For Department of Defense contractors, compliance is rarely owned by one person. It depends on leadership, clear communication, defined responsibilities, reliable evidence, and employees who understand what is expected of them. That is true whether your organization is building a quality management system under ISO 9001 or preparing for a CMMC assessment.
One clause that often causes confusion is ISO 5.2.2. Some organizations associate this clause with the former ISO management representative role. However, under the current ISO 9001:2015 standard, clause 5.2.2 focuses on communicating the quality policy. The mandatory management representative language came from ISO 9001:2008 clause 5.5.2 and was removed in the 2015 edition.
That change did not eliminate the need for leadership or coordination. It shifted accountability more clearly to top management while allowing organizations to assign qualified ISO representatives or quality representatives to coordinate the day-to-day work.
For defense contractors, the lesson is especially valuable: a capable compliance lead can organize the program, but leadership remains accountable for making compliance part of the business. If your organization needs help turning that principle into an assessment-ready cybersecurity program, schedule a free compliance call with CMMC IT Support or call 858-483-8770.
What Is ISO 5.2.2?
ISO 5.2.2 is commonly used as shorthand for clause 5.2.2 of ISO 9001:2015, “Communicating the quality policy.” In practical terms, an organization must ensure its quality policy is:
- Available and maintained as documented information
- Communicated, understood, and applied within the organization
- Available to relevant interested parties when appropriate
This is more than publishing a policy on an intranet or placing it on a wall. Employees should understand how the policy connects to their work, decisions, customer obligations, and quality objectives. The organization should also be able to show that its communication methods are effective.
As of August 2026, ISO 9001:2015 remains the current published edition, together with its 2024 climate-action amendment. ISO has also released a Final Draft International Standard for the next edition, but organizations should follow the published standard and applicable certification-body guidance until the replacement is formally issued.
ISO 5.2.2 Versus the Former Management Representative Clause
The similar clause numbers are a frequent source of outdated advice:
- ISO 9001:2008 clause 5.5.2 required management to appoint a management representative.
- ISO 9001:2015 clause 5.2.2 addresses communication of the quality policy.
- ISO 9001:2015 clause 5.3 addresses organizational roles, responsibilities, and authorities.
ISO 9001:2015 does not require one person to hold the title “Management Representative.” It places stronger emphasis on leadership ownership of the quality management system. An organization may still appoint a quality manager, compliance manager, or other representative to coordinate implementation, reporting, and audits.
That distinction matters. Delegating tasks is practical; delegating all accountability is not.
What Do ISO Representatives and Quality Representatives Do?
Although the title is optional, effective ISO representatives continue to provide substantial value. They connect leadership, process owners, employees, auditors, customers, and external certification bodies.
Depending on the organization, their responsibilities may include:
- Coordinating the design, implementation, and maintenance of the quality management system
- Making sure roles and process ownership are documented
- Managing controlled policies, procedures, forms, and records
- Organizing internal audits and tracking corrective actions
- Preparing inputs for management reviews
- Reporting performance, risks, nonconformities, and improvement opportunities
- Helping employees understand the quality policy and relevant customer requirements
- Coordinating communication with customers, registrars, auditors, and other interested parties
The best quality representatives are facilitators rather than bottlenecks. They create repeatable processes and help process owners produce reliable evidence. They do not become the only people who understand the system.
Skills Effective Quality Representatives Need
A strong representative typically combines subject-matter knowledge with practical business skills. Important capabilities include:
- Knowledge of the applicable standard and contractual requirements
- Familiarity with the organization’s operations and information flows
- Clear written and verbal communication
- Project management and follow-through
- The ability to influence teams without owning every process
- Sound document-control and recordkeeping habits
- Internal-audit and root-cause-analysis skills
- The confidence to report gaps accurately to senior leadership
These same qualities are useful when preparing for CMMC Level 2 compliance. A CMMC program needs coordination, but cybersecurity cannot be isolated within the IT department. Executives, security personnel, human resources, operations, contracts, and system users all contribute to the outcome.
