Init Cyber's formal complaints process for any party expressing dissatisfaction with C3PAO services, conduct, or processes
Init Cyber maintains a formal complaints process as a condition of its Cyber-AB C3PAO authorization. Any person or organization may submit a complaint regarding Init Cyber's C3PAO services, personnel conduct, or operational processes. This process is compliant with ISO/IEC 17020, 32 CFR Part 170, the CMMC Assessment Process (CAP), and the Cyber-AB Code of Professional Conduct.
A complaint is an expression of dissatisfaction with Init Cyber's services, conduct, or processes. A challenge to a specific MET or NOT MET assessment determination is not a complaint, it is an appeal and is governed by a separate process.
Formal complaints must be submitted in writing. Email complaints@initcyber.com and include the word "Complaint" in the subject line. Verbal expressions of dissatisfaction are informal and will not trigger this process.
A submission is treated as a formal complaint when all of the following are received:
Upon receiving a written complaint, Init Cyber will:
If the submission is determined to be an appeal rather than a complaint, Init Cyber will notify the complainant and redirect them to the appeals process. If required information is missing, the complainant will be notified within 10 business days. Submissions not completed within 14 calendar days will be closed.
If a complaint is directed against the C3PAO Certifying Official personally, Init Cyber will acknowledge receipt and refer the complainant directly to the Cyber-AB complaint process at complaints@cyberab.org.
All validated complaints are fully investigated. The investigation may include review of submitted information, requests for additional records, interviews with Init Cyber personnel, and review of applicable SOPs and assessment records.
If the complaint involves an allegation of unethical conduct, conflict of interest, fraud, or illegal activity, the matter may be referred to the Cyber-AB for parallel review.
If the investigation takes more than 15 calendar days, the complainant will receive a written interim status update.
Init Cyber's C3PAO Certifying Official will issue a formal written decision within 30 calendar days of the complaint being validated. The decision will state:
Complaint is logged and assigned a tracking number.
Written acknowledgment sent to complainant.
Interim status update provided if investigation is ongoing.
Formal written decision delivered to complainant.
If a complainant is not satisfied with Init Cyber's decision, or if Init Cyber fails to respond within the timeframes in this policy, the complainant may escalate to the Cyber-AB. Complaints may be submitted to complaints@cyberab.org or via the Cyber-AB website. The submission must include documentation showing the complaint was first submitted to Init Cyber.
A complainant who intends to escalate to the Cyber-AB must first submit a formal complaint to Init Cyber and allow a reasonable opportunity to resolve it.
Requests to keep a complainant's identity confidential will be honored to the extent practicable. Init Cyber will not disclose identifying information without consent, except as required by law or directed by the Cyber-AB. Requests for anonymity may limit Init Cyber's ability to fully investigate the complaint.
Init Cyber will not take retaliatory action against any individual or organization that submits a complaint in good faith.
Init Cyber maintains a log of all formal complaints including submission date, tracking number, assigned investigator, outcome, and closure date. Complaint records are retained for a minimum of 6 years from closure.
To submit a formal complaint or request a copy of this policy, email complaints@initcyber.com with "Complaint" in the subject line.