CMMC consultants and RPOs for small contractors
Published 2026-10-22
No rule makes you hire anyone. Your own company can run a Level 1 or Level 2 self-assessment, and the senior person who affirms the score in SPRS is yours, not the consultant's. What the CMMC rule does set out is who may prepare you and who may assess you: a CMMC Certified Professional gives advice and recommendations 32 CFR 170.13, a CMMC Certified Assessor assesses for a C3PAO 32 CFR 170.11, and nobody who prepared you may sit on your certification assessment for three years 170.8(b)(17)(ii)(G).
The badge most firms lead with, RPO, is not in the rule at all: it is a Cyber AB registration. We read six firms' own pages and their Cyber AB Marketplace listings against those lines. If you have not drawn your boundary yet, do that first with the CMMC scoping worksheet; the size of the box decides how much help you need.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Contracts may require CMMC Level 1 (Self) or Level 2 (Self): your own assessment, scored and entered in SPRS, with a senior official's affirmation. Class Deviation 2026-O0025 Rev 3; 32 CFR 170.15, 170.16
- The CMMC rule itself, 32 CFR Part 170, is unchanged since it took effect on 2024-12-16. eCFR, 32 CFR Part 170
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Existing contracts that carry CMMC requirements have them removed at the next option period or the next scheduled administrative modification. Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
- DoD's 2026 Regulatory Plan lists an interim final rule amending 32 CFR Part 170 (RIN 0790-AM01) to set a deadline and transition from NIST SP 800-171 Rev 2 to Rev 3. It was timetabled for July 2026 and has not been published as of 2026-10-23. 91 FR 52824
- Class Deviation 2026-O0025, Revision 3 (DFARS part 240), read 2026-10-23
- DFARS 252.204-7012, -7019, -7020, -7021 (acquisition.gov), read 2026-10-23
- 32 CFR Part 170 (eCFR), read 2026-10-23
- Federal Register 2026-16603, 2026 Regulatory Plan (RIN 0790-AM01), read 2026-10-23
- Federal Register: CMMC documents, read 2026-10-23
Totem Technologies
A gap assessment of about 50 hours that ends with your SSP, POA&M, assessment report and policies, from a firm that is a small DoD contractor itself.
Read the Totem Technologies notesExcalTech
An RPO that also deploys the tools, sized for 20 to 500 people with machine shops named. Once it runs your systems it sits inside your scope.
Read the ExcalTech notesBeryllium InfoSec
An RPO whose advice comes with its own managed enclave, so a small CUI footprint can move out of the office network.
Read the Beryllium InfoSec notes
Eight badges, and which side of the line each sits on
Consultants' pages are thick with acronyms. Only some of them are written into 32 CFR Part 170, and only some of them let the holder assess you. This is the whole set as the Marketplace lists it, with the count of listings we found on 2026-10-22.
| Badge | Granted by | In 32 CFR 170 | May prepare you | May assess you | Listings |
|---|---|---|---|---|---|
| RPRegistered Practitioner | Cyber AB | Not in the rule | Yes | No | 2,193 |
| RPARegistered Practitioner Advanced | Cyber AB | Not in the rule | Yes | No | 304 |
| RPORegistered Practitioner Organization (a company) | Cyber AB | Not in the rule | Yes | No | 413 |
| CCPCMMC Certified Professional | CAICO | § 170.13 | Yes | On a team, under a CCA | 2,325 |
| CCACMMC Certified Assessor | CAICO | § 170.11 | Yes, then off your assessment for 3 years | Yes, for a C3PAO | 1,185 |
| LCCALead CMMC Certified Assessor | CAICO | § 170.11(b)(10) | Yes, then off your assessment for 3 years | Leads the team | 687 |
| C3PAOThird-party assessment organization (a company) | Cyber AB | § 170.9 | Yes, then not your assessor for 3 years | Yes, Level 2 certification | 120 |
| CCICMMC Certified Instructor | CAICO | § 170.12 | Not while instructing | May join a team | 66 |
Listings on the Cyber AB Marketplace, read 2026-10-22. One person can hold several listings (the rule requires every CCA to be a CCP), so the rows do not add up to people.
