Questions, answered
Clarity starts with a question.
Straight answers about scope, roles, information handling, and working together.
Scope & Fit
Who do you support?
C3PAOs seeking embedded CMMC assessment QA support. Our actively marketed service is assessment QA, not contractor implementation or certification preparation.
Link to this answerWhen can QA become involved?
QA participation is planned around relevant assessment activities, from planning and process observations through documentation review and finding resolution. The engagement establishes checkpoints and access; the service is not limited to final-package proofreading.
Link to this answerCan we engage you for one assessment or recurring support?
Engagement-specific and recurring arrangements can be discussed based on scope, workload, independence requirements, and availability. Fees and scheduling are agreed privately.
Link to this answerRoles & Boundaries
Who can perform formal QA?
The formal QA individual must be a CCA and cannot be on the assessment team being reviewed. Assignments also require applicable eligibility, impartiality, and authorized-access conditions to be satisfied.
Link to this answerDo you conduct certification assessments or issue certificates?
This offering supports a C3PAO’s QA function. It is not an engagement to perform a certification assessment or issue a Certificate of CMMC Status on behalf of 11th Hour.
Link to this answerHow are QA findings handled?
Findings are documented against applicable requirements, responses and corrections are tracked, and unresolved matters follow the C3PAO’s escalation procedures. The QA role and any applicable appeals responsibilities are established in the engagement; 11th Hour does not replace the accreditation body’s authority.
Link to this answerInformation & Support
How do you handle assessment information?
Confidentiality, access, and information-handling arrangements are established before work begins. Assessment materials must use the channels authorized for the engagement, not the public website form.
Link to this answerWhat information should we provide initially?
Provide your organization, business contact details, general QA need, and approximate timing. Do not provide OSC-identifying assessment details, evidence, system diagrams, or sensitive information through the website.
Link to this answerWhat about existing training or consulting customers?
Existing customers should use their established access/support arrangements or contact us for assistance. Those legacy services are not being promoted for new public enrollment or engagements.
Link to this answerAbbreviations used on this site
Each is written out in full where it first appears in context.
- C3PAO
- CMMC Third-Party Assessor OrganizationThe organization that conducts CMMC assessments and carries the assessment responsibilities.
- CAP
- CMMC Assessment ProcessThe published process that sets out how a CMMC assessment is conducted.
- CMMC
- Cybersecurity Maturity Model CertificationThe certification program set out in the CMMC Program regulation, 32 CFR Part 170.
- QA
- Quality AssuranceThe review activity that examines how assessment work is performed, recorded, and resolved.
No matching questions. Try another search or contact us.
