Reviews & Readiness
Reviews & Readiness is where a qualified reviewer evaluates how prepared you are before you engage a formal assessment. Instead of finding out during your C3PAO engagement that your evidence is thin or your boundary is wrong, you request an assurance checkpoint, an expert examines what you've built, and you get back a readiness score, written findings, and a prioritized list of what to fix.
There are two shapes to this: focused checkpoints that validate a specific slice of your work (a set of objectives and their evidence, your scope, your SSP, your policies), and comprehensive readiness reviews that assess your whole program and issue a formal C3PAO-readiness determination. Both consume checkpoint credits and both feed directly into your remediation planning.
/dashboard/reviews). Requesting a review requires an admin role; the review itself is performed by a CMMC assessor — see Permissions.Key concepts
Two kinds of review
A checkpoint is narrow and inexpensive; a readiness review is broad and thorough. Most organizations use checkpoints throughout their build and a readiness review as the final gate before a C3PAO.
| Review | What it covers | Typical use |
|---|---|---|
| Checkpoint | A focused set of objectives and the evidence linked to them, or a single milestone (scope, SSP, policies) | Validate work as you go, one phase at a time |
| Readiness review | Your whole program — SSP, evidence sufficiency, objective sampling, boundary, and stakeholder interviews | Final confidence check before engaging a C3PAO |
Checkpoint types
Checkpoints map to the phase of your engagement they validate. Each costs a set number of credits.
| Checkpoint | Phase | Credits |
|---|---|---|
| Scope Checkpoint | Early — boundary and asset scoping | 1 |
| Control Checkpoint | Build — objectives and their evidence | 1 |
| SSP Checkpoint | Documentation | 3 |
| Policy Checkpoint | Documentation | 3 |
| SSP + Policy Checkpoint | Documentation (bundled) | 5 |
| Accelerated Setup | Pre-engagement onboarding | 3 |
Readiness tiers
A readiness review is sized to the complexity of your environment. A short qualification wizard asks about your users, sites, identity architecture, cloud footprint, and in-scope systems, then recommends a tier. You confirm before anything is charged.
| Tier | Environment | Depth |
|---|---|---|
| Tier 1 — Cloud-Only | Cloud-only (M365 or Google Workspace), single site, no on-prem | Full SSP review, evidence sufficiency, up to 3 interviews |
| Tier 2 — Hybrid | Cloud plus on-prem, hybrid identity, one or more sites | Everything in Tier 1, plus hybrid identity and on-prem validation, up to 5 interviews |
| Tier 3 — Complex | Multi-site, enclave architecture, OT/ICS, specialized assets | Everything in Tier 2, plus enclave and asset-scoping deep review, up to 8 interviews, C3PAO readiness determination |
Status
Every review moves through the same lifecycle, and its status timeline records each change with a note from the reviewer.
| Status | Meaning |
|---|---|
| Pending | Requested, waiting for a reviewer to be assigned |
| In progress | A reviewer is assigned and actively working |
| Completed | Findings, notes, and (for readiness reviews) a score and report are available |
| Cancelled | Withdrawn before work began — credits are refunded |
What the reviewer delivers
When a readiness review completes, you receive a package rather than a single number.
| Deliverable | What it tells you |
|---|---|
| Readiness score | An overall percentage (0–100) of how prepared you are |
| SSP review notes | The reviewer's written assessment of your System Security Plan |
| Evidence review notes | Where your evidence is sufficient and where it falls short |
| Written report | Findings and recommendations you can download |
| Remediation priorities | An ordered list of what to fix first |
| C3PAO readiness determination | For Tier 3: pass / conditional / not ready |
Using reviews
You request a review, a reviewer works it, and you collect the results — all tracked on the Expert Reviews page.
Request a checkpoint review
A checkpoint is the fastest way to get an expert eye on a specific part of your assessment.
Choose the assessment
Start a new review and pick the assessment you want examined.
