.webp)
TLDR: To choose a C3PAO, first confirm the firm is listed as an Authorized or Accredited C3PAO on The Cyber AB Marketplace. Then rule out any conflict of interest, check the assessment team's experience with environments like yours, and compare scoping approach, cost, scheduling, and quality assurance. The right C3PAO will tell you plainly if you are not ready.
The 7-point C3PAO checklist
- Verify authorization on The Cyber AB Marketplace.
- Rule out conflicts of interest with anyone who helped you prepare.
- Check the assessment team's credentials and industry experience.
- Judge their scoping approach and honesty about readiness.
- Compare total cost, not just the quote.
- Confirm scheduling, capacity, and on-site vs. remote logistics.
- Ask about quality assurance, reporting, POA&M closeout, and appeals.
What is a C3PAO?
A C3PAO (Certified Third-Party Assessment Organization) is a firm authorized by The Cyber AB to conduct CMMC Level 2 certification assessments and issue Certificates of CMMC Status. It is the only type of organization that can certify a defense contractor at CMMC Level 2.
Under 32 CFR § 170.9, every C3PAO must:
- Pass its own CMMC Level 2 assessment, conducted by DCMA DIBCAC (The Defense Industrial Base Cybersecurity Assessment Center).
- Staff each assessment with a Lead CMMC Certified Assessor (Lead CCA) and at least one other CCA.
- Clear a Tier 3 background investigation for every person on the assessment team.
- Follow The Cyber AB's conflict-of-interest policy and Code of Professional Conduct.
- Achieve ISO/IEC 17020 compliance within 27 months of authorization.
- Run an independent quality assurance review on every assessment.
How to choose a C3PAO: 7 criteria
1. Verify authorization on The Cyber AB Marketplace
Start with The Cyber AB Marketplace. Filter by C3PAO under Ecosystem Role and confirm the firm's status is Authorized or Accredited. A badge on a company website is not proof. If the firm is not listed, it cannot issue your certificate.
While you are there, note whether the firm is also listed as an RPO (Registered Provider Organization). Holding both roles is allowed, but it affects the next criterion.
2. Rule out conflicts of interest
A C3PAO cannot assess an organization it has consulted for. If a firm helped you with a gap analysis, remediation, policy writing, or your System Security Plan, it cannot also certify you. The Cyber AB's Code of Professional Conduct sets a look-back period for prior consulting work.
Ask every candidate in writing: "Has your firm, or anyone on the proposed team, provided consulting services to us or our affiliates?"
How Shellproof handles this: Shellproof offers both C3PAO assessments and CMMC advisory services, never to the same client. If we have done readiness or advisory work for you, we will refer you to another C3PAO and tell you so on the first call.
3. Check the assessment team's credentials and experience
Ask who will actually be on your assessment team, not just who leads the firm. Then ask about environments like yours:
- Company profile: Have they assessed organizations of your size and type, such as a 40-person machine shop vs. a multi-site aerospace supplier?
- Technology stack: Have they assessed Microsoft 365 GCC High, commercial cloud with a CUI enclave, on-premise, or hybrid environments?
- Operational technology: If CUI touches the shop floor, how will they assess scoped CNC machines, test equipment, or other OT assets?
- External service providers: Do they understand how your MSP, MSSP, or cloud providers fit into scope?
4. Judge their scoping approach and honesty about readiness
The scoping conversation tells you more than any sales pitch. A strong C3PAO asks detailed questions about your CUI flow, asset inventory, and boundary before quoting.
Look for a C3PAO that will tell you if you are not ready, rather than taking your fee and running an assessment you are likely to fail. A C3PAO cannot coach you on fixes, but it can explain what the assessment will require and what evidence assessors will ask for. If you need help closing gaps first, start with a gap assessment from a separate firm.
Before you contact any C3PAO, have these ready:
- System Security Plan (SSP)
- Current SPRS score and NIST SP 800-171 self-assessment
- Network and data-flow diagrams showing where CUI lives
- Asset inventory, categorized by CMMC asset type
- Any open Plan of Action and Milestones (POA&M) items
5. Compare total cost, not just the quote
The DoD's own regulatory analysis puts a small business's Level 2 (C3PAO) certification at $104,670 over three years. That breaks down to about $20,699 to plan and prepare, $76,743 to conduct the assessment, and $2,851 to report results, plus annual affirmations. For other-than-small businesses, the three-year estimate is $117,768. These figures cover assessment only, not remediation or tools.
What drives the price of a C3PAO assessment:
- Scope: The number of in-scope assets, users, and systems.
- Locations: Each site that must be visited adds time and travel.
- Enclaves: A well-defined CUI enclave is cheaper to assess than an entire enterprise network.
- Readiness: Disorganized evidence stretches the assessment.
- On-site vs. remote: On-site days add travel costs.
Ask each candidate for a written quote that states what is included: pre-assessment planning, on-site days, travel, the POA&M closeout assessment, and the appeals process.
6. Confirm scheduling, capacity, and logistics
C3PAO capacity can be limited, so ask:
- What is your current lead time from signed contract to assessment start?
- How many days on-site, and how much can be done remotely?
- How long from the end of fieldwork to a final report and certificate?
- Who is my single point of contact throughout?
Most organizations spend six to twelve months on gap assessment and remediation before scheduling a C3PAO. Book your assessor early, but only once your scope reflects reality.
