C3PAO & the CMMC Assessment Ecosystem: Who’s Who and How to Engage an Assessor

A CMMC Third-Party Assessment Organization (C3PAO) conducts Level 2 certification assessments for defense contractors under the Cybersecurity Maturity Model Certification (CMMC) program.

C3PAOs work alongside oversight bodies, trainers, and readiness advisers. Contractors need to distinguish the firms that help them prepare from the firms authorized to assess them. The July 2026 Phase II suspension also makes it important to check the assessment requirement in the solicitation or contract, including any executed modifications, before engaging a C3PAO.

This guide explains who’s who in the CMMC ecosystem, when a C3PAO assessment is required, and what to check before choosing an assessor. For a walkthrough of the assessment itself, see the CMMC assessment and audit guide.

Prepare for your CMMC Level 2 C3PAO assessment.

Review all 149 CMMC Level 1–3 requirements and 459 assessment objectives alongside NIST SP 800-53 controls mapped to NIST SP 800-171 Rev. 2 and Rev. 3, CSF 2.0, SOC 2, ISO/IEC 27001:2022, and HIPAA.

Get the NIST 800-53 Multi-Framework crosswalk →

The CMMC Ecosystem

The CMMC ecosystem includes every organization that prepares, assesses, or certifies contractors for CMMC compliance.

• The Department of Defense (DoD) oversees CMMC through its Program Management Office (PMO).
• Under the DoD, the Cyber AB authorizes and accredits C3PAOs.

C3PAOs use certified assessors to conduct Level 2 certification assessments. Assessors first earn the CMMC Certified Professional (CCP) credential, then the CMMC Certified Assessor (CCA) credential. Only then can they conduct Level 2 assessments. Approved Training Providers (ATPs), formerly Licensed Training Providers (LTPs), prepare candidates for these exams.

For a Final Level 2 (C3PAO) status, all 110 NIST SP 800-171 Revision 2 requirements must be assessed as MET. A score of at least 88 out of 110 is necessary for Conditional status, but the remaining gaps must also meet the restrictions on Plans of Action and Milestones (POA&Ms). Eligible gaps must be closed and verified within 180 days.

Readiness advisers help contractors review requirements, find gaps, and organize evidence before a CMMC assessment.

The table below summarizes each role’s responsibilities, its part in the assessment process, and whether it can issue certificates.

What Is a C3PAO?

A C3PAO checks whether defense contractors meet CMMC Level 2 requirements and issues Certificates of CMMC Status.

A CMMC Third-Party Assessment Organization (C3PAO) checks whether a contractor meets Level 2 security requirements. Its assessors use the examine, interview, and test methods in NIST SP 800-171A, June 2018. The C3PAO records the findings and issues a certificate when the assessment supports the required CMMC status. 32 CFR §170.9 defines its responsibilities.

Each C3PAO holds one of two statuses:

• Authorized: The C3PAO conducts certification assessments while it works toward full accreditation.
• Accredited: The C3PAO has met all accreditation requirements, including those of ISO/IEC 17020.

Authorization is a temporary status under 32 CFR §170.4, and the Cyber AB’s R2001 requirements give authorized C3PAOs 27 months to complete accreditation.

Who Is on a C3PAO Team?

A C3PAO Level 2 assessment requires a team of at least two CCAs and a separate quality assurance CCA. CCP participation is optional under 32 CFR §170.9.

• CCAs: Make the assessment determinations. Each Level 2 certification assessment team must include a Lead CCA and at least one other CCA. Additional CCAs can also join.
• CCPs: Can join the team but cannot fill the required second CCA spot. CCPs with a favorable Tier 3 determination may check Level 1 practices under CCA oversight, according to ISACA’s credential guidance.
• Quality assurance CCA: Reviews the assessment from outside the team. This separate CCA is required for every assessment.

C3PAO Responsibilities

A C3PAO plans, conducts, and reports on each Level 2 certification assessment, according to 32 CFR §170.9.

Its work happens in three stages:

• Contracting and planning: Agree on the assessment scope, required status, deliverables, and schedule with the Organization Seeking Certification (OSC).
• Assessment: Review evidence, interview staff, and test controls across the in-scope environment, then document the findings.
• Reporting and certification: Issue a Certificate of CMMC Status based on the results. Then, submit assessment materials and certificates to the CMMC instance of the Enterprise Mission Assurance Support Service (eMASS).

