What the CAP v2.0 defines
End-of-day out-brief (daily close-out)
The CAP requires the assessment team to conduct an end-of-day out-brief at the close of each assessment day. The Lead Assessor summarizes preliminary observations from the day, and the OSC is given the opportunity to ask questions, clarify what the assessor observed, and point to additional evidence the OSC already has that the assessor may not have seen. This is the primary CAP-defined real-time mechanism for making sure the assessor has the full picture of what is already in place. Assessment week is not the time to remediate gaps or build new evidence; the out-brief exists to surface existing facts the assessor missed, not to fix things on the fly.
Final findings briefing
At the end of the assessment the CAP requires a final findings briefing where preliminary determinations are presented. This is the OSC's last formal opportunity to surface clarifications and additional evidence before the report is written. The Lead Assessor has discretion to revise a determination based on additional evidence presented at this briefing.
Lead Assessor quality assurance
The CAP requires the Lead Assessor to validate that each determination is supported by evidence and consistent with the NIST 800-171A assessment objective before it is recorded.
C3PAO quality assurance and dispute process
The CAP requires every C3PAO to maintain a quality assurance program that addresses documented disputes from the OSC. Post-assessment, the OSC raises a dispute with the C3PAO first and the C3PAO is required to respond.
Cyber AB escalation
If the OSC is dissatisfied with the C3PAO's response, the next step is the Cyber AB Code of Professional Conduct and ethics process. The Cyber AB has authority over C3PAO and assessor conduct.
DIBCAC pathway
For Level 3 certifications and for DIBCAC-conducted assessments under 32 CFR 170.7, the dispute path runs through DCMA DIBCAC.
Tips from assessor practice (not in the CAP)
During the assessment week
- Designate one primary point of contact who accompanies the assessors at all times. This person hears every preliminary observation as it surfaces and can act on it quickly.
- Acknowledge findings factually. Do not argue or minimize. Arguing rarely changes the outcome and damages the assessor relationship.
- Present additional evidence as soon as you have it. If the assessor flags a control because they did not see specific evidence and you have that evidence, produce it. The earlier in the week the better.
- Document every preliminary observation in real time, including the specific reason cited. This becomes your reference for the daily out-brief, the final findings briefing, and any subsequent dispute.
At the final findings briefing
- Take notes on every NOT MET finding including the specific reason cited.
- Ask for clarification on any finding you do not understand. Understanding the basis is essential for any post-assessment response.
- If you have evidence the assessor did not see, present it now.
- Thank the assessment team. You may work with them again during closeout.
What rarely works
- Trying to argue an assessor out of a finding with the same evidence they already evaluated. If the basis is the assessor's interpretation of the objective, additional evidence is what changes the determination, not argument.
- Going around the C3PAO directly to the Cyber AB as the first step. The CAP requires the dispute to be raised with the C3PAO first.
- Waiting until after the report is final. The window to introduce additional evidence is much wider during the on-site week than after the report is signed.
What works well
- Pre-assessment evidence catalog walkthrough. Surface scope and evidence questions before the formal Examine begins.
- Real-time evidence retrieval during the on-site week. The Day 1 document review often surfaces existing evidence the assessor wants to see but did not initially have access to. The OSC can locate and produce that evidence from its catalog over the rest of the week. This is retrieval, not creation.
- A factual, concise written response if you do dispute formally, with specific evidence references and citations to the relevant assessment objectives in NIST 800-171A.