What Is a C3PAO? How CMMC Third-Party Assessments Work

A C3PAO, short for CMMC Third-Party Assessment Organization, is a firm the Cyber AB has authorized to perform CMMC Level 2 certification assessments of defense contractors. Its assessors test your environment against the 110 security requirements of NIST SP 800-171, score each one MET or NOT MET, and submit the results to DoD, which posts your status in SPRS. The C3PAO must be independent of you: anyone who consulted to prepare you for a CMMC assessment within the last three years cannot take part in assessing you. Since July 13, 2026, CMMC Phase 2 has been suspended, so DoD solicitations cannot require a C3PAO assessment for now. C3PAOs still perform them, and nearly 2,000 contractors held Final Level 2 certification as of July 2026.

Where a C3PAO fits in CMMC

CMMC has three levels, and a C3PAO works at only one of them. Level 1 covers 15 basic requirements for companies that hold Federal Contract Information, and it is always a self-assessment. Level 2 covers the 110 requirements of NIST SP 800-171 wherever Controlled Unclassified Information is stored, processed, or transmitted, and each contract names one of two paths: a self-assessment, or a certification assessment by a C3PAO. Level 3 adds 24 requirements from NIST SP 800-172 and requires a Final Level 2 certification first. The government's own Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) performs those assessments.

The C3PAO is one link in a chain. DoD's CMMC Program Management Office sets the rules in 32 CFR Part 170. The Cyber AB, the program's accreditation body, authorizes and accredits C3PAOs. The people who do the work are Certified CMMC Assessors, or CCAs, who work for the C3PAO. When an assessment ends, the C3PAO submits the results into eMASS, which sends them to SPRS, where contracting officers check your status before award. A Final status lasts three years, and a senior company official must affirm continuing compliance every year.

How the Cyber AB authorizes a C3PAO

A C3PAO earns its status in two steps under 32 CFR 170.8 and 170.9. Authorization comes first. The Cyber AB authorizes a firm that meets every requirement in 170.9, and the firm can then perform Level 2 certification assessments and issue certificates. Authorization also starts a clock: the C3PAO must achieve compliance with ISO/IEC 17020, the international standard for inspection bodies, within 27 months, and the Cyber AB accredits it once it does. The Cyber AB Marketplace, the public directory of the CMMC ecosystem, lists the firms that hold either status.

The requirements in 170.9 are demanding by design. The C3PAO's own systems must pass a Level 2 certification assessment conducted by DCMA DIBCAC, so the government has tested the controls of the firm that will test yours. Everyone in its assessment process must complete a Tier 3 background investigation or an equivalent that DoD approves. The firm must report foreign ownership, control, or influence and receive a non-disqualifying determination from the CMMC Program Management Office. Every assessment team needs a Lead CCA and at least one other CCA, and a separate CCA performs the quality review. In its July 15, 2026 statement, the Cyber AB counted 110 authorized C3PAOs.

Why the firm that prepares you cannot assess you

Independence is written into the rule. Under 32 CFR 170.8(b)(17), the Cyber AB's code of professional conduct must bar members of the CMMC ecosystem from taking part in a Level 2 certification assessment of any organization they served as a consultant to prepare for a CMMC assessment within three years. The same code requires members to represent their credentials accurately and bars them from exaggerating the services they are authorized to deliver.

In practice, the rule splits the work in two. Readiness firms scope your environment, find the gaps, help close them, and write the System Security Plan. C3PAOs test the result. A firm offering to do both for the same company inside that three-year window is offering something the rule does not allow. The split also protects the value of the certificate, because primes and contracting officers trust a Final Level 2 status precisely when the assessor had no hand in building what it scored. If you dispute a finding, you appeal to the C3PAO first and can take an unresolved appeal to the Cyber AB.

What happens in a Level 2 certification assessment

The assessment opens with planning. The C3PAO reviews your scope, your System Security Plan, and the assets that handle CUI, and it confirms the boundary before fieldwork starts. Fieldwork usually runs one to two weeks. The team reads documentation, interviews the people who run each control, watches controls operate live, and samples records such as tickets, log reviews, and training completions. The team scores each of the 110 requirements MET or NOT MET, with no partial credit.

Results land in one of three places. Meeting all 110 earns Final Level 2 (C3PAO) status. A score of at least 88 can earn Conditional status, but only if every open item qualifies for a Plan of Action and Milestones under 32 CFR 170.21. Items must be worth 1 point, except FIPS validation for CUI encryption at 3 points when encryption is in place, and six requirements can never be deferred, including the System Security Plan itself. A C3PAO must confirm every item closed in a closeout assessment within 180 days, or the Conditional status expires. Below 88, or with an ineligible requirement unmet, the assessment fails and the work goes back to remediation. Our walkthrough of what happens in a CMMC audit covers each stage and where assessments go wrong.