An RP has passed the Cyber AB's training and a background check and may consult; an RPO is the company registration their employer holds. Neither badge is an assessment of anyone's work, and the CMMC rule does not mention either. The people badges the rule does name, CCP, CCA and instructor, are certified by the CAICO, the certification body Part 170 sets up for individuals. The Cyber AB itself uses two names for the same badge: its role page says Registered Practitioner Organization, its page for contractors says Registered Provider Organization, and firms use both. The longer story is in what a CMMC RPO is.
Why your consultant can never be your assessor
The rule does not say it in one sentence about consultants. It says it in the code of conduct the Cyber AB must enforce on everyone in the CMMC ecosystem, C3PAOs, assessors and practitioners alike:
Day 0
The last day a firm or person helps prepare you for any CMMC assessment: a gap assessment, SSP writing, remediation advice.
Years 1 to 3
That firm, and every CCP or CCA who worked on your account, stays off your Level 2 certification assessment team.
After year 3
The fixed bar ends. The duty to avoid and disclose any real or perceived conflict does not.
The bar is checked, not just promised. A C3PAO has to keep, for six years, a record of the organizations it provided consulting services to, and an individual who holds both a practitioner badge and an assessor certification cannot assess a company they helped implement, in the Cyber AB's own words. Assessment teams are built from CCAs and CCPs, so the bar follows the people as well as the firm.
Two of the six firms below, Peak InfoSec and Redspin, are authorized C3PAOs that also sell consulting. That is allowed; doing both for you is not. Hire one to prepare you and your assessor has to be another of the 120 C3PAOs on the Marketplace (read 2026-10-22). A mock assessment is the grey zone: ask the C3PAO in writing whether its mock or readiness work counts as preparing you before you book both from one house.
While Phase 2 is suspended (the status box above), new contracts ask contractors of every size for self-assessments, so the bar can sound academic. It is not. The Cyber AB said on 2026-07-15 that only the Phase 2 requirements were suspended and that C3PAO Level 2 certification assessments remain available. The class deviation is silent on voluntary assessments, so ask the C3PAO what it is booking now and what status it will enter in eMASS. The bar decides which C3PAOs are left to you if you book one now, and the day a contract asks for Level 2 (C3PAO). Plan that day with how CMMC certification works.
Six firms against the rule
Rows inside the boundary are what the rule and the register let you check: the Cyber AB listing, whether the firm could also be your assessor, the certified people it names, and ITAR handling. Rows outside it are how the firm works. Every word was read on the firm's own pages or its Marketplace listing on 2026-10-22; the firms are in alphabetical order.
| What the rule asks | Beryllium InfoSec | CyberSheath | ExcalTech | Peak InfoSec | Redspin | Totem Technologies |
|---|---|---|---|---|---|---|
| Inside the boundary | ||||||
| Listed as a Registered Practitioner Organization (RPO) on the Cyber AB MarketplaceCyber AB Marketplace, read 2026-10-22 | Listed (RPO) | Listed (RPO) | Listed (RPO) | Not listed | Not listed | Not listed |
| Is not also the firm that would assess you (no consultant on your assessment for 3 years)32 CFR 170.8(b)(17)(ii)(G) | Not a C3PAO | Not a C3PAO | Not a C3PAO | Also a C3PAO | Also a C3PAO | Not a C3PAO |
| Names certified people: CCAs, CCPs or Registered Practitioners32 CFR 170.11, 170.13; Cyber AB | Site claim | Not stated | Not stated | CCAs listed | CCAs listed | Not stated |
| US-persons-only path for shops with ITAR data22 CFR 120–130 | Not stated | Not stated | Not stated | Not stated | Not stated | Not stated |
| Outside the boundary | ||||||
| Hands over an SSP and a POA&M as deliverablesCA.L2-3.12.4; CA.L2-3.12.2 | Partly stated | SSP and POA&M | SSP and POA&M | Partly stated | Partly stated | SSP and POA&M |
| Mock or readiness assessment before the real one | Stated | Not stated | Stated | Stated | Stated | Not stated |
| Also runs IT or an enclave for you (then it is an ESP in your scope)32 CFR 170.4; 170.16(c)(3) | Offered | Offered | Offered | Not stated | Offered | Offered |
| Fixed fees published | Not stated | Not stated | Not stated | Stated | Not stated | Stated |
| Names small shops, subcontractors or manufacturers as customers | Stated | Stated | Stated | Not stated | Stated | Stated |
What the words mean
- MeetsListed (RPO)Not a C3PAOStatedOfferedSSP and POA&MCCAs listed
- The vendor's own documentation, or the official register, says so. Read on the date shown.
