What is a C3PAO? CMMC's third-party assessors, explained
Published 2026-10-23, 12 min read
- C
- CMMC
- 3
- Third
- P
- Party
- A
- Assessment
- O
- Organization
A C3PAO is a company the Cyber AB has authorized or accredited to run CMMC Level 2 certification assessments. It is the only kind of outside firm that can give you a Level 2 (C3PAO) status and the Certificate of CMMC Status that goes with it.
It checks your systems against the rule; it does not pick the level your contract asks for (the program office does), and no firm that consulted to prepare you in the last three years may sit on your assessment.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
What does C3PAO stand for?
C3PAO is read "C-three-P-A-O". The first C is CMMC, and the 3 stands in for the word "Third". The official texts do not quite agree on the long form, which is why you see both versions in proposals and on assessor websites:
- 32 CFR Part 170, the CMMC ruleCMMC Third-Party Assessment Organization § 170.4(a)
- DFARS 252.204-7021, the contract clausecertified third-party assessment organization 252.204-7021(a)
- The Cyber AB, the accreditation bodyCertified Third-Party Assessment Organization cyberab.org
The difference is cosmetic. What makes a firm a C3PAO is the definition in the rule, and that definition turns on one thing: the Accreditation Body has authorized or accredited it.
What a C3PAO does, and what it does not
Part 170 gives the C3PAO a narrow job, and most of the confusion around assessors comes from things people assume are part of it. Here is the line the rule draws.
- Runs your Level 2 certification assessment against the NIST SP 800-171A objectives, inside your CMMC Assessment Scope. § 170.17(c)(1), 170.9(b)(15)
- Scores it by the CMMC scoring rule, uploads the results to the CMMC instance of eMASS and gives you a Findings Report. § 170.17(c)(1)
- Issues the Certificate of CMMC Status. § 170.9(b)(18)
- Comes back for the POA&M closeout, which must be posted within 180 days of a Conditional status. § 170.17(c)(3)
- Hears your appeal first; either side can take it to the Accreditation Body for a final decision. § 170.9(b)(19)
- Keeps its assessment records for six years. § 170.9(b)(9)
- Level 1 (Self) or Level 2 (Self): those are your own assessments, entered by you in SPRS. § 170.15, 170.16
- Level 3: DCMA's DIBCAC runs those, on systems that already hold a Final Level 2 (C3PAO). § 170.18
- Choose the level your contract asks for: the program office or requiring activity does. § 170.3(d)
- Assess a company it consulted to prepare for any CMMC assessment within the last 3 years. § 170.8(b)(17)(ii)(G)
- Have the last word over DoD: a later DIBCAC assessment's results take precedence over the status it gave you. § 170.17(a)(1)(iv)
The consulting bar is why the firm that helps you get ready and the firm that assesses you are almost always two different companies. Who can prepare you, and how to check a firm, is covered in CMMC consultants and RPOs compared; the advisory badge itself is explained in what a CMMC RPO is.
Who sits on your assessment
A C3PAO is the company you sign with; the people who assess you are certified individually. Part 170 sets a floor of two assessors per team and adds a reviewer who must stay off it:
| Role | How many | What the rule asks of them |
|---|---|---|
| Lead CCA | 1, always | Leads the team. At least 5 years in cybersecurity, 5 in management and 3 in assessment or audit, plus a DoD 8140 assessor qualification. § 170.11(b)(10) |
| CCA | 1 or more | A CMMC Certified Assessor: a CCP with at least 3 years in cybersecurity and 1 in assessment, certified by the CAICO for 3 years at a time. § 170.11(b)(1), (6) |
| CCP | Optional | A CMMC Certified Professional may take part, but a CCA makes every final determination. § 170.13(a) |
| Quality assurance | 1, off the team | A CCA who is not on your assessment team checks the data for accuracy and completeness before it goes into eMASS. § 170.9(b)(13) |
Everyone at the C3PAO who takes part, the reviewer included, needs a Tier 3 background investigation or its equivalent (§ 170.9(b)(3)–(4)). The Cyber AB also lists US citizenship as a requirement for CCAs.
How a firm becomes a C3PAO
Before a C3PAO can assess you, it has to get through the same kind of scrutiny it will put you through, and then some. The Cyber AB puts the whole process at approximately 4 to 6 months. The gates, in order:
- Apply to the Cyber ABThe Cyber AB runs its own financial review of the applicant (an Experian review, in its words) and its administrative requirements.cyberab.org; § 170.8(b)(3)(i)(A)
- Clear the foreign-ownership reviewThe firm files an SF 328 on foreign interests with DCSA and needs a non-disqualifying determination from the CMMC PMO. Any later change is refiled within 15 business days, and a disqualifying result ends the authorization.§ 170.9(b)(5)
- Background checks for its assessorsEvery person who takes part in its assessments needs a Tier 3 background investigation or an equivalent DoD accepts.§ 170.9(b)(3)–(4)
- Pass its own Level 2 assessment, by DIBCACDCMA's DIBCAC assesses the firm against all 110 requirements, to the Final Level 2 (C3PAO) bar. It earns no CMMC status and no certificate from it: the assessment is for the authorization only.§ 170.9(b)(6)
- AuthorizedThe Cyber AB authorizes the firm to run Level 2 certification assessments and issue certificates.§ 170.8(b)(3)(i)(A)
- Accredited, within 27 monthsThe firm must meet ISO/IEC 17020:2012, the conformity standard for bodies that perform inspection, within 27 months of authorization, and the Cyber AB accredits it against that standard.§ 170.9(b)(2), 170.8(b)(3)(ii)
Gate 4 is worth knowing when you sit across from an assessor: the firm has met the 110 requirements itself, on its own systems, and passed a government assessment to prove it. The Cyber AB told DoD in August 2026 that approximately 80% of authorized or accredited C3PAOs are small businesses themselves.
