (OSC) and the Assessment Team have all necessary resources, schedules, and logistical arrangements in place. It also addresses any risks that could impede the assessment process itself. The CA-RR is not the assessment; it does not involve evaluating the OSC's implementation of security controls or determining their actual cybersecurity posture. That evaluation is the objective of the assessment that follows the CA-RR.

B. Assessment readiness: This is incorrect because the primary purpose of the CA-RR is to determine and confirm the overall readiness of all parties to proceed with the assessment.

C. Assessment risk status: This is incorrect because the CA-RR explicitly involves identifying and mitigating risks that could negatively impact the successful and timely execution of the assessment.

D. Logistics: This is incorrect because verifying logistical arrangements, such as travel, site access, and availability of personnel and resources, is a core component of the CA-RR.

---

1. The Cyber AB. (2023). CMMC Assessment Process (CAP) for Level 2, Version 1.0. Section 3.3.2, "Conduct Certification Assessment Readiness Review (CA-RR)," Page 16. This section explicitly states, "The CA-RR addresses all aspects of readiness to conduct the assessment, including but not limited to: assessment readiness, assessment risk status, and logistics." It makes no mention of evaluating the OSC's cybersecurity posture.