- PartialSite claimPartly statedAlso a C3PAO
- Covers part of the requirement, or the vendor claims it and the official register does not show it.
- Check with vendorNot statedNot listed
- Not stated in what we read. Ask the vendor in writing before you rely on it.
Advice only, or hands on your systems
The rule draws one more line through the consulting market, and it is the one that changes your assessment. A firm becomes an External Service Provider only when your CUI or your Security Protection Data sits on its assets. Security Protection Data is wider than it sounds: configuration data, log files, the vulnerability status of in-scope machines and the passwords that open them.
- Reads your documents and interviews your staff
- Drafts the SSP and POA&M in files you own
- Works in your systems only under accounts you issue and can revoke
- Keeps nothing of yours on its own laptops or cloud
- Runs your firewall, endpoint or log tools
- Holds admin passwords to your in-scope systems
- Stores your logs, configurations or scan results on its own systems
- Hosts your enclave or holds your CUI
| What the firm holds | What the rule says (a provider that is not a cloud service) |
|---|---|
| CUI, with or without security data | The services provided by the ESP are in the OSA's assessment scope and shall be assessed as part of the OSA's assessment. |
| Security Protection Data only | The services provided by the ESP are in the OSA's assessment scope and shall be assessed as Security Protection Assets. |
| Neither | A service provider that does not process CUI or SPD does not meet the CMMC definition of an ESP. |
Five of our six firms also run IT, a managed cloud or an enclave, and that is often the point of hiring them. It just means the firm goes into your system security plan by name, with its service description and a customer responsibility matrix that splits each requirement between you and them, and its services are assessed with yours. The rule lets an ESP take a CMMC assessment of its own to lighten that load, which is why some say they hold Level 2. What to ask a provider that runs your systems is on the CMMC managed service providers page; the enclave route is compared in CMMC enclaves.
Questions to put in writing before you sign
A firm's sales call answers these out loud. Ask for them in the proposal instead, where they bind. The last three double as a quick test of whether the firm is reading the current rule.
Questions before you sign a CMMC consultant, cuideck.com
Tick a question once the firm has answered it in writing.
0 of 9 answered in writing
The firms, one by one
Beryllium InfoSec
What it is. A Dallas advisory firm, listed as an RPO, that runs gap assessments, compliance reviews, readiness assessments and vCISO work, and sells its own managed VDI enclave, Cuick Trac, which it describes as FedRAMP Moderate equivalent.
Who it fits. A shop that would rather move its CUI into a managed enclave than rebuild the whole office, and wants the advice from the same firm.
| What the rule asks | What we found |
|---|---|
| Listed as a Registered Practitioner Organization (RPO) on the Cyber AB Marketplace | Listed (RPO) |
| Names certified people: CCAs, CCPs or Registered Practitioners | Site claim |
| Also runs IT or an enclave for you (then it is an ESP in your scope) | Offered |
Checked on berylliuminfosec.com, 2026-10-22
Check with the vendor before you buy.
CyberSheath
What it is. A Reston, Virginia firm, listed as an RPO, that sells a three-stage service: a gap assessment against all 110 requirements that ends in an SSP and a POA&M, then remediation, then managed IT, security and compliance. It says it holds CMMC Level 2 certification itself.
Who it fits. A shop with no IT staff of its own that wants one firm to find the gaps, close them and keep the environment running afterwards.
| What the rule asks | What we found |
|---|---|
| Listed as a Registered Practitioner Organization (RPO) on the Cyber AB Marketplace | Listed (RPO) |
| Hands over an SSP and a POA&M as deliverables | SSP and POA&M |
| Also runs IT or an enclave for you (then it is an ESP in your scope) | Offered |
Checked on cybersheath.com, 2026-10-22
ExcalTech
What it is. An IT services company from Rolling Meadows, Illinois (Excalibur Technology), listed as an RPO, that puts the consulting (scoping, gap assessment, SSP, POA&M, policies, interview rehearsals) and the technical work (MFA, EDR, SIEM, logging) under one roof.
