--- title: Reviews & Readiness description: Request an expert reviewer to validate your evidence, SSP, and scope before a formal C3PAO assessment, receive a readiness score and written findings, and track each review from request to completed report. navigation: icon: i-lucide-badge-check --- # Reviews & Readiness **Reviews & Readiness** is where a qualified reviewer evaluates how prepared you are *before* you engage a formal assessment. Instead of finding out during your C3PAO engagement that your evidence is thin or your boundary is wrong, you request an assurance checkpoint, an expert examines what you've built, and you get back a **readiness score**, written findings, and a prioritized list of what to fix. There are two shapes to this: focused **checkpoints** that validate a specific slice of your work (a set of objectives and their evidence, your scope, your SSP, your policies), and comprehensive **readiness reviews** that assess your whole program and issue a formal C3PAO-readiness determination. Both consume **checkpoint credits** and both feed directly into your remediation planning. ::note Find it in the sidebar under **Expert Reviews** (`/dashboard/reviews`). Requesting a review requires an admin role; the review itself is performed by a CMMC assessor — see [Permissions](#permissions). :: --- ## Key concepts ### Two kinds of review A checkpoint is narrow and inexpensive; a readiness review is broad and thorough. Most organizations use checkpoints throughout their build and a readiness review as the final gate before a C3PAO. | Review | What it covers | Typical use | | --- | --- | --- | | **Checkpoint** | A focused set of objectives and the evidence linked to them, or a single milestone (scope, SSP, policies) | Validate work as you go, one phase at a time | | **Readiness review** | Your whole program — SSP, evidence sufficiency, objective sampling, boundary, and stakeholder interviews | Final confidence check before engaging a C3PAO | ### Checkpoint types Checkpoints map to the phase of your engagement they validate. Each costs a set number of credits. | Checkpoint | Phase | :badge[Credits]{color="neutral"} | | --- | --- | --- | | **Scope Checkpoint** | Early — boundary and asset scoping | 1 | | **Control Checkpoint** | Build — objectives and their evidence | 1 | | **SSP Checkpoint** | Documentation | 3 | | **Policy Checkpoint** | Documentation | 3 | | **SSP + Policy Checkpoint** | Documentation (bundled) | 5 | | **Accelerated Setup** | Pre-engagement onboarding | 3 | ### Readiness tiers A readiness review is sized to the complexity of your environment. A short **qualification wizard** asks about your users, sites, identity architecture, cloud footprint, and in-scope systems, then recommends a tier. You confirm before anything is charged. | Tier | Environment | Depth | | --- | --- | --- | | :badge[Tier 1 — Cloud-Only]{color="success"} | Cloud-only (M365 or Google Workspace), single site, no on-prem | Full SSP review, evidence sufficiency, up to 3 interviews | | :badge[Tier 2 — Hybrid]{color="warning"} | Cloud plus on-prem, hybrid identity, one or more sites | Everything in Tier 1, plus hybrid identity and on-prem validation, up to 5 interviews | | :badge[Tier 3 — Complex]{color="error"} | Multi-site, enclave architecture, OT/ICS, specialized assets | Everything in Tier 2, plus enclave and asset-scoping deep review, up to 8 interviews, C3PAO readiness determination | ::tip The wizard's recommendation is a floor, not a ceiling — if your environment is more involved than the questions capture, you can request a higher tier. The tier only sets the depth and the number of interviews; it never changes the read-only nature of the review. :: ### Status Every review moves through the same lifecycle, and its status timeline records each change with a note from the reviewer. | Status | Meaning | | --- | --- | | **Pending** | Requested, waiting for a reviewer to be assigned | | **In progress** | A reviewer is assigned and actively working | | **Completed** | Findings, notes, and (for readiness reviews) a score and report are available | | **Cancelled** | Withdrawn before work began — credits are refunded | ### What the reviewer delivers When a readiness review completes, you receive a package rather than a single number. | Deliverable | What it tells you | | --- | --- | | **Readiness score** | An overall percentage (0–100) of how prepared you are | | **SSP review notes** | The reviewer's written assessment of your System Security Plan | | **Evidence review notes** | Where your evidence is sufficient and where it falls short | | **Written report** | Findings and recommendations you can download | | **Remediation priorities** | An ordered list of what to fix first | | **C3PAO readiness determination** | For Tier 3: pass / conditional / not ready | --- ## Using reviews You request a review, a reviewer works it, and you collect the results — all tracked on the Expert Reviews page. ### Request a checkpoint review A checkpoint is the fastest way to get an expert eye on a specific part of your assessment. ::steps{level="4"} #### Choose the assessment Start a new review and pick the **assessment** you want examined. #### Select objectives and evidence Browse your objectives by control family and select the ones you want reviewed. As you select objectives, the evidence you've already linked to them becomes available to include. One credit covers a batch of objectives and evidence; larger selections draw more credits, and the page tells you the cost before you commit. #### Add a note Optionally leave a **note or question** for the