Authorized or accredited?
The two words are not interchangeable. An authorized C3PAO may assess you today; the ISO/IEC 17020 accreditation is what it must reach within 27 months to keep going.
What a C3PAO assessment looks like
The full road to a certificate, from scoping to the affirmation, is in how to get CMMC certified. This is the part the C3PAO runs, in the order Part 170 sets it. The assessors only look inside the scope you hand them, so draw it first with the CMMC scoping worksheet.
- You fix the CMMC Assessment Scope: which systems, people and facilities hold CUI or protect it.
- Without an up-to-date SSP (CA.L2-3.12.4) at the time of assessment, the assessment cannot be completed.
- All evidence must be in final form and not draft.
- You hash every evidence file with a NIST-approved algorithm and hand the C3PAO the list of names, hash values and the algorithm used.
- The C3PAO uploads its pre-assessment and planning material to eMASS.
- The team tests each NIST SP 800-171A objective inside your scope and scores every requirement MET or NOT MET by the § 170.24 rule.
- A NOT MET requirement may be re-evaluated during the Level 2 certification assessment and for 10 business days following the active assessment period, if the evidence shows it MET, it changes no other MET requirement, and the Findings Report has not been delivered.
- A CCA off the team reviews the results before anything goes into eMASS.
- You get the CMMC Assessment Findings Report. C3PAO and DIBCAC results go into the CMMC instance of eMASS, which passes them to SPRS.
- A passing score is a Final Level 2 (C3PAO). A Conditional Level 2 status needs a score of at least 88 of 110, and a POA&M must be closed out within 180 days of the Conditional CMMC Status Date, or the Conditional status expires.
- Your Affirming Official affirms in SPRS after the assessment and every year after it.
- Assessment evidence is kept for six years from the CMMC Status Date. If you disagree with a finding, the C3PAO hears the appeal first.
Two things decide most outcomes before the team arrives: the system security plan and the score you already know you will get. Run your NOT MET list through the SPRS score calculator first; if it lands below 88, a C3PAO cannot give you even a Conditional status, and the rules for what may sit on a POA&M are in what a POA&M is.
What the C3PAO records about you
Two records come out of an assessment. The detailed one goes to DoD through eMASS; the certificate is the short one you can show a prime. The rule sets a minimum for each:
| Item | In eMASS | On the certificate |
|---|---|---|
| Date and level of the assessment | Recorded | Shown |
| C3PAO name | Recorded | Shown |
| Assessment unique identifier | Recorded | Shown |
| Every CAGE code tied to the systems in scope | Recorded | Shown |
| CMMC Status Date | Recorded | Shown |
| Your company's name | Not listed | Shown |
| Each assessor's name and business contact | Recorded | Not listed |
| Name, date and version of your SSP | Recorded | Not listed |
| The result for each assessment objective | Recorded | Not listed |
| POA&M usage and compliance | Recorded | Not listed |
| Evidence file names, hash values and hash algorithm | Recorded | Not listed |
32 CFR 170.17(a)(1)(i) and 170.9(b)(18), read 2026-10-23. A C3PAO may record more; these are the minimums.
Check the CAGE codes on the certificate against every CAGE code your contracts use. A code left out of the assessment scope is a code the certificate does not cover.
What a C3PAO does today, with Phase 2 suspended
On 2026-07-13 the Department of War CIO suspended the advance to CMMC Phase 2 (memo: Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements). Phase 2 is the phase in which, by 32 CFR 170.3(e)(2), DoD intends to make Level 2 (C3PAO) a condition of award on applicable contracts. What contracts may ask for while it is suspended is in the status box at the top of this page, as of 2026-10-23; it is the one place we update when that moves.
The suspension is about what contracts require. The Accreditation Body's position, published two days after the memo, is that C3PAOs keep working:
“The Cyber AB is emphasizing that only Phase II implementation requirements have been suspended and that all CMMC program elements remain operational and available, to include C3PAO Level 2 certification assessments …”
120
C3PAO listings on the Cyber AB Marketplace
110
authorized C3PAOs, in the Cyber AB's own count
The two counts measure different things (listings on the Marketplace today, firms the Cyber AB called authorized in July), so read them as a range, not a trend. The same July statement put the number of defense contractors certified at Level 2 (Final) at nearly 2,000.