7. Ask about quality assurance, reporting, and appeals
Every C3PAO must run a quality assurance review by a CCA who was not on your assessment team. Ask how that review works and how long it adds. Also ask:
- POA&M closeout: If you score at least 88 of 110 and receive Conditional status, how will they handle your closeout assessment within the 180-day window?
- Appeals: What is their appeals process if you dispute a finding?
- Certificate: Will the certificate list every CAGE code tied to the assessed systems?
Questions to ask a C3PAO before you sign
- Are you Authorized or Accredited on The Cyber AB Marketplace?
- Have you or any proposed team member consulted for us in the past?
- Who exactly will be on our assessment team, and who is the Lead CCA?
- How many Level 2 assessments has your team completed for organizations like ours?
- Have you assessed our environment type (GCC High, hybrid, on-prem, OT)?
- What do you need from us before you can give a firm quote?
- What does the quote include, and what costs extra?
- What is your current lead time to start?
- How many days on-site vs. remote?
- How do you handle POA&M closeout and appeals?
- If planning uncovers a major issue in our environment, can we cancel or reschedule without a big penalty?
- What conditions would make the price go up, and is a re-check of near-miss practices included in the quote?
- Can our MSP lead our side of the assessment, and does our MSP need to be assessed before us or alongside us?
- How will we share evidence with you securely, and how do you store it?
- How much evidence do you expect per control, and does our SSP need to follow NIST SP 800-171 numbering?
- What percentage of your clients have reached Conditional or Final status, and can you provide references?
- Do your assessors mainly work in CMMC, or in other frameworks such as NIST SP 800-53 or FedRAMP?
Red flags when choosing a C3PAO
- Not listed on The Cyber AB Marketplace, or listed under a different legal name.
- Offers to help you fix gaps and then certify you.
- Guarantees you will pass.
- Quotes a low price without asking about scope, sites, or CUI flow.
- Cannot name who will be on your assessment team.
- Picking an assessor because they seem the cheapest or easiest. A weak assessment can be challenged later, and you end up paying twice.
Comparing several C3PAOs? The National Defense ISAC's free C3PAO Shopping Guide for SMBs and its scoring spreadsheet help you rate assessors side by side. The guide was published in 2024, before the final CMMC rule, so check regulatory details against current guidance.
C3PAO vs. RPO: what's the difference?
The usual sequence: work with an RPO or advisor to prepare, then engage a separate C3PAO to certify.
What your assessment looks like, by company profile
How Shellproof approaches C3PAO assessments
Shellproof Security is an Authorized C3PAO based in Greenvale, Long Island, New York. Our C3PAO assessments are led by Mark Jackolski, Managing Partner and Lead CMMC Certified Assessor (LCCA). What you can expect from us:
- A detailed scoping call before any quote.
- A straight answer if you are not ready yet.
- A clear, written quote with no surprise line items.
- A named team and a single point of contact from kickoff to certificate.
Talk to an Authorized C3PAO
Not sure whether you're ready for a C3PAO assessment? Book a scoping call. We'll review your scope, timeline, and what the assessment will require, with no obligation.
Frequently asked questions
How do I choose a C3PAO?
Confirm the firm is Authorized or Accredited on The Cyber AB Marketplace, then rule out conflicts of interest. Next, compare the assessment team's experience with environments like yours, their scoping approach, total cost, lead time, and quality assurance process. Choose the firm that asks the most detailed scoping questions and is honest about your readiness.
How do I find an authorized C3PAO?
Use The Cyber AB Marketplace at cyberab.org. Filter by C3PAO under Ecosystem Role. Only firms listed there as Authorized or Accredited can issue a CMMC Level 2 certificate.
Can the same company help me prepare for CMMC and certify me?
No. A C3PAO cannot assess an organization it has provided consulting or preparation services to. Use an RPO or advisor to prepare, and a separate C3PAO to certify.
What is the difference between a C3PAO and an RPO?
A C3PAO is an independent assessor authorized to issue CMMC Level 2 certificates. An RPO is a registered consultant that helps you prepare but cannot certify you.
How long does a C3PAO assessment take?
Preparation usually takes six to twelve months before you are ready to schedule. Fieldwork length depends on your scope and number of sites, and is followed by quality assurance review and certificate issuance.
Do I still need a C3PAO now that CMMC Phase 2 is paused?
For many contractors, yes. Primes can still require Level 2 certification from their subcontractors, and many already do. A C3PAO certificate is also the strongest evidence that your SPRS score is accurate, and it stays valid for three years however the program is restructured. Phase 2 was suspended on July 13, 2026, so DoD contracts aren’t currently requiring C3PAO certification at award, but the underlying NIST SP 800-171 requirements haven’t changed.
What happens if I don't pass all 110 controls?
If you score at least 88 of 110 and the open items are eligible, you can receive Conditional Level 2 status with a POA&M. You must close those items within 180 days, verified by a POA&M closeout assessment. Otherwise, you do not receive certification.
How long is a CMMC Level 2 certification valid?
Three years, with an annual affirmation of continued compliance submitted in SPRS.
Who is on a C3PAO assessment team?
At least two people: a Lead CMMC Certified Assessor (Lead CCA) and at least one other CCA. A separate CCA performs quality assurance and cannot be on your assessment team.