At present, the CMMC certification process is being developed. In general, the construct is to work along these lines; the organization will need to contract with a local Certified Third-Party Assessment Organization (C3PAO). The organization will have to pay for its assessment. All CMMC accessors will work for or will be affiliated with a C3PAO. It is the C3PAO that will “manage” the accessors; the accessors will be certified to a CMMC level(s) at this time; there will be two levels, CMMC Level 1 and 3. The contractor and accessor will schedule the assessment and will conduct the assessment on-site.
The assessment will be based on a scoring mechanism; once certified, the certification will last three years and will then have to be renewed.
At this time, the certification process has not started, and there are no organizations that can certify any organization in terms of the CMMC model.
A higher certification level will cover lower-level certifications; for example, an organization certified at Level 5 will be certified for Levels 1 through 4.