reviewer — for example, a specific concern about a boundary or a piece of evidence you're unsure about. #### Submit The request is created as **Pending** and a reviewer is notified. Your credit balance is debited when you submit. :: ::note The reviewer examines the exact evidence you selected — the files and links already attached to those objectives. Nothing new is uploaded for the review; it works against what's already in your assessment. :: ### Request a readiness review A readiness review is the comprehensive, tiered evaluation you'd run before engaging a C3PAO. ::steps{level="4"} #### Run the qualification wizard Answer a short set of questions about your organization's size, sites, identity setup, cloud footprint, and in-scope systems. The wizard calculates a **complexity score** and recommends a tier. #### Confirm the tier Review the recommended tier, what it includes, and how many interviews it covers. Adjust upward if your environment warrants it. #### Submit the request Confirm to create the readiness review. It enters the queue as **Pending**, and the credits for the chosen tier are reserved. :: ::tip Run a few **checkpoints** during your build and save the full **readiness review** for when your SSP and evidence are largely complete — you'll get a more meaningful score and a cleaner remediation list. :: ### Track a review Open any review to see its current status, a timeline of every status change, and — once complete — its full deliverables. ::steps{level="4"} #### Watch the status While the review is **In progress**, the detail page shows whether a reviewer has been assigned and is actively working. #### Collect the results When the review is **Completed**, download the written report and any accompanying materials, and read the reviewer's SSP and evidence notes inline. #### Cancel if needed A **Pending** request (one no reviewer has started) can be cancelled, and its credits are refunded to your balance. :: ::note Completed reviews carry an **attestation** identifying who performed the work — your dibfi assessor, or, for managed clients, your MSP where they have a certified assessor on staff. This keeps the record truthful about who signed off. :: --- ## Permissions Requesting a review and performing a review are deliberately different jobs held by different roles. | Capability | Permission | | --- | --- | | Request a checkpoint review | :badge[REQUEST_REVIEW]{color="info"} | | Request a readiness review | :badge[REQUEST_READINESS_REVIEW]{color="info"} | | Write review findings and notes | :badge[WRITE_REVIEW_NOTES]{color="warning"} | `REQUEST_REVIEW` is held by **Org Admin, MSP Super, and MSP Admin**; `REQUEST_READINESS_REVIEW` by **Org Admin and MSP Super**. Only the **Assessor** role holds `WRITE_REVIEW_NOTES` — the reviewer is a read-only party who can record findings but cannot change your data. Everyone who can view your compliance data can *see* a review's status and results; only admins can *start* one. ::warning The Assessor role is intentionally read-only apart from writing review notes. A reviewer evaluating your readiness never edits your evidence, objectives, or SSP — so their findings are an independent second opinion, not a hand on your data. :: --- ## How it works Extra detail on how reviews behave — product behavior, not internals. ### Credits and how they're charged Reviews are paid for with **checkpoint credits**, a prepaid balance on your organization. A checkpoint costs 1–5 credits depending on type and the size of your selection; a readiness review costs the credits for its tier. The cost is always shown before you commit, and a cancelled pending request refunds its credits in full. For **MSP-managed clients**, requests are staged with the managing MSP first and draw from the MSP's shared credit pool only when the MSP forwards them — so a managed client never spends credits it doesn't control. Direct customers debit immediately on submission. ### What the reviewer examines A checkpoint review is scoped to exactly the objectives and evidence you selected — the reviewer sees the files and links already attached to those objectives, grouped the same way you see them in your Evidence Library. A readiness review is broader: the reviewer works across your SSP, your evidence sufficiency, a sampling of objectives (with extra attention on high-weight controls), your boundary documentation, and a set of stakeholder interviews sized to your tier. ### The readiness determination For the most complex environments, a readiness review ends with an explicit **C3PAO readiness determination** — pass, conditional, or not ready. This is the signal you're looking for before you spend money on a formal assessment: a conditional or not-ready result, paired with the remediation priority list, tells you precisely what to close before you engage a C3PAO. ### Where results live Every review stays on your Expert Reviews page with its full history. The status timeline is retained as an audit trail, completed reports and notes remain downloadable, and the attestation on each completed review keeps a permanent record of who performed it. --- ## Related features :::card-group ::card{title="Assessments" icon="i-lucide-clipboard-check" to="https://app.dibfi.com/dashboard/systems"} The objectives and evidence a checkpoint review examines. :: ::card{title="System Security Plan" icon="i-lucide-file-text"} The SSP a readiness review evaluates and scores. :: ::card{title="POA&M" icon="i-lucide-list-checks" to="https://app.dibfi.com/dashboard/poam"} Turn a review's remediation priorities into tracked milestones. :: :::