What Is a C3PAO Assessment?

A C3PAO assessment checks whether a contractor meets the Level 2 requirements in 32 CFR §170.17. The regulation calls it a certification assessment. The CMMC program distinguishes two types of information:

• Federal Contract Information (FCI): Non-public information provided by or generated for the government under a contract to develop or deliver a product or service. It excludes information the government makes public and simple transactional information, such as information needed to process payments, under FAR 52.204-21.
• Controlled Unclassified Information (CUI): Unclassified information the government creates or possesses, or an entity creates or possesses for or on behalf of the government, for which law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls. 32 CFR §2002.4 defines the term.

Level 2 requirements focus on protecting CUI.

For help identifying FCI and CUI and deciding which systems belong in your assessment scope, see our CMMC scoping guide.

When Is a C3PAO Assessment Required?

A C3PAO assessment is required when the applicable solicitation or contract calls for Level 2 (C3PAO) status. Contractors should check amendments and executed modifications before engaging an assessor, because those documents determine whether the requirement still applies.

The CMMC program rule defines assessment requirements by level:

• Level 1: Contractors complete an annual self-assessment and affirm continuing compliance.
• Level 2: Contractors complete a self-assessment or C3PAO certification assessment every three years, with annual affirmations. The required assessment type follows the applicable solicitation or contract.
• Level 3: DCMA DIBCAC conducts the certification assessment. The relevant systems must already hold current Final Level 2 (C3PAO) status, and contractors must maintain both certifications and their annual affirmations.

A qualifying DIBCAC High Assessment completed before the rule took effect can also establish Final Level 2 (C3PAO) status under §170.20. The assessment must have a perfect score, no open POA&Ms, and the same Level 2 scope. That status lasts three years from the original assessment, with an affirmation in SPRS initially and annually thereafter.

The July 2026 Phase II suspension changed the procurement rollout. Class Deviation 2026-O0025, Revision 3 permits Level 1 (Self) or Level 2 (Self) procurement requirements and directs amendments or modifications to affected solicitations and contracts. Existing contract requirements do not disappear automatically. Contractors should confirm the executed modification before treating a C3PAO requirement as removed.

How to Prepare for a C3PAO Assessment

Contractors can prepare for a C3PAO assessment with a registered adviser, their own internal team, or another qualified adviser. The right choice depends on the team’s CMMC experience and the scope of work.

• Internal team: Works best when the team knows CMMC and can review controls, find gaps, and organize evidence.
• Registered Practitioner (RP): Suits a focused review when the team lacks CMMC experience or capacity.
• Registered Practitioner Organization (RPO): Handles broader engagements that need several specialists.
• Other qualified adviser: Offers the same support without Cyber AB registration.

Because registration alone doesn’t guarantee these capabilities, contractors must check a proposed adviser’s experience and deliverables before hiring one.

Check your CMMC Level 2 readiness before engaging a C3PAO.
Use our NIST 800-53 Multi-Framework Crosswalk to explore all 149 CMMC Level 1–3 requirements and 459 assessment objectives. Compare the Level 2 requirements with your existing safeguards and evidence to identify gaps.
Get the CMMC↔NIST 800-53 crosswalk →

Reporting Obligations After a C3PAO Assessment

For contracts containing DFARS 252.204-7021, contractors must maintain the required CMMC status for the contract’s duration. Their affirming official must submit and maintain a current annual affirmation in the Supplier Performance Risk System (SPRS) for each applicable CMMC unique identifier (UID). These obligations follow the clause and the executed contract, including modifications.

How the Phase II Suspension Changes C3PAO Requirements

The July 13, 2026 suspension halted the planned November 2026 Phase II transition. Class Deviation 2026-O0025, Revision 3, signed September 3, 2026, carries that suspension into contracting instructions. It directs contracting officers to work with requiring activities to remove or revise affected CMMC requirements in new and existing solicitations and contracts.

CMMC Phase II suspension: The deviation permits Level 1 (Self) or Level 2 (Self) requirements in procurement requests. An existing contract’s requirement must be changed through an executed modification. Contractors should check that contract before deciding whether certification is required.

