Assessor Experiences in CMMC Level 2 Certification Assessments: An Interpretative Phenomenological Analysis of Role Expectations
This study employs Interpretative Phenomenological Analysis and Role Conflict Theory to explore the lived experiences of CMMC Level 2 assessors, revealing how they navigate the non-consultative model's constraints through technical competence, procedural discipline, and boundary management strategies.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
The Big Picture: The "Strict Referee" Rule
Imagine the U.S. Department of Defense (DoD) is a giant sports league. They want to make sure every team (defense contractors) is playing by the rules to keep their secrets safe. To prove they are playing fair, the teams need a referee to check their work. This is the CMMC program.
The paper focuses on Level 2, which is a high-stakes game. Here, the referees (called Assessors) are hired by a third party, not the teams themselves.
The Golden Rule: These referees are strictly forbidden from being coaches. They can't tell the teams how to fix their mistakes or give them tips on how to pass. They can only watch, take notes, and blow the whistle if rules are broken. This is called the "Non-Consultative Model."
The paper asks: What is it like to be a referee who can't coach?
The Study: Listening to Two Referees
The researchers interviewed two experienced referees (named "Timothy" and "John" in the paper) to understand their daily struggles. They didn't just ask "Do you like your job?" They dug deep into how these men felt about their roles, using a method called Interpretative Phenomenological Analysis (IPA). Think of this as a deep-dive interview where the goal is to understand the person's inner world, not just get a statistic.
The Three Main Stories (Themes)
The paper found three main ways these referees make sense of their jobs:
1. "I am Credible Because I Know My Stuff" (Professional Credibility)
- The Analogy: Imagine a judge in a courtroom. Their power doesn't come from a gun; it comes from the fact that everyone knows they are smart, trained, and follow the law perfectly.
- The Finding: Both referees said their authority comes from their competence. They have to be experts.
- Timothy felt his credibility came from being "hired" by many organizations because he was so good at his job.
- John felt his credibility came from being a "good guy" who never bends the rules, even when it's tempting.
- The Takeaway: To feel safe in their role, they rely on their deep knowledge and strict adherence to the rules.
2. "It's a Complex Puzzle, Not a Checklist" (Structured Work)
- The Analogy: Doing an assessment isn't like checking off items on a grocery list. It's more like solving a massive, moving jigsaw puzzle where the pieces keep changing shape.
- The Finding: The work is incredibly detailed and procedural. It requires planning, organizing mountains of evidence, and managing timelines.
- Timothy saw the process as something that could be "tuned up" and made more efficient over time.
- John saw it as a rigid structure that must be followed exactly, like a recipe, to ensure fairness.
- The Takeaway: The job is heavy, technical, and requires constant focus to keep the "puzzle" from falling apart.
3. "Walking the Tightrope" (The Boundary Problem)
- The Analogy: Imagine walking a tightrope over a canyon. On one side is "Helping the Team" (Consulting). On the other side is "Just Watching" (Assessing). If you lean too far to the helping side, you fall off the tightrope and lose your job. But the teams on the ground are constantly shouting, "Hey, how do I fix this?"
- The Finding: This is the biggest stress point. The teams being checked often ask for advice. The referees cannot give it.
- Timothy felt this was a broken system. He noted that teams are often unprepared and that the "no coaching" rule feels unfair, almost like a "pay-to-play" game where only rich teams can afford to figure it out alone.
- John felt this was a necessary evil. He believed that if the referee helps, the game is rigged. He used "ethical discipline" to stay on the rope, telling himself, "I can't grade my own paper."
- The Takeaway: The referees constantly have to say "No" to people asking for help, which creates tension. They have to be very careful not to accidentally give advice while trying to be helpful.
Why This Matters (The Conclusion)
The paper concludes that these referees aren't just robots following a script. They are humans trying to balance what the rules say (no coaching) with what the situation demands (teams are confused and need help).
They manage this by:
- Relying on their expertise to feel confident.
- Following strict procedures to stay organized.
- Using boundary strategies to politely but firmly say, "I can't tell you how to fix that, but I can tell you that it's broken."
The authors suggest that while the "no coaching" rule is important for fairness, the system might need better instructions for the teams so they don't get so confused that they pressure the referees. This would make the "tightrope walk" a little less dangerous for everyone.
In short: The paper is a look behind the curtain at the stress and strategy of being a cybersecurity referee who is allowed to spot the errors but is strictly forbidden from helping to fix them.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.