The Smithers Continuous Assessment Process

The Usual CMMC Assessment Process

If a company follows the prescribed process for Level 2 CMMC certification, the initial assessment must be completed by a C3PAO and the recertification assessment must be completed by a C3PAO.

The requirement for year two and year three is a self-assessment/self-attestation. This means the company must assess its own compliance, report a SPRS score, and a company executive must sign off on the submitted score.

If the score is misrepresented, the executive can be penalized under the False Claims Act.

Cancel
Show Policy
Usual CMMC Certification Process
Robert McVay Senior Consultant, Information Security Services
Robert
McVay

Senior Consultant, Information Security Services

United States

Contact Robert

The Smithers Continuous Assessment Process

The Smithers Continuous Assessment Process offers third-party validation for the self-assessments and self-attestations required in the second and third years.

Because Smithers is also an ANAB-accredited certification body, our assessors can interweave partial surveillance for standards like ISO 9001, AS9100, and ISO 27001 into the CMMC continuous assessment process. This will save companies time and money for each certification.

Finally, the continuous assessment process keeps investment levels more even over a four-year period because there will not be large investment spikes in year one and year four.

Continuous Assessment Process
Schedule a Meeting Today