The deviation specifies the following actions:

• Procurement requests: Requiring activities may include Level 1 (Self) or Level 2 (Self) assessments.
• Underlying safeguards: Baseline compliance with NIST SP 800-171 Revision 2 continues in accordance with DFARS 252.204-7012.
• Active solicitations: Program managers and requiring activities must initiate amendments, and contracting officers must issue the corresponding amendments as soon as practicable.
• Existing contracts: Contracting officers must remove affected requirements by modification before the next option exercise or through the next scheduled administrative modification. Contractors should confirm that the modification has been executed before treating a requirement as removed.

Assessment Capacity and Program Planning

In its March 2026 report, GAO found that the department had not assessed and documented how it would address the risk of insufficient private-sector assessment capacity. That finding concerns the assessments delivered by private organizations. It does not mean every defense contractor needs a C3PAO assessment.

The DoD agreed with GAO’s recommendation to document external factors and approaches to address them.

GAO’s current recommendation record states that the department’s corrective action plan targets December 31, 2026, for completing that documentation. It also records the July suspension and review. Contractors should treat that target as a program-planning deadline, not a new certification deadline.

What Still Applies During the Suspension

Safeguarding duties and the CMMC assessment ecosystem continue during the suspension. The applicable contract remains the starting point for determining a contractor’s obligations.

• Government assessment access: Where DFARS 252.204-7020 applies, contractors must provide the access needed for a government Medium or High NIST SP 800-171 assessment if necessary. This is distinct from a CMMC certification assessment.
• Safeguarding obligations: Where DFARS 252.204-7012 applies, contractors must protect covered contractor information systems and report qualifying cyber incidents. Check the signed contract and executed modifications to confirm the applicable obligations.
• Cyber AB services: Assessment, training, examination, and advisory services remain operational, according to the Cyber AB’s statement.

Plan around upcoming CMMC dates with the CMMC deadline and timeline guide, and see what each level involves in the CMMC requirements guide.

Should You Still Pursue a C3PAO Assessment?

A voluntary C3PAO assessment may be appropriate when a contractor has a specific customer requirement or wants an independently assessed Level 2 status. Before booking, compare that objective with the contract or prime’s requirements, the readiness of the assessed environment, and the full cost of the engagement. Confirm the intended use of the certificate so the assessment supports a defined business need.

How to Select a C3PAO

To select a C3PAO, confirm its authorization in the Cyber AB Marketplace, then review its independence, experience, proposal, and availability.

Step 1 — Check C3PAO Authorization Status

Use the Cyber AB Marketplace to find candidate firms, then verify the specific legal entity’s authorization or accreditation before requesting a proposal. The Cyber AB’s FAQ states that authorized C3PAOs are posted in the Marketplace. The relevant distinctions are:

• Candidate: The firm is still completing authorization.
• Authorized: The firm can conduct Level 2 certification assessments while it works toward accreditation.
• Accredited: The firm has completed the required accreditation process.

Authorized and accredited C3PAOs can both conduct Level 2 certification assessments. Confirm the status of the specific legal entity you’re hiring, record the Marketplace listing and check date, and recheck before the assessment begins.

Step 2 — Confirm C3PAO Independence

Ask whether the C3PAO or anyone on its assessment team served as a consultant to prepare the contractor for a CMMC assessment within the past three years. 32 CFR §170.8 prohibits participation in that contractor’s Level 2 certification assessment in those circumstances. The rule also addresses financial interests, business relationships, prior employment, and close personal ties that may create conflicts. Request written disclosures so the contractor can identify conflicts before selecting the assessor.

Step 3 — Evaluate C3PAO Experience and Fit

Ask the C3PAO for examples of past assessments involving similar information types, systems, and contractor environments. Client references can show how the firm handles evidence review and communication.

Confirm that the assessment team understands the systems and external service providers within the assessment scope. Before signing, agree with the C3PAO on evidence access, confidentiality, and how the assessment will run.

Step 4 — Compare C3PAO Proposals and Confirm Availability

Compare C3PAO proposals to evaluate price, experience, approach, and availability. Request the following details so the proposals can be compared on the same scope:

• Assessment dates
• Named team members and their credentials
• Reporting milestones and responsibilities
• A fee breakdown covering assessor fees, contractor and service-provider effort, travel, and any closeout or rescheduling charges

As of July 15, 2026, there were 110 authorized C3PAOs and more than 1,000 CCAs, according to the Cyber AB’s statement. Use the current Marketplace to verify a firm’s status, and confirm assessment dates and staffing in writing before signing.