Who it fits. A machine shop or fabricator of 20 to 500 people, the size ExcalTech names, that wants the firm writing the policies to deploy the tools as well.
| What the rule asks | What we found |
|---|---|
| Listed as a Registered Practitioner Organization (RPO) on the Cyber AB Marketplace | Listed (RPO) |
| Also runs IT or an enclave for you (then it is an ESP in your scope) | Offered |
| Names small shops, subcontractors or manufacturers as customers | Stated |
Checked on excaltech.com, 2026-10-22
Peak InfoSec
What it is. A Tampa-area firm that has been an authorized C3PAO since 2022 and also sells consulting (scoping, gap assessments, remediation plans, compliance programs), mock assessments and CCP and CCA training, the consulting under separate non-certification terms.
Who it fits. A shop that wants advice from people who run real Level 2 assessments, and will book a different C3PAO for its own certification.
| What the rule asks | What we found |
|---|---|
| Is not also the firm that would assess you (no consultant on your assessment for 3 years) | Also a C3PAO |
| Names certified people: CCAs, CCPs or Registered Practitioners | CCAs listed |
| Mock or readiness assessment before the real one | Stated |
Checked on peakinfosec.com, 2026-10-22
Check with the vendor before you buy.
Redspin
What it is. A C3PAO, listed on the Marketplace under CTEK Security, LLC, that says it was the first one authorized. It also sells readiness work: scoping, gap and mock assessments, SSP help, and a CCA embedded with your team as your advisor during the certification assessment.
Who it fits. A shop that wants an assessor's rehearsal before it books another C3PAO, or one already buying Redspin's managed GCC High enclave.
| What the rule asks | What we found |
|---|---|
| Is not also the firm that would assess you (no consultant on your assessment for 3 years) | Also a C3PAO |
| Mock or readiness assessment before the real one | Stated |
| Also runs IT or an enclave for you (then it is an ESP in your scope) | Offered |
Checked on redspin.com, 2026-10-22
Check with the vendor before you buy.
Totem Technologies
What it is. A consultancy that is itself a small DoD contractor. Its gap assessment runs about 50 hours spread over several weeks and hands over an SSP, a security assessment report, a POA&M and security policies, scored for SPRS in its own Totem software.
Who it fits. A shop of a few people that wants to build its first SSP next to an engineer, and may later keep one CUI computer in Totem's single-PC enclave.
| What the rule asks | What we found |
|---|---|
| Listed as a Registered Practitioner Organization (RPO) on the Cyber AB Marketplace | Not listed |
| Hands over an SSP and a POA&M as deliverables | SSP and POA&M |
| Fixed fees published | Stated |
Checked on totem.tech, 2026-10-22
Check with the vendor before you buy.
How we read the firms
Questions small shops ask
Do I need a consultant to get through CMMC Level 2?
No. The rule has your own company run a Level 2 self-assessment and your Affirming Official, a senior person in the company, affirm the result in SPRS. Plenty of small shops hire help for the first SSP and the gap list, then keep the record themselves. Before you decide, put a number on the work with the CMMC cost estimator.
What is the difference between an RPO and a C3PAO?
An RPO is a company registered with the Cyber AB to consult: it helps you find and close gaps, and it cannot certify anyone. A C3PAO is authorized under 32 CFR 170.9 to run Level 2 certification assessments and issue the certificate. Some C3PAOs also consult, but never for a company they will assess within three years.
Can the firm that prepared us also certify us?
No. The code of conduct in 32 CFR 170.8 bars anyone who served as your consultant for any CMMC assessment from your Level 2 certification assessment for three years, and the Cyber AB applies the same line to individuals who hold both practitioner and assessor credentials. Choose your assessor separately, and early.
How do I check a firm on the Cyber AB Marketplace?
Search the Marketplace by the company's legal name and filter by role (RPO, C3PAO). Brand names often differ: Redspin is listed as CTEK Security, LLC and ExcalTech as Excalibur Technology. Then search each consultant by surname; a CCP or CCA appears as a personal listing. A firm missing from the RPO list can still be good, since the CMMC rule does not require the badge, but ask why.
Does my consultant have to be a US person if we hold ITAR data?
If they will see ITAR technical data, such as drawings, yes in practice: releasing technical data to a foreign person, even inside the US, is an export under 22 CFR 120.50(a)(2). None of the six firms' pages we read promised US-persons-only staffing, so ask for it in writing. What ITAR asks of a small shop is in what ITAR compliance means.