How ISO 5.2.2 Connects to CMMC Level 2 Compliance
ISO 9001 and CMMC are different frameworks with different purposes. ISO 9001 addresses quality management; CMMC verifies implementation of cybersecurity requirements for protecting Federal Contract Information and Controlled Unclassified Information in the defense industrial base.
Still, ISO 5.2.2 offers a useful operational principle: a policy is effective only when people understand it and act on it.
For CMMC Level 2 compliance, contractors should apply that principle to security policies and procedures. Employees need to know how to identify and protect Controlled Unclassified Information, use approved systems, report incidents, follow access-control requirements, and avoid unauthorized tools or data transfers. A signed policy alone does not demonstrate consistent implementation.
The CMMC Program rule in 32 CFR Part 170 establishes the program requirements for contractors and subcontractors that process, store, or transmit FCI or CUI. Level 2 is currently based on the 110 security requirements in NIST SP 800-171 Revision 2, as incorporated into the CMMC rule. Depending on the solicitation or contract, Level 2 may require either a self-assessment or a certification assessment by an authorized CMMC Third-Party Assessment Organization.
A Practical Compliance Leadership Model
Defense contractors can create a clear structure without placing the entire burden on one employee:
- Executive leadership approves resources, resolves business risks, and provides the required affirmation of continuing compliance.
- The CMMC or security lead coordinates implementation, evidence collection, documentation, and readiness activities.
- Control owners operate specific requirements, such as access control, incident response, configuration management, and personnel security.
- Employees and external service providers follow documented practices within the defined CMMC assessment scope.
- Independent assessors evaluate the applicable environment and evidence when a formal assessment is required.
This model resembles the modern approach to ISO representatives: coordination can be assigned, but accountability and implementation remain distributed across the organization.
What Happens During a CMMC Assessment?
A CMMC assessment evaluates whether applicable security requirements are implemented within the defined assessment scope. For a Level 2 certification assessment, an authorized C3PAO assesses the organization using the procedures required by the CMMC rule and NIST SP 800-171A.
Assessors may examine documentation, interview personnel, and test or observe technical and operational practices. Evidence may include:
- A current System Security Plan
- An accurate network and data-flow diagram
- Asset inventories and scope classifications
- Policies, procedures, and configuration standards
- User access records and privileged-access reviews
- Security-awareness and role-based training records
- Vulnerability, patching, logging, and monitoring evidence
- Incident-response plans and test results
- Risk assessments and corrective-action records
- Contracts and responsibility matrices for external service providers
The objective is not simply to show that documents exist. The organization must demonstrate that required practices are implemented and operating as described.
Under the current rule, a Level 2 C3PAO status is generally valid for three years, and an affirmation is required at the assessment and annually afterward. Limited Plans of Action and Milestones may be permitted for a conditional status, but only under specific scoring and eligibility restrictions, and qualifying items must be closed within 180 days. Contractors should not plan on using a POA&M as a substitute for readiness.
How to Prepare for CMMC Level 2 Compliance
Preparation should begin well before an assessment is scheduled. A focused readiness program generally includes the following steps.
Define the CMMC Assessment Scope
Identify where CUI is processed, stored, and transmitted. Document the people, facilities, technologies, security-protection assets, and external service providers that affect the environment. Accurate scoping can reduce unnecessary cost and complexity while preventing dangerous exclusions.
Perform a Requirement-by-Requirement Gap Assessment
Evaluate all applicable NIST SP 800-171 requirements and their assessment objectives. Record what is implemented, what evidence exists, who owns each requirement, and what remediation remains. Avoid giving credit based only on intent or planned work.
Align Policies With Actual Operations
Policies should describe the environment you operate—not an idealized environment copied from a template. Confirm that employees, administrators, and vendors follow the documented procedures consistently.