Is a C3PAO assessment worth anything now?
The rule answers part of this. DFARS 252.204-7021 asks for a current CMMC status "at the following CMMC level, or higher", and 32 CFR 170.17(a) says a Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self) for the same CMMC Assessment Scope. So a C3PAO status earned today meets a Level 2 (Self) clause for the systems it covers, for as long as it stays current: a Final Level 2 (C3PAO) for three years, with an affirmation every year.
What the rule cannot tell you is what Phase 2 will look like when the Reform Task Force is done. The deviation is silent on voluntary assessments, so the only practical answer is to ask a C3PAO directly what it is booking now and what status it will enter in eMASS. If a solicitation you are bidding on still names Level 2 (C3PAO), ask the contracting officer in writing whether that requirement stands; that advice is ours, not the rule's. To see what an outside assessment might cost against a self-assessment, use the CMMC cost estimator, which works from DoD's own figures.
Ten questions to ask a C3PAO before you sign
Every question below rests on a rule or a source quoted on this page, so each one has an answer the firm should give without hesitating. Print the sheet and take it to the first call.
Ten questions to ask a C3PAO, cuideck.com
| Ask | Why it matters | Rule |
|---|---|---|
| 01 Are you authorized or accredited, and under what legal name is your Marketplace listing? | An authorized firm must reach ISO/IEC 17020 within 27 months; listings often use a legal name, not the brand. | § 170.9(b)(1)–(2) |
| 02 Who will be our Lead CCA, and who else is on the team? | The team needs a Lead CCA and at least one other CCA; CCPs may join, but a CCA decides. | § 170.9(b)(12) |
| 03 Has your firm, or anyone on the team, consulted to prepare us in the last three years? | If so, they may not take part in our certification assessment. | § 170.8(b)(17)(ii)(G) |
| 04 Who does your quality assurance review? | A CCA who is not on our team must check the results before they go into eMASS. | § 170.9(b)(13) |
| 05 What evidence do you need before day one, and which hash algorithm do you accept? | Evidence must be in final form, and we hand over a list of hashed files for eMASS. | § 170.17(c)(4); 170.24(b) |
| 06 How do you handle a NOT MET we can fix in the days after the assessment? | Re-evaluation runs for 10 business days, and ends when the Findings Report is delivered. | § 170.17(c)(2) |
| 07 Which systems and CAGE codes will the certificate cover? | The certificate lists every CAGE code in the assessed scope; anything outside it is not covered. | § 170.9(b)(18) |
| 08 If we get a Conditional status, can you book the closeout inside 180 days? | The POA&M closeout is a second C3PAO assessment, and the Conditional status expires without it. | § 170.17(c)(3) |
| 09 How does your appeals process work? | The C3PAO hears our appeal first; either side can take it to the Cyber AB. | § 170.9(b)(19) |
| 10 Are you booking assessments now, and what status will you enter in eMASS? | Phase 2 is suspended; the Cyber AB says C3PAO assessments remain available. | cyberab.org, 2026-07-15 |
32 CFR Part 170 (eCFR) and the Cyber AB, read 2026-10-23. The questions are CuiDeck's advice, not the rule's.
Questions about C3PAOs
Is a C3PAO the same thing as a CMMC assessor?
Not quite. The C3PAO is the company you contract with. The assessors are individuals, CMMC Certified Assessors (CCAs), who conduct the assessment in support of the C3PAO, with a Lead CCA in charge and at least one other CCA beside them.
Do I need a C3PAO for CMMC Level 1?
No. Level 1 is always a self-assessment: a Level 1 self-assessment is repeated every year, with results and an affirmation in SPRS. A C3PAO assesses Level 2 only.
Can a C3PAO also help us get ready?
Some C3PAOs sell consulting, and Part 170 makes them keep a record of every organization they consulted for. But CMMC Ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within 3 years. How that plays out when you hire help is in CMMC consultants and RPOs compared.
How do I find a C3PAO?
The Cyber AB Marketplace lists them: filter by the C3PAO role and search by the firm's legal name, which is often not its brand. We do not recommend individual assessors.
How long does a C3PAO certification last?
Level 2 (Self), Level 2 (C3PAO) and Level 3 (DIBCAC) assessments are repeated every three years; Level 1 every year. A Final Level 2 (C3PAO) also needs an affirmation every year, and a Conditional one lasts only until the POA&M closeout: a POA&M must be closed out within 180 days of the Conditional CMMC Status Date, or the Conditional status expires.
Where does DCMA's DIBCAC fit in?
DIBCAC is the government's own assessment team. It runs Level 3 assessments, it assesses every C3PAO before the firm is authorized, and it can assess a contractor that already holds a Level 2 (C3PAO) status; if it finds the rule was not met, its results take precedence over the status the C3PAO gave.
What does a C3PAO assessment cost?
Part 170 sets no fee; each C3PAO quotes its own. DoD published its own estimate of the cost of each assessment path when it wrote the rule, and the CMMC cost estimator lays those figures beside your quotes.