CMMC Certified Assessment Organizations: The C3PAO Landscape
The Cybersecurity Maturity Model Certification (CMMC) program, administered by the Department of Defense, requires defense contractors handling Controlled Unclassified Information (CUI) to obtain certification through authorized Third-Party Assessment Organizations, known as C3PAOs. As of early 2026, approximately 97 organizations hold active C3PAO authorization from the Cyber AB (formerly the CMMC Accreditation Body).
What C3PAOs Do
C3PAOs are the only entities authorized to conduct formal CMMC certification assessments. They evaluate whether an Organization Seeking Certification (OSC) meets the required security practices and processes defined in NIST SP 800-171 and CMMC framework requirements. A C3PAO must maintain strict independence — it cannot provide advisory or consulting services to the same organization it assesses.
CMMC Assessment Levels
- Level 1 (Foundational)
- Self-assessment of 15 basic safeguarding practices from FAR 52.204-21. No C3PAO involvement required.
- Level 2 (Advanced)
- Third-party assessment by a C3PAO against all 110 security requirements in NIST SP 800-171 Rev 2. This is the most common level requiring C3PAO engagement.
- Level 3 (Expert)
- Government-led assessment by DIBCAC, building on Level 2 with additional requirements from NIST SP 800-172.
Choosing a C3PAO
Key factors defense contractors should evaluate when selecting a C3PAO:
- Capacity and availability — With ~97 authorized C3PAOs serving the entire Defense Industrial Base, scheduling can be competitive. Plan assessments 3-6 months ahead.
- Industry experience — Some C3PAOs specialize in specific sectors (aerospace, IT services, manufacturing) and understand sector-specific CUI handling.
- Assessment team size — Larger C3PAOs like Coalfire Federal, Schellman, and A-LIGN maintain multiple certified assessor teams, enabling faster scheduling.
- Geographic coverage — While assessments can be conducted remotely, some organizations prefer C3PAOs with regional presence for on-site evaluation of physical security controls.
The Path to Assessment
Before engaging a C3PAO, organizations should complete a readiness review, typically with a Registered Provider Organization (RPO). The formal C3PAO assessment follows four phases: planning, assessment, reporting, and adjudication by the Cyber AB. Certification is valid for three years.