What is an Organization Seeking Assessment (OSA)?

An Organization Seeking Assessment (OSA) is an entity seeking to undergo a CMMC assessment. This includes organizations seeking Level 1 and 2 self-assessments and Level 2 and 3 independent certification assessments. This also includes organizations seeking an assessment in order to achieve CMMC compliance for the first time or to maintain it. 

The definition in the CMMC Final Rule (32 CFR Part 170.4) mentions organizations seeking to undergo an assessment to achieve and maintain “any CMMC Status.” This refers to the different status types an organization may see after submitting their assessments in the Supplier Performance Risk System (SPRS). For example, the potential CMMC Status Types for Level 2 are: 

• CMMC L2 Final Self-Assessment: Your score was 110, meaning you met all CMMC Level 2 self-assessment requirements. This status, with annual affirmations verifying compliance, is valid for 3 years.
• CMMC L2 Conditional Self-Assessment: Your score fell between 88 to 109, meaning you met most but not all CMMC Level 2 self-assessment requirements. This status is valid for 180 days.
• Pending Affirmation: Awaiting AO approval.
• Incomplete: Assessment information only partially completed.
• No CMMC Status: Your “CMMC L2 Final Self-Assessment” is expired.

The term OSA includes all Organizations Seeking Certification (OSCs).