When conducting a CMMC assessment, the CCA must follow the steps outlined in the CMMC Assessment Process (CAP). This document is organized into…

The CMMC Assessment Process (CAP) is structured into four distinct phases. Phase 1, "Plan and Prepare for the Assessment," involves initial scoping, readiness reviews, and logistical planning. During this phase, the Assessor uses the CMMC Pre-Assessment Form Data Template, the CMMC Assessment Readiness Review (CA-RR) Checklist, and, if applicable, the Virtual Assessment Evidence Preparation Template. The CMMC Assessment Quality Review Checklist, however, is not used until Phase 4, "Assessment Closeout." This final phase requires the C3PAO to conduct a thorough quality review of the entire assessment package before submission, ensuring all documentation is complete and accurate.

B. CMMC Assessment Readiness Review (CA-RR) Checklist: This is a key document for Phase 1, used to verify that the Organization Seeking Certification (OSC) is prepared for the formal assessment to begin.

C. Virtual Assessment Evidence Preparation Template: This template is used during Phase 1 planning to guide the OSC in organizing and preparing evidence specifically for a remote or virtual assessment.

D. CMMC Pre-Assessment Form Data Template: This is one of the initial documents completed in Phase 1 to gather foundational data about the OSC and define the assessment scope.

1. Cybersecurity Maturity Model Certification (CMMC) Program, CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1, The Cyber AB, December 21, 2023.

Section 3.1, Phase 1: Plan and Prepare for the Assessment: This section details the activities and required documentation for the initial phase, including the CMMC Pre-Assessment Form Data Template (p. 11), the CMMC Assessment Readiness Review (p. 12), and planning for evidence collection which would include the virtual template if applicable.

Section 3.4, Phase 4: Assessment Closeout: This section explicitly states that the C3PAO must "Conduct a quality review of the assessment package" (p. 20), which is the function of the CMMC Assessment Quality Review Checklist.