Questions, answered

Clarity starts with a question.

Straight answers about scope, roles, information handling, and working together.

Scope & Fit

Who do you support?

C3PAOs seeking embedded CMMC assessment QA support. Our actively marketed service is assessment QA, not contractor implementation or certification preparation.

When can QA become involved?

QA participation is planned around relevant assessment activities, from planning and process observations through documentation review and finding resolution. The engagement establishes checkpoints and access; the service is not limited to final-package proofreading.

Can we engage you for one assessment or recurring support?

Engagement-specific and recurring arrangements can be discussed based on scope, workload, independence requirements, and availability. Fees and scheduling are agreed privately.

Roles & Boundaries

Who can perform formal QA?

The formal QA individual must be a CCA and cannot be on the assessment team being reviewed. Assignments also require applicable eligibility, impartiality, and authorized-access conditions to be satisfied.

Do you conduct certification assessments or issue certificates?

This offering supports a C3PAO’s QA function. It is not an engagement to perform a certification assessment or issue a Certificate of CMMC Status on behalf of 11th Hour.

How are QA findings handled?

Findings are documented against applicable requirements, responses and corrections are tracked, and unresolved matters follow the C3PAO’s escalation procedures. The QA role and any applicable appeals responsibilities are established in the engagement; 11th Hour does not replace the accreditation body’s authority.

Information & Support

How do you handle assessment information?

Confidentiality, access, and information-handling arrangements are established before work begins. Assessment materials must use the channels authorized for the engagement, not the public website form.

What information should we provide initially?

Provide your organization, business contact details, general QA need, and approximate timing. Do not provide OSC-identifying assessment details, evidence, system diagrams, or sensitive information through the website.

What about existing training or consulting customers?

Existing customers should use their established access/support arrangements or contact us for assistance. Those legacy services are not being promoted for new public enrollment or engagements.

Abbreviations used on this site

Each is written out in full where it first appears in context.

C3PAO
CMMC Third-Party Assessor OrganizationThe organization that conducts CMMC assessments and carries the assessment responsibilities.
CAP
CMMC Assessment ProcessThe published process that sets out how a CMMC assessment is conducted.
CMMC
Cybersecurity Maturity Model CertificationThe certification program set out in the CMMC Program regulation, 32 CFR Part 170.
QA
Quality AssuranceThe review activity that examines how assessment work is performed, recorded, and resolved.