CMMC Conflicts of Interest
What Assessors Cannot Do — and What Disqualifies an Assessment
Under the Cyber AB Code of Professional Conduct (CoPC), a conflict of interest exists when a CMMC ecosystem member's objectivity in conducting an assessment is compromised — or reasonably appears to be. The bright-line rule: no individual may participate on a Level 2 assessment team if they previously served as a consultant preparing that specific organization for the assessment. The C3PAO is responsible for identifying conflicts before the engagement begins and cannot proceed if the conflict cannot be sufficiently mitigated.
A CMMC conflict of interest exists when a credentialed CMMC ecosystem member's objectivity in conducting a Level 2 assessment under 32 CFR Part 170 is compromised — or reasonably appears to be — by a prior consulting relationship, financial interest, employment history, or personal connection with the organization being assessed. Under the Cyber AB Code of Professional Conduct (CoPC) and ISO/IEC 17020, the bright-line rule is absolute: the same individual cannot both prepare an organization for CMMC certification and serve on the C3PAO assessment team that evaluates it. Every credentialed individual and every C3PAO must sign the CoPC as a condition of maintaining credentials.
Can the Same Company Consult and Assess for CMMC?
The CoPC draws a hard boundary between the advisory role and the evaluative role. These roles are not just separated by policy — they are structurally incompatible when performed by the same individual for the same organization. The question is not whether a consultant did good work. The question is whether anyone can objectively evaluate work they themselves designed and built.
Allowed — Before the Assessment
Allowed — During the Assessment
What Types of Conflicts Disqualify a CMMC Assessor?
The CoPC defines conflicts of interest broadly — the consulting prohibition is the most well-known, but conflicts can arise from financial relationships, employment history, and personal connections. The C3PAO's COI screening process must address all categories before the assessment is scheduled, not after it begins.
What Is an Assessor Prohibited From Doing During a CMMC Assessment?
The prohibition on consulting behavior does not end at the conflict-of-interest screening. It applies throughout the assessment engagement. An assessor who crosses into advisory territory during Phase 2 — regardless of whether they have a prior relationship with the OSC — is violating the CoPC in real time.
"You can be critical, that is fine — but you are not supposed to be consulting." An assessor who tells the OSC a policy is missing is doing their job. An assessor who tells the OSC what the policy should say, or who reviews the rewritten policy the next morning, has crossed from evaluation into preparation. The findings end on the day they are made. They cannot be reversed by overnight remediation.
Can You Fix a Failing Control During the CMMC Assessment?
Because assessments are expensive and time-constrained, OSCs frequently pressure assessors to allow mid-assessment corrections. These requests — even when made in good faith — place assessors in an untenable position and are a common trigger for CoPC violations.
An assessor identifies a missing access control policy on Friday afternoon. The OSC's compliance manager spends the weekend writing a policy and presents it Monday morning, asking the assessor to evaluate it as if it had always been there. The OSC's position: the policy reflects the actual practice that was always in place — it just was not documented yet.
The assessment is a snapshot of the environment as it existed on assessment day. A policy that did not exist on Friday does not satisfy an assessment objective that was evaluated on Friday. The Monday policy can support the next assessment. It cannot retroactively satisfy a finding from the prior week.
After the assessment day closes, an assessment team member joins OSC staff for dinner. Over the meal, the team member reviews a failing policy draft, suggests specific language that would satisfy the assessment objective, and confirms the revised version will pass tomorrow's evaluation. The team member frames it as "just answering a general question."
This is one of the most explicitly taught CoPC violation scenarios in the CMMC ecosystem. The informal setting, the absence of formal documentation, and the framing as "a general question" do not change the nature of the act: the assessor provided consulting advice on a specific failing control during an active assessment. The conduct is a severe CoPC violation regardless of intent.
