CMMC Conflicts of Interest
What Assessors Cannot Do — and What Disqualifies an Assessment
Under the Cyber AB Code of Professional Conduct (CoPC), a conflict of interest exists when a CMMC ecosystem member's objectivity in conducting an assessment is compromised — or reasonably appears to be. The bright-line rule: no individual may participate on a Level 2 assessment team if they previously served as a consultant preparing that specific organization for the assessment. The C3PAO is responsible for identifying conflicts before the engagement begins and cannot proceed if the conflict cannot be sufficiently mitigated.
The separation between consulting and assessing is not a procedural preference — it is a structural requirement of the CMMC ecosystem enforced by the Cyber AB through the CoPC. Its foundation is the ISO/IEC 17020 impartiality principle: an assessor cannot evaluate their own work and remain objective. Every credentialed individual and every C3PAO operating in the ecosystem must sign the CoPC and is bound by it as a condition of maintaining credentials.
The Consulting-to-Assessing Firewall
The CoPC draws a hard boundary between the advisory role and the evaluative role. These roles are not just separated by policy — they are structurally incompatible when performed by the same individual for the same organization. The question is not whether a consultant did good work. The question is whether anyone can objectively evaluate work they themselves designed and built.
Allowed — Before the Assessment
Allowed — During the Assessment
What Counts as a Conflict of Interest
The CoPC defines conflicts of interest broadly — the consulting prohibition is the most well-known, but conflicts can arise from financial relationships, employment history, and personal connections. The C3PAO's COI screening process must address all categories before the assessment is scheduled, not after it begins.
What Assessors Can and Cannot Do During an Assessment
The prohibition on consulting behavior does not end at the conflict-of-interest screening. It applies throughout the assessment engagement. An assessor who crosses into advisory territory during Phase 2 — regardless of whether they have a prior relationship with the OSC — is violating the CoPC in real time.
"You can be critical, that is fine — but you are not supposed to be consulting." An assessor who tells the OSC a policy is missing is doing their job. An assessor who tells the OSC what the policy should say, or who reviews the rewritten policy the next morning, has crossed from evaluation into preparation. The findings end on the day they are made. They cannot be reversed by overnight remediation.
Practical Scenarios: "Quick Fixes" and Why They Violate the CoPC
Because assessments are expensive and time-constrained, OSCs frequently pressure assessors to allow mid-assessment corrections. These requests — even when made in good faith — place assessors in an untenable position and are a common trigger for CoPC violations.
An assessor identifies a missing access control policy on Friday afternoon. The OSC's compliance manager spends the weekend writing a policy and presents it Monday morning, asking the assessor to evaluate it as if it had always been there. The OSC's position: the policy reflects the actual practice that was always in place — it just was not documented yet.
The assessment is a snapshot of the environment as it existed on assessment day. A policy that did not exist on Friday does not satisfy an assessment objective that was evaluated on Friday. The Monday policy can support the next assessment. It cannot retroactively satisfy a finding from the prior week.
After the assessment day closes, an assessment team member joins OSC staff for dinner. Over the meal, the team member reviews a failing policy draft, suggests specific language that would satisfy the assessment objective, and confirms the revised version will pass tomorrow's evaluation. The team member frames it as "just answering a general question."
This is one of the most explicitly taught CoPC violation scenarios in the CMMC ecosystem. The informal setting, the absence of formal documentation, and the framing as "a general question" do not change the nature of the act: the assessor provided consulting advice on a specific failing control during an active assessment. The conduct is a severe CoPC violation regardless of intent.
During the Phase 1 Certification Assessment Readiness Review, the lead assessor reviews the OSC's vulnerability management documentation and observes that scan results are missing. The assessor then tells the OSC: "You should run your Tenable scan against the CUI assets, export the results in CSV format, and add them to the AC folder in your evidence package." The OSC complies and the assessment proceeds.
Pointing out that evidence is absent is permitted. Prescribing the specific tool, output format, and filing location for the evidence the OSC should generate is consulting — even during Phase 1, and even without a prior relationship between the assessor and the OSC.
How to Structure Vendor Relationships to Prevent Conflicts
The cleanest conflict prevention strategy is structural: use entirely separate organizations for readiness consulting and formal assessment. This eliminates the possibility of the prior-work prohibition applying to any member of the assessment team.
- Use a different C3PAO for assessment than you used for readiness consulting. If your MSP or a Registered Practitioner Organization helped build your compliance environment, hire an entirely separate C3PAO — with no organizational relationship to the consulting firm — for the formal Level 2 assessment. This is the single most effective conflict prevention measure available.
- If the same parent organization offers both consulting and assessment services, proceed with caution. The Cyber AB requires separate legal entities for the consulting and assessment functions even within the same parent organization. But many OSCs — and many lead assessors — decline the arrangement entirely because of the appearance of collusion, regardless of structural separation on paper.
- Screen your C3PAO's assessment team against your past vendor list before signing the engagement agreement. Ask the lead assessor to confirm, in writing, that no team member has a prior consulting relationship with your organization. This disclosure request is your due diligence — and it surfaces potential conflicts before they become assessment-invalidating problems.
- Document the absence of conflicts as an artifact. A written COI attestation from the C3PAO — signed by the lead assessor — confirming no prior relationships or financial interests is worth keeping in the assessment documentation. If a conflict allegation arises later, the attestation is your evidence that appropriate screening was conducted.
- Do not allow your consulting firm's employees to join the assessment team as CCPs, even informally. A CCP who worked on your readiness preparation and then sits in on interviews as a "support resource" for the C3PAO has crossed into the assessment boundary. Their presence — even without formal authority — creates the appearance of a conflict that must be disclosed and mitigated.
When a Conflict Is Discovered: Disclosure, Mitigation, and When to Stop
Conflicts discovered before the assessment begins are manageable. Conflicts discovered during or after are significantly more damaging — to the assessment's standing, to the individuals involved, and to the C3PAO's authorization status with the Cyber AB.
Reporting Violations: The Cyber AB Escalation Path
Every individual credentialed in the CMMC ecosystem has an affirmative obligation under the CoPC — not just to avoid violations themselves, but to report violations they witness. The obligation to act is built into the Code, and failing to report a known violation is itself a CoPC deficiency.
The Bottom Line
The conflict of interest rules exist because the CMMC ecosystem's value depends entirely on the credibility of its assessments. A certification issued by an assessor who helped build the environment being certified is not evidence of compliance — it is evidence of a compromised process. The CoPC and the Cyber AB's enforcement mechanisms exist to protect that credibility, which is why both the disclosure obligations and the reporting obligations are mandatory, not optional.
For OSCs, the practical implication is simple: use separate organizations for readiness preparation and formal assessment, screen the C3PAO's team before the engagement agreement is signed, and document the absence of conflicts as a formal artifact. For credentialed individuals, the CoPC obligation runs in both directions — avoid conflicts yourself, and report the ones you witness.
An assessor who cannot say "Met" or "Not Met" without first asking "how does this affect my client?" has a conflict — whether or not a prior consulting engagement exists on paper. The standard is not just the absence of a prohibited relationship. It is the presence of genuine independence. The Cyber AB's complaint process exists for the cases where that independence fails.