What is a CMMC RPO? The consultant badge, and how it differs from a C3PAO
Published 2026-10-23, 13 min read
A CMMC RPO is a consulting company the Cyber AB has registered to help defense contractors get ready for CMMC. It can find your gaps, help you fix them and run a practice assessment. It cannot assess you, certify you or post a third-party result for you, and the CMMC rule itself never mentions it.
- Stands for
- Registered Practitioner OrganizationOne Cyber AB page says Provider
- Registered by
- The Cyber ABThe CMMC Accreditation Body
- In 32 CFR 170
- Not namedThe badge is the Cyber AB's own
- Must employ
- At least one RPA Registered Practitioner
- Can certify you
- NoOnly a C3PAO or DCMA DIBCAC
- On the Marketplace
- 413 listingsRead 2026-10-23
Practitioner or Provider: one badge, two names
RPO means Registered Practitioner Organization: the Cyber AB's role for a firm that “delivers a non-certified advisory service through the employment of RPs”. The Cyber AB's own DIB Companies (OSCs) page also says “Registered Provider Organization”, so you will see both on proposals and websites. They are the same badge.
Registered Practitioner Organization
“delivers a non-certified advisory service through the employment of RPs”
Registered Provider Organization
“you can collaborate with a Registered Provider Organization (RPO) available through Cyber AB”
Who hands out the badge matters more than its name. The Cyber AB (legally the Cybersecurity Maturity Model Certification Accreditation Body, Inc.) is the one Accreditation Body that 32 CFR Part 170 allows at a time. The rule gives it the job of authorizing and accrediting the people and firms who assess. It does not give it a consultant register: the words RPO and Registered Practitioner do not appear anywhere in Part 170. The RP and RPO badges are a program the Cyber AB runs on its own.
RP, RPA, RPO and the assessors: two sides of one line
The CMMC world splits into people who get you ready and people who judge whether you are. An RPO sits wholly on the first side. The second side is the one the rule writes down.
Cyber AB registrations, outside the rule
RPRegistered Practitioner
A person trained and tested by the Cyber AB to find gaps and suggest fixes.
Cyber AB
RPARegistered Practitioner Advanced
An RP who has implemented at least 50 controls that map to Level 2, then passed a second exam.
Cyber AB
RPORegistered Practitioner Organization
The company: background-checked, with at least one RP on its books.
Cyber AB
Roles written into 32 CFR Part 170
C3PAOThird-Party Assessment Organization
The company authorized “to conduct Level 2 certification assessments”.
32 CFR 170.9
CCACertified Assessor
Works for a C3PAO and makes the assessment’s final calls.
32 CFR 170.11
CCPCertified Professional
May advise clients, or sit on an assessment team under a CCA.
32 CFR 170.13
The CCP is the one badge that crosses the line. The rule lets a CCP give “advice, consulting, and recommendations” to clients and also sit on a C3PAO's assessment team, where the CCA makes all final determinations. CCPs and CCAs are certified by the CAICO, which the Cyber AB now names as ISACA, not by the Cyber AB's RP program. So an RPO's staff may hold an RP badge, a CCP certificate, or both, and the difference matters when you later pick an assessor.
The whole set of badges, with who grants each one and how many listings the Marketplace shows for it, is in the badge table on our CMMC consultants comparison. The assessor side has its own guide: what a C3PAO is and does.
CMMC RPO vs C3PAO
Both show up on the same Marketplace and both sell to the same shops, so they are easy to mix up. One gets you ready. The other decides, under the rule, whether you passed, and it may not be the firm that prepared you.
| Question | RPO | C3PAO |
|---|---|---|
| What it isCyber AB; 32 CFR 170.4 | A consulting firm or MSP the Cyber AB has registered | A firm authorized or accredited by the Accreditation Body to run Level 2 certification assessments |
| Named in 32 CFR 170eCFR Part 170 | No | Yes, with its duties in § 170.9 |
| What it does for youCyber AB; 32 CFR 170.17 | Gap review, fixes, documents, a practice assessment | Your Level 2 (C3PAO) certification assessment |
| Certificate of CMMC Status32 CFR 170.9(b)(18) | Cannot issue one | Issues one after a passing assessment |
| Where its result goes32 CFR 170.17(a) | A report to you, nothing official | The CMMC instance of eMASS, then SPRS |
| Who does the workCyber AB; 32 CFR 170.9(b)(12) | At least one Registered Practitioner | A Lead CCA and at least one other CCA; CCPs may join |
| Background checksCyber AB; 32 CFR 170.9(b)(3) | Organizational check; RPs a commercial check | Tier 3 investigation for everyone in the assessment |
| Outside accreditation32 CFR 170.9(b)(2) | None required | ISO/IEC 17020 within 27 months of authorization |
| After it prepares you32 CFR 170.8(b)(17)(ii)(G) | Free to keep helping you | Off your Level 2 assessment for 3 years |
| Marketplace listings, 2026-10-23cyberab.org/Catalog | 413 | 120 |
Listings are the Marketplace's own totals by role on 2026-10-23: listings, not people, and they move every week.
