Overview

What the Bedrock C3PAO client is and how it fits into an assessment engagement.

The Bedrock C3PAO client is a standalone assessment portal for certified assessors. It runs as a Docker container — on an assessment laptop, an on-premises server, or inside a government-approved VDI — and is designed to operate fully air-gapped: once it is running, conducting an assessment requires no network connection to the Bedrock CMMC platform or anything else.

How it works

• Assessment packages are imported, not synced. The contractor (OSC) exports their assessment package from Bedrock CMMC as a file. You load that file into the client with the Import Package wizard, and the entire package — SSP, controls, evidence, POA&Ms, assets — becomes available locally for offline assessment.
• Everything you record stays local. Objective scores, findings, notes, readiness checklists, and schedules are stored in the instance's own PostgreSQL database, which ships inside the same Docker Compose stack. Nothing is transmitted off the machine.
• Deliverables are generated in the client. Export the eMASS-compatible Excel workbook, JSON exports, reference baselines, and draft certificate PDFs directly from your findings — each one downloads through your browser like any other file.

Who this documentation is for

These docs cover the assessor experience: installing the container, setting up an instance, and conducting an assessment. If you are a contractor (OSC) preparing for assessment, see the Bedrock CMMC docs instead.

Where to go next

• Installation — get the container running and complete first-run setup.
• Signing in and finding your way around — the login flow and the portal layout.
• How your data moves — exactly what stays on the instance and what leaves it.