During the planning phase of the Assessment Process. C3PAO staff are reviewing the various entities associated with an OSC that has requested a CMMC…

In the context of the CMMC Assessment Process, a "Supporting Organization/Unit" refers to an external entity that provides people, processes, or technology to the Organization Seeking Certification (OSC). These supporting elements are included within the assessment scope because they handle, process, or protect Controlled Unclassified Information (CUI) on behalf of the OSC. However, the supporting organization itself does not receive a CMMC certification from the OSC's assessment. Its compliance is evaluated solely in relation to the services it provides to the OSC. This is a common scenario with External Service Providers (ESPs) like cloud vendors or managed service providers.

A. Host Unit: This is not a defined term within the CMMC framework or its associated assessment process documentation.

B. Organization: This term is too general. The question asks for the specific term describing an external entity that supports the primary organization being assessed.

C. Coordinating Unit: This is not an official CMMC term used to describe an external entity that is part of the assessment scope.

1. U.S. Department of Defense (DoD)

CMMC Level 2 Scoping Guide

Version 2.0

December 2

2022.

Section 3.3

"External Service Provider (ESP) Considerations" (Page 10): This section details how external organizations that provide services to the OSC are handled within the assessment scope. It states

"The OSC is responsible for CUI protection when leveraging external services... The C3PAO assesses the OSC’s implementation of CMMC practices that apply to the services provided by the ESP." This describes the function of a "Supporting Organization/Unit."

2. U.S. Department of Defense (DoD)

CMMC Assessment Process (CAP) for CMMC Level 2

Version 2.0

December 2

2022.

Section 2.2

"Assessment Planning" (Page 13): This section outlines the planning activities

which include defining the assessment scope. The identification of all external dependencies and supporting entities that handle CUI is a critical part of this phase

reinforcing the concept of evaluating supporting organizations as part of the OSC's assessment.