Independent vs. Government-Led CMMC Assessments

C3PAOs issue Level 2 Certificates of CMMC Status, while DCMA DIBCAC issues Level 3 certificates under 32 CFR Part 170. Government Medium and High assessments under DFARS 252.204-7020 instead produce NIST SP 800-171 assessment scores. These are different assessment routes:

• Independent assessment: A C3PAO assesses the Level 2 requirements, whether the contractor seeks certification for a contract requirement or voluntarily.
• Government-led CMMC assessment: DCMA DIBCAC assesses Level 3 requirements on systems that already have Final Level 2 (C3PAO) status. The rule also permits external service providers to seek a Level 3 assessment voluntarily.

What It Takes to Become a C3PAO

Becoming a C3PAO requires authorization from the Cyber AB after the firm satisfies security, staffing, and oversight requirements. The 27-month deadline applies to achieving accreditation after authorization. It is not an estimate of how long initial authorization takes.

The Cyber AB’s January 2026 R2001 requirements list the authorization steps, and 32 CFR §170.9 sets out a C3PAO’s obligations under the CMMC program rule.

To become a C3PAO, a firm must:

1. Apply and pay fees: Submit an application and pay the Cyber AB’s application and authorization fees.
2. Pass a background check: Complete an Experian business check and repeat it annually.
3. Pass a foreign-influence review: Complete the Defense Counterintelligence and Security Agency’s (DCSA) Foreign Ownership, Control, or Influence (FOCI) review and receive a non-disqualifying determination from the CMMC PMO initially and every three years.
4. Sign the agreements: Complete the Cyber AB interview and sign the C3PAO Agreement and Code of Professional Conduct, which set the firm’s program and professional obligations.
5. Staff qualified assessors: Keep at least three CCAs on staff or under contract, including a Lead CCA and a separate quality assurance CCA.
6. Pass a DIBCAC assessment: Have DCMA DIBCAC assess the firm’s own information system against the Final Level 2 requirements before authorization and every three years after.
7. Carry required insurance: Maintain at least $1 million each in general liability, errors and omissions, and cybersecurity liability coverage, according to the Cyber AB’s published authorization conditions.
8. Complete the authorization review: Confirm the remaining requirements with the Cyber AB, including a valid Commercial and Government Entity (CAGE) code. Authorization depends on completing the full review, not on submitting an application.
9. Achieve accreditation: Earn International Organization for Standardization/International Electrotechnical Commission (ISO/IEC) 17020:2012 accreditation within 27 months of authorization.

For a walkthrough of the steps contractors must take to get certified, see our CMMC certification guide.

What C3PAO Authorization Tells Contractors

C3PAO authorization means the firm meets security, personnel-vetting, and oversight requirements that protect contractors.

• Assessed environment: The firm passed a DIBCAC Level 2 assessment and must maintain its CMMC facilities, personnel, and equipment within that assessed scope under §170.9(b)(16), so contractors work with an assessor whose own environment the DoD has reviewed.
• Vetted assessors: Every assessment team member, including the separate quality assurance CCA, must complete a Tier 3 background investigation with a favorable determination, or a DoD-approved equivalent, under §170.9(b)(3).
• Foreign-influence screening: The firm received a non-disqualifying foreign ownership, control, or influence (FOCI) determination and must report changes to its foreign-interest information within 15 business days under §170.9(b)(5), giving contractors an assessor the DoD has screened for foreign influence.
• A path to dispute results: If contractors disagree with their results, they can appeal to the C3PAO and escalate to the Cyber AB for a final decision under §170.9(b)(19).
• Required insurance: C3PAOs must carry errors and omissions and cybersecurity liability insurance, which may provide financial recourse for covered claims, according to the Cyber AB’s published authorization conditions.

How to Simplify C3PAO Assessment Preparation

Isora GRC, the GRC Assessment Platform™, connects CMMC readiness assessments, supporting evidence, and remediation tracking in one workspace. Security teams can coordinate contributors, examine the responses behind assessment results, and follow up on deficiencies before engaging a C3PAO. The team remains responsible for defining scope and evaluating evidence, while an authorized C3PAO performs the certification assessment.

See the GRC Assessment Platform in action →

Assessment Management

Organize CMMC readiness assessments, assign contributors, and track completion across the units and applications in scope. Assessment series group related reviews under a compliance goal, giving coordinators a view of outstanding work.

