At C3, We Are Built For This: Why the CMMC Phase 2 Pause Didn’t Change How We Work
The CMMC Phase 2 pause changed what's required. It didn't change how we operate — because our Compliance Services offering was never dependent on a C3PAO in the first place.
Under the Department of War’s current CMMC posture, program offices may only require CMMC Level 1 (Self) or Level 2 (Self) assessments — third-party C3PAO assessments remain suspended pending a 60-day review. For a lot of the industry, that pause raises an uncomfortable question: without a third-party assessor in the loop, what stands behind a self-assessment score?
We can answer that question today, because we already built the answer into our Compliance Services offering before this pause was ever announced. Implementation and Assessment have always run as two separate, independent functions in our process — not something we’re standing up in response to the change, but the model we’ve operated under all along. The score your company uploads to SPRS is your own attestation, and the liability for that number sits with whoever signs it, not with an outside assessor. Our process exists to make sure you can sign it with confidence.
Two functions, one pipeline
Our Compliance Service is deliberately split into two functions that never share staff:
- Implementation — our Implementers spend approximately 13 weeks translating NIST SP 800-171 Rev 2 and FAR 52.204-21 requirements into real operating controls: policies, system configurations, the System Security Plan (SSP), and POA&Ms where gaps remain — all passed through internal QA before handoff.
- Assessment — a separate C3 team, walled off from the people who wrote the SSP, independently gathers evidence and tests whether each control actually operates as documented, culminating in a Pre-Assessment Readiness Review (PRR) with your team.
Only after that independent verification does your company sign and submit the CMMC Level 1 or Level 2 self-assessment score to SPRS.
Why the separation matters
The handoff between Implementation and Assessment functions as an internal control gate: nothing gets scored by the same team that built it. That’s the same independence principle a licensed C3PAO would apply — we simply apply it internally, on a timeline that matches the current self-assessment requirement.
This isn’t a structure we invented for convenience. NIST’s Risk Management Framework (SP 800-37 Rev. 2) defines System Owners and Security Control Assessors as distinct roles by design, and control CA-2 in SP 800-53 — together with its companion assessment guidance, SP 800-53A — calls for assessors to hold a degree of independence from the individuals who developed and implemented the controls being assessed, scaled to the risk associated with the system. NIST SP 800-171A, the methodology behind CMMC Level 1 and Level 2 assessments, reinforces the same line: verifying a control through examination, interview, or testing is treated as distinct from the act of building it. The reasoning is straightforward: a control assessment carries far less weight when the person confirming it works is the same person who built it. Structuring Implementation and Assessment as separate teams is how we apply that same principle inside a self-assessment model.
The Pre-Assessment Readiness Review is where this pays off. It’s the mechanism that turns “we believe we’re compliant” into “we can defend this score if DIBCAC ever asks.” That distinction matters more, not less, under a self-attestation model — when your company signs the score, you own the exposure if the evidence doesn’t hold up.
Built for what comes next
Because our Assessment team already performs evidence-based control testing rather than a documentation review, the same team is structurally ready to support C3PAO or DIBCAC-level assessments if and when Phase 2 requirements resume after the CIO’s review concludes. The rigor you build with us under the self-assessment regime carries forward — none of it is a throwaway exercise for today’s requirements only.
Ready to talk through your CMMC posture under the current requirements? Contact us to schedule a readiness conversation.
Meet the Author
