What to check before you hire a C3PAO.

This page does not list assessment firms.

What the organization does

32 CFR 170.4 defines a C3PAO and points to the roles in 32 CFR 170.9. That section says C3PAOs conduct Level 2 certification assessments and issue Certificates of CMMC Status based on the results.

The source says: The rule says a C3PAO is an organization authorized or accredited by the Accreditation Body. The Cyber AB ecosystem roles page says a C3PAO conducts assessments through certified professionals and certified assessors. ^{3, 1, 5}

A Registered Practitioner Organization is not that role.

The source says: The same Cyber AB page says an RPO delivers a non-certified advisory service through registered practitioners. It says RPOs are consultative organizations or managed service providers, and that they do not conduct certified CMMC assessments. ⁵

The C3PAO submits Level 2 certification results into the CMMC instance of eMASS. That system transmits the results to the Supplier Performance Risk System. The company still files its own affirmation in SPRS. ⁴

Checks that come from the rule

Ask whether the Accreditation Body lists the organization, and confirm that status on its public list. 32 CFR 170.8(b)(8) requires the Accreditation Body to establish, maintain, and manage that list on a single publicly accessible website and to provide the list and status to the Department through eMASS. This guide does not copy that list. ²

Ask whether the firm, or anyone it would put on the assessment, consulted to prepare your organization for any CMMC assessment in the last 3 years. 32 CFR 170.8(b)(17) requires conflict, conduct, and ethics policies. One of those rules prohibits CMMC ecosystem members from participating in the Level 2 certification assessment process for an assessment where they previously served as a consultant to prepare the organization for any CMMC assessment within 3 years. C3PAOs must comply with those policies. ^{2, 1}

Ask who is on the assessment team. The rule sets a minimum of two people on that team.

The source says: The rule requires a lead certified assessor and at least one other certified assessor. Additional certified assessors and certified professionals may participate. ¹

Ask who performs quality assurance. That person cannot be a member of the assessment team for the assessment they are reviewing.

The source says: The rule says that person must be a certified assessor. The C3PAO conducts a quality assurance review for each assessment. ¹

Ask how an appeal works. The C3PAO addresses appeals arising from the Level 2 certification assessment. If the company or the C3PAO is not satisfied with the result, either one can elevate the matter to the Accreditation Body for a final determination. Appeal records go to the Department through eMASS. ¹

Ask what the certificate will contain. At a minimum it includes all industry CAGE codes associated with the information systems in the assessment scope, the C3PAO name, the assessment unique identifier, the assessed organization's name, and the CMMC status date and level. ¹

A few more duties sit on the C3PAO, not on the hiring company, and they are still fair questions. The organization must achieve and maintain ISO/IEC 17020:2012 compliance within 27 months of authorization. It keeps assessment-related records for six years unless the CMMC program office authorizes another disposition. Personnel who participate in the Level 2 certification assessment process complete a Tier 3 background investigation, or a DoD-determined equivalent if they are not eligible for that investigation. The Tier 3 investigation does not result in a security clearance. ¹

What the suspension changes about the requirement

Since July 13, 2026, the Department of War's program managers and requiring activities may put only Level 1 (Self) or Level 2 (Self) into procurement requests. They may not designate Level 2 (C3PAO) or Level 3 (DIBCAC). The memorandum limits what the government writes into a requirement. It does not change what a C3PAO is under 32 CFR 170.9, and C3PAOs stay in the rule. A law firm's alert argues the Department could still ask for a C3PAO under its Phase 1 discretion, while the memorandum itself says program offices may not. The guide "CMMC Phase 2 is suspended, and what still applies" covers the full picture. (Implementing memorandum, DoD CIO, About CMMC)

Software listed on this site can help a company organize a system security plan or evidence. None of those listings is a C3PAO, and none of them issues a Certificate of CMMC Status.

Compare tools for CMMC Level 2, with each published price and the date it was checked.

Sources checked October 16, 2026. Not legal advice.