Assessor handoff
Built for the C3PAO handoff. Not direct eMASS access.
PolicyCortex prepares the control-mapped evidence package a C3PAO reviews for a CMMC Level 2 assessment: artifacts tied to each objective, remediation history with rollback identifiers, SSP, POA&M, and OSCAL 1.1.2 exports, each content hashed and timestamped. The C3PAO controls the official assessment package and the eMASS submission. PolicyCortex does not claim direct access to CMMC eMASS.
What the assessor receives, and who submits
PolicyCortex is the A&A system of record on the assessed organization's side for CMMC cloud environments. It maps controls, records approved remediation with rollback identifiers, and packages the evidence your C3PAO can review, select from, and use when preparing the required CMMC eMASS submission.
That framing is intentional: the assessor controls the formal assessment and the official eMASS workflow. PolicyCortex makes the handoff cleaner by turning remediation work into organized evidence.
- system.of.record
- A&A, assessed organization's side.
- assessor.handoff
- C3PAO: review, select, submit.
- output
- OSCAL 1.1.2 and ZIP: SSP, POA&M, evidence.
What the package contains
Four kinds of artifact, each tied back to the CMMC objective it evidences.
- EV-01
Control-mapped cloud evidence
Every artifact ties back to the CMMC objective, asset scope, resource ID, and cloud-state proof.
- EV-02
Remediation history
Findings, fixes, approvals, rollback identifiers, and post-fix validation stay in one evidence trail.
- EV-03
SSP, POA&M, and OSCAL outputs
Narrative and machine-readable exports are generated from the same control implementation record.
- EV-04
Hash, timestamp, and retention
Artifacts are content-hashed, timestamped, and retained so the package can be regenerated later.
The handoff workflow
Five steps from a connected cloud to an assessor-controlled submission. PolicyCortex does the first three and supports the last two.
- 01
Connect and scope
PolicyCortex maps the CUI boundary across Azure, AWS and GCP accounts, with Azure Government, AWS GovCloud (US) and GCC High supported.
- 02
Baseline and fix
Cloud gaps are detected, remediated under approval with rollback identifiers, and validated against the control objective.
- 03
Package the evidence
Evidence is grouped by control, objective, system, asset, and remediation event instead of dumped as screenshots.
- 04
C3PAO reviews and selects
Your assessor reviews the package, chooses the evidence that supports each objective, and asks for clarifications.
- 05
Official eMASS work stays with the assessor
The C3PAO prepares and submits the required CMMC eMASS assessment results; PolicyCortex supports that handoff.
Questions about the handoff
- Q-01
Does PolicyCortex upload directly to CMMC eMASS?
No. PolicyCortex prepares the control-mapped evidence package for the C3PAO handoff. The C3PAO controls the official CMMC assessment package and eMASS submission.
- Q-02
What does the C3PAO get from PolicyCortex?
Control-mapped evidence, remediation history, SSP and POA&M artifacts, OSCAL exports, auditor ZIPs, hashes, timestamps, asset scope, and cloud-state proof organized around the assessment objectives.
- Q-03
Does this replace my GRC or CSPM?
GRC tools document the gap and CSPMs find the gap. PolicyCortex records the state, the change, and the authority behind it, and packages that evidence so the C3PAO handoff is cleaner.
- Q-04
Why does the eMASS handoff matter?
CMMC assessment results still have to move through the assessor-controlled workflow. Clean evidence reduces manual cleanup, screenshot chasing, and back-and-forth before the official submission is prepared.
Connect a cloud. Hand off clean evidence.