What a C3PAO assessment costs and how long it takes

C3PAOs price on assessor days: a Lead CCA plus one or two more assessors across the fieldwork, with a quality reviewer behind them. A tightly scoped enclave commonly runs $40,000 to $60,000. A company of 100 to 300 people on one site usually sees $60,000 to $110,000, and multi-site scopes with heavy external provider involvement run past $150,000. Travel usually comes on top, and a POA&M closeout assessment adds $8,000 to $20,000. Asset count, number of locations, and the external service providers inside the boundary decide where you land, so the scoping decision moves the price more than any negotiation. Our CMMC certification cost guide covers the readiness and remediation spending around the assessment fee.

Timing has two parts. The assessment itself takes weeks: planning, one to two weeks of fieldwork, then the C3PAO's quality review before results post. Getting ready takes far longer. A contractor starting from ordinary commercial IT typically needs 6 to 12 months to scope, remediate, and run its controls long enough to produce evidence, because assessors sample what happened over time and evidence of operation cannot be backdated.

What the Phase 2 suspension means for booking a C3PAO

Phase 2 was scheduled to put C3PAO certification requirements into new DoD solicitations on November 10, 2026. On July 13, 2026, DoD suspended that transition. Its implementing procedures bar program managers from designating Level 2 (C3PAO) or Level 3 (DIBCAC) assessments while the suspension holds, require amendments to active solicitations, and direct that existing requirements come out at the next option period or administrative modification. DFARS 252.204-7012 remains in effect, and DoD is enforcing NIST SP 800-171 through Level 1 and Level 2 self-assessments and select government-led assessments. The procedures promised further guidance after a 60-day review, and as of early November 2026 DoD has announced no date for C3PAO requirements to return.

C3PAO assessments did not stop. The Cyber AB stated that all program elements remain available, including C3PAO Level 2 certification assessments, and nothing in the suspension revokes certifications already issued. A contractor can still book one, and there are reasons to: primes still ask suppliers for readiness evidence, and the Cyber AB's chief executive called a C3PAO certification “a compelling calling card for subcontracting viability to primes.” Contractors that wait should keep remediating, because the 110 requirements did not change and work done now counts under whatever the review produces.

How to choose a C3PAO

Start with the Cyber AB Marketplace, then narrow the field on six questions.

• Status. Is the firm authorized or accredited, and if only authorized, how far along is it on the 27-month path to ISO/IEC 17020 compliance?
• Independence. Has the firm, or anyone on the proposed team, served as your consultant to prepare for a CMMC assessment in the last three years? If so, they cannot take part.
• Environment fit. Has the team assessed environments like yours, such as a GCC High tenant, an enclave, shop-floor manufacturing systems, or a network run by a managed service provider?
• Team and quality review. Who is the Lead CCA, how many CCAs will work the engagement, and who performs the quality review?
• Calendar. When can fieldwork start, how long does the quality review take, and can the firm schedule a closeout assessment inside 180 days if you finish Conditional?
• Price structure. How many assessor days are quoted, is travel extra, and what do a closeout assessment and a reassessment cost?

Collect at least two or three proposals and compare them line by line. A quote far below the others usually assumes a smaller scope than the assessment team will accept in planning, so ask each firm to state the asset count it priced.

A C3PAO we trust: Schellman

When clients ask which C3PAO we would call first, we often recommend Schellman. Schellman is a phenomenal audit partner for the companies we prepare, and we regard its team as thought leaders in independent assessment. It publishes some of the clearest guidance available on how CMMC assessments run, and in FedRAMP it is the assessor of record for more authorized cloud offerings than any other assessor, according to FedRAMP Marketplace data from September 2026. Schellman announced its first C3PAO authorization in October 2021 and was reauthorized under the final CMMC program in 2025. It is also a FedRAMP 3PAO and an ISO certification body.

Schellman is independent of BD Emerson, and that independence is a large part of why we value it. Its FedRAMP Marketplace listing states that it “only performs assessment services, and no consulting services.” It reaches its own conclusions, and nothing we do on the readiness side changes how it scores an environment. When Schellman assesses a company we prepared, the result is Schellman's call alone, which is why primes and contracting officers can rely on it. We still tell clients to collect other proposals and choose on the criteria above.

How BD Emerson prepares you for the C3PAO

BD Emerson is not a C3PAO and does not certify anyone. We prepare defense contractors for the assessment: scoping and enclave design, a CMMC gap assessment against all 110 requirements, remediation, System Security Plan development, POA&M management, and a mock assessment that samples and interviews the way a C3PAO will. Then an independent C3PAO, Schellman or another authorized firm you choose, performs the certification assessment. Because we hold no stake in the score, we can tell you exactly which requirements would fail today and what closing them costs. Start with our CMMC consulting services, or send us your current SPRS score and boundary diagram and we will tell you how far you are from assessment-ready.

Frequently asked questions

How do I find an authorized C3PAO? Search the Cyber AB Marketplace on cyberab.org, which lists authorized and accredited C3PAOs alongside other members of the CMMC ecosystem. Confirm the firm's current status there before you sign, because status can change.

Can a C3PAO help fix the gaps it finds? A C3PAO that helps fix your gaps gives up its role as your assessor. A firm that serves as your consultant to prepare for a CMMC assessment cannot take part in assessing you within three years, so remediation help belongs with your own team or a separate readiness firm.