During the Phase 1 Certification Assessment Readiness Review, the lead assessor reviews the OSC's vulnerability management documentation and observes that scan results are missing. The assessor then tells the OSC: "You should run your Tenable scan against the CUI assets, export the results in CSV format, and add them to the AC folder in your evidence package." The OSC complies and the assessment proceeds.
Pointing out that evidence is absent is permitted. Prescribing the specific tool, output format, and filing location for the evidence the OSC should generate is consulting — even during Phase 1, and even without a prior relationship between the assessor and the OSC.
How Should You Choose Separate Consultants and C3PAOs for CMMC?
The cleanest conflict prevention strategy is structural: use entirely separate organizations for readiness consulting and formal assessment. This eliminates the possibility of the prior-work prohibition applying to any member of the assessment team.
- Use a different C3PAO for assessment than you used for readiness consulting. If your MSP or a Registered Practitioner Organization helped build your compliance environment, hire an entirely separate C3PAO — with no organizational relationship to the consulting firm — for the formal Level 2 assessment. This is the single most effective conflict prevention measure available.
- If the same parent organization offers both consulting and assessment services, proceed with caution. The Cyber AB requires separate legal entities for the consulting and assessment functions even within the same parent organization. But many OSCs — and many lead assessors — decline the arrangement entirely because of the appearance of collusion, regardless of structural separation on paper.
- Screen your C3PAO's assessment team against your past vendor list before signing the engagement agreement. Ask the lead assessor to confirm, in writing, that no team member has a prior consulting relationship with your organization. This disclosure request is your due diligence — and it surfaces potential conflicts before they become assessment-invalidating problems.
- Document the absence of conflicts as an artifact. A written COI attestation from the C3PAO — signed by the lead assessor — confirming no prior relationships or financial interests is worth keeping in the assessment documentation. If a conflict allegation arises later, the attestation is your evidence that appropriate screening was conducted.
- Do not allow your consulting firm's employees to join the assessment team as CCPs, even informally. A CCP who worked on your readiness preparation and then sits in on interviews as a "support resource" for the C3PAO has crossed into the assessment boundary. Their presence — even without formal authority — creates the appearance of a conflict that must be disclosed and mitigated.
What Happens When a CMMC Conflict of Interest Is Discovered?
Conflicts discovered before the assessment begins are manageable. Conflicts discovered during or after are significantly more damaging — to the assessment's standing, to the individuals involved, and to the C3PAO's authorization status with the Cyber AB.
How Do You Report a CMMC Assessor Ethics Violation?
Every individual credentialed in the CMMC ecosystem has an affirmative obligation under the CoPC — not just to avoid violations themselves, but to report violations they witness. The obligation to act is built into the Code, and failing to report a known violation is itself a CoPC deficiency.
The Bottom Line
The conflict of interest rules exist because the CMMC ecosystem's value depends entirely on the credibility of its assessments. A certification issued by an assessor who helped build the environment being certified is not evidence of compliance — it is evidence of a compromised process. The CoPC and the Cyber AB's enforcement mechanisms exist to protect that credibility, which is why both the disclosure obligations and the reporting obligations are mandatory, not optional.
Take these four steps before signing any C3PAO engagement agreement: (1) Use an entirely separate organization for readiness consulting (RP/RPO) and formal assessment (C3PAO) — no shared parent entity if possible. (2) Request a written COI attestation from the C3PAO's lead assessor confirming no team member has a prior consulting, employment, financial, or personal relationship with your organization. (3) Cross-reference the proposed assessment team roster against your past vendor list and flag any overlap. (4) Retain the signed COI attestation as an assessment artifact. For DFARS 252.204-7021 compliance, the CoPC obligation runs in both directions — avoid conflicts yourself, and report the ones you witness via the Cyber AB complaint process (SOP1001).
An assessor who cannot say "Met" or "Not Met" without first asking "how does this affect my client?" has a conflict — whether or not a prior consulting engagement exists on paper. The standard is not just the absence of a prohibited relationship. It is the presence of genuine independence. The Cyber AB's complaint process exists for the cases where that independence fails.