Review progress and follow up on unfinished assessments before confirming readiness for the C3PAO engagement.

Learn more about Assessment Management with Isora GRC →

Questionnaires & Surveys

Collect answers from control owners and attach supporting evidence to the relevant responses. Select questionnaire content that matches the required CMMC level and assessed environment, with the Level 2 assessment based on NIST SP 800-171 Rev. 2.

Review incomplete answers and request clarification so the recorded response explains the safeguard and its supporting evidence.

Learn more about Questionnaires & Surveys with Isora GRC →

Reports & Scorecards

Open CMMC assessment results, examine individual responses, and review the evidence and comments behind each score. Reviewers can trace the reported result to the information contributors supplied.

Revisit the report as responses change and identify answers that need further evidence or correction before the certification assessment.

Learn more about Reports & Scorecards with Isora GRC →

Risk Management

Review readiness findings, assign risk owners, and document remediation plans with milestones. Each risk record retains its assessment context so the responsible team can see what prompted the corrective work.

Track progress and review supporting updates before closing findings. Internal remediation tracking does not establish that a deficiency qualifies for a CMMC POA&M.

Learn more about Risk Management with Isora GRC →

Key Takeaways

A C3PAO conducts the Level 2 certification assessment and issues the Certificate of CMMC Status. Registered Practitioners, RPOs, and other advisers help contractors prepare, but they cannot assess any contractor they’ve prepared in the past three years.

The Phase II suspension permits Level 1 (Self) or Level 2 (Self) procurement requirements. Affected existing contract requirements must be changed through a modification, so contractors should check the executed contract and any prime requirements. Voluntary C3PAO assessments remain available.

Before hiring a C3PAO, confirm its authorization or accreditation with the Cyber AB and request written conflict-of-interest disclosures. Compare proposals on the same assessment scope, then confirm dates and staffing in writing.

Contractors subject to DFARS 252.204-7012 must continue to protect covered contractor information systems and report qualifying cyber incidents, whether or not they need a C3PAO assessment.

See how Isora GRC supports CMMC compliance →

C3PAO FAQs

What does C3PAO stand for?

C3PAO stands for CMMC Third-Party Assessment Organization. It is an organization authorized or accredited by the Cyber AB to conduct Level 2 certification assessments and issue Certificates of CMMC Status.

What does a C3PAO do?

A C3PAO contracts with an organization seeking certification, conducts the Level 2 assessment through a qualified team, and records the results in CMMC eMASS. It issues the appropriate Certificate of CMMC Status based on the assessment results.

How do I find an authorized C3PAO?

Use the Cyber AB Marketplace to find firms and confirm their authorization or accreditation before hiring. A candidate designation alone does not establish authorization to conduct certification assessments.

What is the difference between a C3PAO and an RPO?

A Registered Practitioner Organization (RPO) helps contractors prepare for CMMC, while a C3PAO conducts Level 2 certification assessments. A firm or assessor that helped a contractor prepare within the past three years cannot assess that contractor and must also avoid financial, business, or personal ties that could affect impartiality.

Do I need a C3PAO assessment right now?

Check the applicable solicitation or contract, including amendments and executed modifications, for the required CMMC status. Final Level 2 (C3PAO) status is also a prerequisite for Level 3 certification. Class Deviation 2026-O0025, Revision 3, permits Level 1 (Self) or Level 2 (Self) procurement requirements and directs amendments and modifications to remove or revise affected requirements. Voluntary C3PAO assessments remain available.

How many C3PAOs are there?

The Cyber AB reported 110 authorized C3PAOs as of 15 July 2026. Check the current Marketplace for authorization status and contact firms directly about availability.

How do you become a C3PAO?

To become a C3PAO, a firm must apply to the Cyber AB, pass background and foreign-influence reviews, hire qualified assessors, carry insurance, sign program agreements, and pass a government security assessment. It needs at least three CCAs on staff or under contract and must earn accreditation within 27 months of authorization.⁠

How much does a C3PAO assessment cost?

The DoD’s October 2024 regulatory analysis estimates three-year Level 2 certification assessment and affirmation costs of $104,670 for small entities and $117,768 for other-than-small entities. These estimates include assessment preparation and support, the assessment, and annual affirmations. They assume the NIST SP 800-171 Revision 2 safeguards are already implemented and are not quotes for a C3PAO’s fee alone. Request a proposal for the actual assessment scope.

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.