Choosing a CMMC provider usually means choosing two kinds of firm. One helps you prepare: a consultant, Registered Practitioner, or Registered Practitioner Organization (RPO). The other independently assesses you: a C3PAO, a Certified Third-Party Assessment Organization authorized by the Cyber AB. A C3PAO can’t assess an organization it provided consulting services to within the preceding three years, so the two roles need separate firms.
To choose a C3PAO:
- Confirm its authorization on the Cyber AB Marketplace.
- Check its assessors’ credentials, capacity, and independence.
- Ask how it scopes, schedules, and reports.
What is a C3PAO?
C3PAO stands for Certified Third-Party Assessment Organization. It is an organization authorized by the Cyber AB to conduct CMMC Level 2 certification assessments of defense contractors. A C3PAO:
- Plans and conducts Level 2 assessments using Certified CMMC Assessors (CCAs).
- Scores each requirement against its assessment objectives.
- Submits results to the Department of War’s CMMC eMASS system; your status then appears in SPRS.
- Issues a certification valid for three years, with annual affirmations.
C3PAOs don’t assess Level 1 (self-assessment) or Level 3 (conducted by DCMA’s DIBCAC). For the full process, see how CMMC works.
What it takes to become an authorized C3PAO
Authorization is demanding by design. A C3PAO must be accredited by the Cyber AB to the ISO/IEC 17020 inspection-body standard; pass its own CMMC Level 2 assessment, conducted by DCMA DIBCAC; complete a foreign ownership, control, or influence (FOCI) review; and staff its assessments with certified assessors who have passed background investigations.
Who are CMMC auditors?
People often say “CMMC auditor” when they mean a Certified CMMC Assessor (CCA): an individual certified to conduct CMMC assessments as part of a C3PAO’s team. A Lead CCA directs each Level 2 assessment. Certified CMMC Professionals (CCPs) can support assessments. CCP and CCA certifications are issued through the CMMC certification body (CAICO), a role ISACA holds as of 2026.
C3PAO vs. CMMC consultant or RPO
| Consultant / RP / RPO | C3PAO | |
|---|---|---|
| Role | Helps you scope, implement, document, and prepare | Independently assesses whether you meet the requirements |
| Authorized by | Cyber AB registration (RP/RPA/RPO) is common but not required for consultants | Cyber AB authorization (required) |
| Can issue CMMC certification? | No | Yes, at Level 2 |
| Typical deliverables | Gap assessment, remediation plan, SSP, policies | Assessment results in eMASS, CMMC status in SPRS, certificate |
The independence rule: CMMC’s conflict-of-interest requirements bar a C3PAO from assessing an organization it provided consulting services to within the preceding three years. Plan on separate providers for preparation and certification.
Where to find authorized C3PAOs
The authoritative C3PAO list is the Cyber AB Marketplace. It shows every authorized C3PAO, plus registered RPs and RPOs and certified individuals. As of early 2026 it listed about 100 authorized C3PAOs.
Before you engage any firm that calls itself a C3PAO:
- Search for it on the Marketplace by name.
- Confirm its status reads authorized, not pending or in process.
- Note the assessors it lists, and ask which of them will be on your assessment.
If a firm isn’t listed as authorized, it can’t issue a CMMC Level 2 certification, no matter how it describes itself.
How to choose a C3PAO: 10 questions to ask
- Are you authorized on the Cyber AB Marketplace today? Verify it yourself.
- Have you advised us, or any of our affiliates, on CMMC in the past three years? If yes, that C3PAO can’t assess you.
- Who will be on our assessment team? Ask for names and CCA status. Is the Lead CCA experienced with environments like yours (manufacturing, cloud-heavy, multi-site)?
- How many Level 2 assessments has your team completed? Ask for a number, not adjectives.
- What is your current scheduling lead time? Assessor capacity is finite and demand spikes around contract deadlines.
- How do you confirm scope before the assessment starts? You want agreement on assets, ESPs, and boundaries in writing before day one.
- What do you need from us, and when? Ask for the documentation and evidence list and the timeline.
- How is the assessment conducted? On-site versus remote, duration, and interview scheduling.
- How do you handle a NOT MET finding or a POA&M closeout? Ask how the 180-day closeout assessment is scheduled and priced.
- How is pricing structured? Get a scoped quote that states what is included, such as the closeout assessment and any reassessment.
Red flags: a C3PAO that offers to prepare you and then assess you, promises a pass, quotes a price without scoping, or can’t show its Marketplace authorization. See red flags when choosing a CMMC provider.
How to choose a CMMC consultant or RPO
- Relevant credentials: RP/RPA/RPO registration with the Cyber AB, and individuals holding CCP or CCA certification.
- Hands-on NIST SP 800-171 implementation experience, not just policy writing. Ask what technical controls they have implemented.
- A clear deliverable set: gap assessment, prioritized remediation plan, SSP, and POA&M.
- Honesty about independence. A good advisor will tell you to use a separate C3PAO and will not promise a certification outcome.
- Fit with your environment: cloud platform, MSP relationships, enclave approach, and company size.
Do you need a C3PAO right now?
As of October 2026, Phase 2 is suspended pending a DoW review, so most new contracts call for a Level 2 self-assessment. Some contracts and prime contractors still request C3PAO certification. A certification earned now remains valid for three years, with annual affirmations. See where CMMC stands now.
Frequently asked questions
Work with RSI Security
RSI Security is a Cyber AB-authorized C3PAO that performs independent CMMC Level 2 assessments. Organizations still preparing can work with RSI Security through a separate advisory engagement. RSI Security does not assess any organization it has advised on CMMC. Ask us the ten questions above; we’ll answer every one.
Schedule a CMMC Level 2 assessment · Talk to an advisor about readiness