A firm, or a person, can hold badges on both sides of the table. What they may not do is both jobs for the same shop: the code of conduct in the rule keeps anyone who prepared you for a CMMC assessment off your Level 2 certification assessment for three years. The next section shows how far that reaches.
What an RPO can and cannot do for you
Read the Cyber AB's pages side by side and the job is clear. An RPO works for you, on your side of the table, up to the day an assessment starts. From then on its role is advice and nothing more.
- Find your gaps against the requirements and suggest how to close them. Cyber AB, RP and RPO roles
- Run readiness and gap assessments, guide the fixes and stay on for support. Cyber AB, page for contractors
- Run a practice assessment on the Cyber AB’s own platform and track what is left. Cyber AB, page for contractors
- Help you write the documents an assessor reads: SSP, POA&M, policies. Cyber AB, RPA training modules
- Run your IT as an MSP. Then it is a service provider inside your scope. Cyber AB; 32 CFR 170.4 (ESP)
- Show the Cyber AB’s RPO logo on its website and proposals. Cyber AB, Consulting and Implementation
- Conduct a certified CMMC assessment. The Cyber AB says RPOs do not. Cyber AB, Ecosystem roles
- Issue a Certificate of CMMC Status. Only a C3PAO or DCMA DIBCAC assessment leads to one. 32 CFR 170.4
- Enter a Level 2 (C3PAO) result. Those go into the CMMC instance of eMASS, then SPRS. 32 CFR 170.17(a)
- Affirm for you. Your own Affirming Official, a senior person in your company, does that. 32 CFR 170.22(a)
- Guarantee a pass. The Cyber AB says certification depends on your own efforts. Cyber AB, page for contractors
- Put its people on your Level 2 assessment within 3 years of preparing you. 32 CFR 170.8(b)(17)(ii)(G)
The MSP line deserves a second look. An RPO that also runs your servers, firewall or security tools is an external service provider in CMMC terms once your CUI or your security data (logs, configurations, passwords) sits on its systems. Its services then sit inside your assessment scope: assessed as part of your assessment if they touch CUI, as Security Protection Assets if they hold only security data, and written into your SSP with the provider's service description and responsibility matrix. The MSPs that run CMMC for small shops are compared on their own page, and the scoping worksheet shows where a provider lands in your boundary.
The 3-year bar, and how it reaches an RPO
CMMC Ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within 3 years. That is the rule, in the code of conduct the Accreditation Body must enforce:
Who counts as an Ecosystem member is defined too: the people and organizations in subpart C of Part 170, which are the Accreditation Body, C3PAOs, the CAICO, CCAs, instructors and CCPs. RPs and RPOs are not on that list. So the rule reaches an RPO through its people and its other badges, and the Cyber AB closes the gap for the rest: individuals “holding multiple designations (RP/RPA and Assessor Certifications) cannot assess a company if they have previously assisted with an implementation for that same company.”
| After helping you prepare | On your assessment | Why |
|---|---|---|
| A C3PAO that prepared you | Barred | An Ecosystem member under the rule |
| A CCA or CCP who worked on your account | Barred | An Ecosystem member under the rule |
| An RP or RPA who also holds an assessor certificate | Barred | The Cyber AB’s own line |
| An RPO, as a company | Never assesses | Not a C3PAO, so not on any assessment |
32 CFR 170.4, 170.8(b)(17)(ii)(G); Cyber AB, Consulting and Implementation, read 2026-10-23
The bar is on the record, not just on trust: a C3PAO keeps, for six years, a list of the organizations it provided consulting services to. In practice, hiring an RPO is also choosing which assessors are left to you later. If the RPO is also a C3PAO, that C3PAO is out for three years, and a related C3PAO should tell you in writing how it handles the conflict: the rule tells Ecosystem members to avoid even a perceived one. The day-by-day version of the bar is drawn on the consultants comparison.
What an RPO does while Phase 2 is suspended
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
With third-party assessments on hold, the CMMC work a contract can ask of you today is a self-assessment, so the RPO's job is helping you do your own. That changes what you should buy. You are not paying for a pass. You are paying for a scope you can defend, documents you own and a score you understand, because your company enters it and your company signs for it.
Scope
Before a Level 2 self-assessment you must specify what is in scope.
32 CFR 170.19(c)
RPO's partCan run the workshop and build the asset list with you.
Write the SSP
Without an up-to-date SSP (CA.L2-3.12.4) at the time of assessment, the assessment cannot be completed.
32 CFR 170.24
RPO's partCan draft it. You approve it, and it must be final, not a draft.
Score
The maximum Level 2 score is 110. Each requirement NOT MET subtracts its value (1, 3 or 5 points) from 110, which may result in a negative score.
32 CFR 170.24(c)(2)
RPO's partCan score with you. The number you enter is yours.
Affirm
An Affirming Official, a senior representative of the company, affirms in SPRS after every assessment, after a POA&M closeout, and annually after a Final status.
