Standards & methodology

The criteria behind the review.

Quality Assurance (QA) review work is only as credible as the criteria it is measured against. These are the references used when we examine CMMC assessment process execution and records.

REFERENCE / 01
01

32 CFR Part 170 — CMMC Program

Specifically § 170.9(b)(13) and § 170.9(b)(14)

What it is

The CMMC Program regulation. Section 170.9 addresses CMMC Third-Party Assessor Organization (C3PAO) requirements, including the Quality Assurance (QA) function in paragraph (b)(13) and the quality assurance reviews conducted during an assessment in paragraph (b)(14).

How we use it

This is the reference we read when a QA finding concerns the accuracy and completeness of assessment data prior to upload, or the conduct of quality assurance reviews during an assessment.

View 32 CFR § 170.9 on eCFR
REFERENCE / 02
02

The CMMC Assessment Process (CAP)

Applicable CAP procedural requirements

What it is

The published process describing how a CMMC assessment is conducted, including the procedural steps a C3PAO is expected to follow.

How we use it

Used as the procedural reference when reviewing whether assessment activity followed the applicable process requirements. It is not a scoring method, and it does not replace the C3PAO’s own procedures.

REFERENCE / 03
03

Assessment and scoping guidance, and NIST assessment references

NIST SP 800-171 · NIST SP 800-171A · applicable DoD scoping guidance

What it is

The security requirements and the assessment procedures and objectives used to evaluate them, together with the official scoping guidance applicable to the assessment being reviewed.

How we use it

Used when a review concerns whether documented evidence traces to a stated objective, and whether the record supports the determination written against it. We review the trace; we do not re-make the determination.

REFERENCE / 04
04

C3PAO quality-system obligations

Applicable obligations, plus the C3PAO’s documented quality procedures

What it is

The quality-system obligations that apply to the C3PAO, alongside the procedures the C3PAO has documented for its own assessment and quality work.

How we use it

Reviews are measured against applicable CMMC requirements and the C3PAO’s documented procedures. Missing or conflicting procedures are identified against the governing requirements; reviewer preferences are not treated as requirements.

Criteria.
Not credentials.

Using a standard is not the same as being accredited to it

Citing a requirement shows the criteria a review is measured against. It does not make us a regulator, accreditor, or approved certification body, and it does not transfer assessment or certification responsibility to 11th Hour. Determinations, certification decisions, and appeals remain with the C3PAO and the responsible bodies. Where a reference has been revised, we confirm the version applicable to the assessment being reviewed before it is applied.

See how a reference becomes a finding