Build an Evidence Library
Collect dated, traceable evidence throughout implementation. Organize it by requirement and assessment objective. Strong evidence should make it easy for an assessor to connect a policy statement to an implemented technical or operational practice.
Test Communication and Understanding
Use the lesson from ISO 5.2.2: communication must lead to understanding and application. Interview employees, observe workflows, test incident reporting, and verify that users know how to handle CUI. These internal checks can reveal gaps that policy reviews miss.
Conduct a Readiness Review
Before engaging a C3PAO, conduct a mock assessment or independent readiness review. Validate the SSP, scope, evidence, and technical implementation. Address weaknesses early enough to remediate and generate proof of sustained operation.
Common Mistakes That Put Assessments at Risk
Contractors often encounter avoidable problems when responsibility and evidence are unclear. Watch for these common issues:
- Treating compliance as an IT-only project
- Assigning a representative without executive authority or resources
- Using generic policies that do not match the actual environment
- Leaving CUI locations or external providers out of scope
- Confusing a policy statement with proof of implementation
- Waiting until the assessment to interview control owners
- Relying on future remediation instead of closing gaps before the assessment
- Failing to maintain evidence after an initial readiness project
A sustainable program makes responsibilities visible, communication routine, and evidence part of normal operations.
How CMMC IT Support Helps DoD Contractors Prepare
CMMC IT Support is a San Diego-based consultancy helping DoD contractors and subcontractors achieve and maintain CMMC Level 2 compliance. We help organizations translate requirements into practical technical controls, defensible documentation, trained personnel, and assessment-ready evidence.
Our team can support your organization with scoping, gap analysis, remediation planning, security documentation, Microsoft 365 and GCC High considerations, evidence development, and ongoing compliance maintenance. When a certification assessment is required, we help you prepare for the independent C3PAO process; we do not replace the authorized assessor.
Whether you need a complete readiness program or help strengthening an existing environment, request a quote or schedule a free compliance call today. You can also call 858-483-8770 or email info@cmmcitsupport.us.
Frequently Asked Questions
Is a Management Representative Required by ISO 9001:2015?
No. ISO 9001:2015 does not require the formal management representative role found in ISO 9001:2008. It does require organizational responsibilities and authorities to be assigned and communicated, while top management remains accountable for the quality management system.
What Does ISO 5.2.2 Require?
ISO 9001:2015 clause 5.2.2 requires the quality policy to be maintained as documented information, communicated and understood within the organization, applied in relevant work, and made available to appropriate interested parties.
Can ISO Representatives Also Lead CMMC Preparation?
They may coordinate both programs if they have the necessary cybersecurity knowledge, authority, and support. However, ISO 9001 and CMMC have distinct requirements. A multidisciplinary team with qualified technical and compliance expertise is usually more effective than relying on one person.
Who Performs a CMMC Level 2 Certification Assessment?
When a contract requires Level 2 certification, the formal assessment must be performed by an authorized or accredited C3PAO. A readiness consultant can help prepare the organization, remediate gaps, and organize evidence but should not be represented as the independent certifying assessor unless separately authorized for that role.
How Soon Should We Begin Preparing for a CMMC Assessment?
Begin as early as possible. Scoping, technical remediation, documentation, training, and evidence collection can take months. Starting early also gives your organization time to verify that controls operate consistently before assessors review them.
Build a Compliance Program That Works Beyond the Audit
The most important lesson from ISO 5.2.2 is that written commitments must become understood, repeatable behavior. Effective ISO representatives and quality representatives help coordinate that work, but leadership and process owners must keep the system functioning.
The same principle applies to a CMMC assessment. Passing depends on more than policies or a last-minute evidence collection effort. Your organization needs accurate scope, implemented safeguards, trained people, reliable records, and leadership that treats cybersecurity as a continuing business responsibility.
Ready to move toward CMMC Level 2 compliance with a clearer plan? Contact CMMC IT Support to request a quote or schedule your free compliance call, call 858-483-8770, or email info@cmmcitsupport.us today.