32 CFR 170.22(a)
RPO's partNo part. Someone senior in your company signs.
How to check an RPO on the Cyber AB Marketplace
The badge is easy to claim and easy to check. Five minutes on the CMMC Marketplace tells you whether the firm is registered, who is attached to it and whether it also sells assessments.
- 01Open the MarketplaceGo to the Cyber AB’s CMMC Marketplace. It is free and needs no account.
- 02Filter to RPOUnder Ecosystem role, tick RPO, so people and assessors drop out of the results.
- 03Search the nameType the firm’s name in the Lookup box. Try its legal name and its trading name: a listing sits under the name the firm registered.
- 04Open the listingThe role word, RPO, sits under the firm’s name. The address starts cyberab.org/Member/RPO-.
- 05Read the AssociationsThis list shows the people tied to the firm, with their other profiles (RP, and any CCP or CCA). The people in your proposal should be on it.
- 06Discount the sales copyOverview and Services offered are written in the firm’s own voice. Read them as sales copy and check the claims that matter to you.
- 07Search again as C3PAOTick C3PAO instead and search the same name. A hit means that C3PAO cannot assess you for 3 years after it prepares you.
- RPO listings
- 413RPO listings
- RPO listings that tick “Assessment Services”
- 299+RPO listings that tick “Assessment Services”
- RPO listings that tick “Managed IT Security Services”
- 254RPO listings that tick “Managed IT Security Services”
- C3PAO listings
- 120C3PAO listings
Read the second number carefully. Most RPO listings tick a capability box called Assessment Services. On an RPO that can only mean readiness and gap work: the Cyber AB's own roles page says RPOs “do not conduct Certified CMMC Assessments”. These are totals we read from the Marketplace's own search on 2026-10-23; they change as firms join and lapse.
Questions to ask an RPO before you sign
Take these into the first call. Each one has a reason behind it from the rule or from the Cyber AB, and each answer should end up in the proposal or the engagement letter, not only in the conversation. The questions are ours; the reasons are cited.
Questions to ask a CMMC RPO before you sign, cuideck.com
Questions to ask a CMMC RPO before you sign
Answered 0 of 9
Tick each one once you have the answer in writing. Nothing is saved or sent.
An RPO must have at least one RP. Every name can be looked up on the Marketplace.
Cyber AB
Whoever prepares you is off your Level 2 certification assessment for 3 years.
32 CFR 170.8(b)(17)(ii)(G)
Then your services are in our assessment scope and go into our SSP with a responsibility matrix.
32 CFR 170.19(c)(2)
All evidence must be in final form and not draft, and it has to be ours.
32 CFR 170.24(b)(1)
The score we enter is ours, and a senior person here affirms it.
32 CFR 170.24(c); 170.22(a)
No RPO can certify. The Cyber AB says certification depends on our own efforts.
Cyber AB
The Cyber AB says its platform lets an RPO simulate an assessment and track remediation.
Cyber AB
Releasing technical data to a foreign person in the United States is a deemed export.
22 CFR 120.50; 120.62
Assessment evidence is kept for six years from the CMMC Status Date.
32 CFR 170.16(c)(4)
Questions shops ask about RPOs
Is an RPO the same as a Registered Provider Organization?
Yes. The Cyber AB's roles page calls the badge Registered Practitioner Organization and its page for contractors calls it Registered Provider Organization. It is one registration under two names.
Do we need an RPO to become CMMC compliant?
No. 32 CFR Part 170 never mentions RPOs, and no CMMC rule makes you hire a consultant. The Cyber AB recommends working with one; that is its advice, not a requirement. A shop can use an RPO for the parts it lacks the time or skill for and do the rest itself.
Does the RPO badge mean the firm's work was checked?
No. To register, a firm passes an organizational background check, attaches at least one Registered Practitioner, signs the Cyber AB's Code of Professional Conduct and an RPO agreement, and pays the Cyber AB's fees ($6,000 to apply and $5,000 a year to renew, on the Cyber AB's schedule read 2026-10-23). Nobody assesses the quality of its advice. That is why the questions above matter.
Can an RPO help with CMMC Level 1?
Yes. The Cyber AB's RP training includes implementing the Level 1 framework. A Level 1 self-assessment is repeated every year, with results and an affirmation in SPRS, so a light, repeatable setup is worth more than a thick binder. Our Level 1 checklist covers the 15 requirements.
Can our MSP also be our RPO?
Yes. The Cyber AB describes RPOs as consultative organizations or MSPs. If that MSP holds your CUI or your security data, though, it is a service provider inside your assessment scope, so the firm advising you on scope is also part of it. Ask how they keep the two roles apart.
Is a CCP the same as an RP?
No. A CCP is certified by the CAICO under 32 CFR 170.13 and may sit on an assessment team under a CCA. An RP is the Cyber AB's consulting badge, outside the rule. A consultant can hold both, and if they do, the 3-year bar keeps them off the Level 2 assessment of any shop they prepared.