Select objectives and evidence
Browse your objectives by control family and select the ones you want reviewed. As you select objectives, the evidence you've already linked to them becomes available to include. One credit covers a batch of objectives and evidence; larger selections draw more credits, and the page tells you the cost before you commit.
Add a note
Optionally leave a note or question for the reviewer — for example, a specific concern about a boundary or a piece of evidence you're unsure about.
Submit
The request is created as Pending and a reviewer is notified. Your credit balance is debited when you submit.
Request a readiness review
A readiness review is the comprehensive, tiered evaluation you'd run before engaging a C3PAO.
Run the qualification wizard
Answer a short set of questions about your organization's size, sites, identity setup, cloud footprint, and in-scope systems. The wizard calculates a complexity score and recommends a tier.
Confirm the tier
Review the recommended tier, what it includes, and how many interviews it covers. Adjust upward if your environment warrants it.
Submit the request
Confirm to create the readiness review. It enters the queue as Pending, and the credits for the chosen tier are reserved.
Track a review
Open any review to see its current status, a timeline of every status change, and — once complete — its full deliverables.
Watch the status
While the review is In progress, the detail page shows whether a reviewer has been assigned and is actively working.
Collect the results
When the review is Completed, download the written report and any accompanying materials, and read the reviewer's SSP and evidence notes inline.
Cancel if needed
A Pending request (one no reviewer has started) can be cancelled, and its credits are refunded to your balance.
Permissions
Requesting a review and performing a review are deliberately different jobs held by different roles.
| Capability | Permission |
|---|---|
| Request a checkpoint review | REQUEST_REVIEW |
| Request a readiness review | REQUEST_READINESS_REVIEW |
| Write review findings and notes | WRITE_REVIEW_NOTES |
REQUEST_REVIEW is held by Org Admin, MSP Super, and MSP Admin; REQUEST_READINESS_REVIEW by Org Admin and MSP Super. Only the Assessor role holds WRITE_REVIEW_NOTES — the reviewer is a read-only party who can record findings but cannot change your data. Everyone who can view your compliance data can see a review's status and results; only admins can start one.
How it works
Extra detail on how reviews behave — product behavior, not internals.
Credits and how they're charged
Reviews are paid for with checkpoint credits, a prepaid balance on your organization. A checkpoint costs 1–5 credits depending on type and the size of your selection; a readiness review costs the credits for its tier. The cost is always shown before you commit, and a cancelled pending request refunds its credits in full.
For MSP-managed clients, requests are staged with the managing MSP first and draw from the MSP's shared credit pool only when the MSP forwards them — so a managed client never spends credits it doesn't control. Direct customers debit immediately on submission.
What the reviewer examines
A checkpoint review is scoped to exactly the objectives and evidence you selected — the reviewer sees the files and links already attached to those objectives, grouped the same way you see them in your Evidence Library. A readiness review is broader: the reviewer works across your SSP, your evidence sufficiency, a sampling of objectives (with extra attention on high-weight controls), your boundary documentation, and a set of stakeholder interviews sized to your tier.
The readiness determination
For the most complex environments, a readiness review ends with an explicit C3PAO readiness determination — pass, conditional, or not ready. This is the signal you're looking for before you spend money on a formal assessment: a conditional or not-ready result, paired with the remediation priority list, tells you precisely what to close before you engage a C3PAO.
Where results live
Every review stays on your Expert Reviews page with its full history. The status timeline is retained as an audit trail, completed reports and notes remain downloadable, and the attestation on each completed review keeps a permanent record of who performed it.
Related features
POA&M
Track remediation of compliance gaps and risks as a Plan of Action & Milestones — targets, milestones, status, and system scope — and see how open and overdue items shape your SPRS score and posture.
Risk Management
Identify, score, treat, and review information-security risks against a 5×5 model, link them to POA&Ms, and track your active risk posture over time.