Independent. Not affiliated with any government agency.Rev. Oct 16, 2026

CMMC firms

CMMC assessors and consultants

90 firms, each from the website that firm publishes. Filter by C3PAO, RPO, or both. A firm that states both stays in the C3PAO list and the RPO list. Name order. This list is not a ranking.

Email me when CMMC status changes

One email when the CMMC status on this site changes; unsubscribe anytime.

States

What to check before you hire

  • The public list. Confirm the firm appears on the Accreditation Body's public list of C3PAOs. This page copies each firm's own website, not that list.
  • Conflicts. Ask whether anyone on the assessment team consulted to prepare your company for a CMMC assessment in the last 3 years.
  • The team. Ask who is on the assessment team. The rule sets a minimum of two people on that team.
  • Timing. Phase 2 is suspended, so check your solicitation or your prime's terms before you pay for an assessment. What to check before you hire a C3PAO.

Questions

How many CMMC consultants and C3PAO companies are listed?

90 firms. 72 state C3PAO status and 30 state RPO status, and 12 state both. Each comes from the firm's own website, in name order. This list is not a ranking.

Source: What to check before you hire a C3PAO

What is the difference between a C3PAO and an RPO?

A C3PAO conducts Level 2 certification assessments. The Cyber AB says an RPO is a consultative organization or managed service provider that does not conduct CMMC certification assessments.

Source: 32 CFR 170.9, Cyber AB ecosystem roles

Can the firm that assesses me also be my consultant?

Not for the same assessment. The rule bars ecosystem members from a Level 2 assessment where they consulted to prepare the organization for any CMMC assessment within the last 3 years.

Source: 32 CFR 170.8, 32 CFR 170.9

Do I need a C3PAO assessment right now?

CMMC status as of October 23, 2026: Phase 2 suspended. Since Jul 13, 2026. Phase 1 self-assessments still apply. Check your solicitation or your prime's terms before you pay for an assessment.

Source: CMMC Phase 2 is suspended

Are these firms checked against the Cyber AB Marketplace?

No. Each listing comes from the firm's own website. Verify authorization on the Cyber AB Marketplace before you hire, because it can change.

Source: Cyber AB Marketplace

Related

Is your firm missing? Apply to be listed

Verify authorization on the Cyber AB Marketplace

On every listing: Verify authorization on the Cyber AB Marketplace. Authorization can change. Always verify before you hire.