Short answer: A C3PAO (CMMC Third-Party Assessment Organization) is an organization authorized or accredited by the CMMC Accreditation Body to conduct CMMC Level 2 certification assessments and issue Certificates of CMMC Status. C3PAOs assess; they don’t help you prepare for the same assessment. Readiness work is done by your own team or a consultant like USCIBER, which is not a C3PAO and doesn’t issue certifications. While CMMC Phase II is suspended, C3PAO certification is not being phased in as a condition of award, but contractors can still pursue one voluntarily.
Who’s who in CMMC assessments?
| Role | What they do |
|---|---|
| DoD CMMC Program Management Office | Owns and oversees the CMMC program |
| Accreditation Body (the Cyber AB) | Authorizes and accredits C3PAOs and sets conflict-of-interest and ethics policies for the CMMC ecosystem |
| C3PAO | Performs Level 2 certification assessments and issues Certificates of CMMC Status |
| Certified CMMC Assessor (CCA) | Individual assessor who conducts Level 2 certification assessments for a C3PAO |
| DCMA DIBCAC | DoD’s own assessors. Performs Level 3 assessments and assesses C3PAOs themselves |
| Readiness consultant | Helps you scope, close gaps, and document your environment before an assessment. Can’t assess you. |
How are C3PAOs vetted?
The CMMC program rule (32 CFR § 170.9) sets strict requirements. A C3PAO must:
- Be authorized or accredited by the Accreditation Body, and meet ISO/IEC 17020 (the international standard for inspection bodies) within 27 months of authorization.
- Pass its own Level 2 assessment performed by DCMA DIBCAC, meeting all requirements for a Final Level 2 status.
- Clear a foreign ownership, control, or influence (FOCI) review.
- Have its assessment personnel complete a Tier 3 background investigation (or the DoD-determined equivalent).
- Use qualified teams. Every assessment team includes a Lead CCA and at least one other CCA, plus a separate quality assurance reviewer who is a CCA and not on the team.
- Follow conflict-of-interest rules. Ecosystem members may not take part in a certification assessment of an organization they consulted for to prepare for any CMMC assessment within the previous 3 years.
- Keep assessment records for six years and upload results to the CMMC instance of eMASS.
You can find authorized C3PAOs in the Cyber AB Marketplace.
How does a CMMC Level 2 certification assessment work?
- Select a C3PAO and agree on scope. You’ll share your CMMC Assessment Scope, System Security Plan, and asset inventory. The C3PAO submits pre-assessment and planning material to eMASS.
- Assessment. The team assesses each of the 110 NIST SP 800-171 requirements (see all 14 families) using the assessment objectives in NIST SP 800-171A. They examine documents, interview staff, and test that controls actually work.
- Re-evaluation window. A requirement scored NOT MET may be re-evaluated during the assessment and for up to 10 business days afterward, if you have additional evidence, the change doesn’t weaken other requirements, and the findings report hasn’t been delivered.
- Results. The C3PAO uploads results to eMASS, which transmits them to SPRS, and delivers a CMMC Assessment Findings Report.
- Status.
- Final Level 2 (C3PAO): all requirements MET.
- Conditional Level 2 (C3PAO): a limited POA&M is allowed (at least 80% score, only certain 1-point requirements). A C3PAO must perform a POA&M closeout assessment within 180 days, or the Conditional status expires.
- Affirmation. A senior official affirms compliance in SPRS at the time of the assessment and annually after that.
The certificate lists, at minimum, the CAGE codes covered by the assessment scope, the C3PAO, the assessment identifier, your organization’s name, and the CMMC status date and level.
What should you have ready before calling a C3PAO?
- A defined scope and boundary, with assets categorized per the CMMC scoping rules
- A current SSP describing how all 110 requirements are implemented. Without one, the assessment can’t be completed.
- Evidence for each requirement: configurations, logs, policies, training records, and tickets
- Provider documentation: customer responsibility matrices for cloud and managed service providers, and FedRAMP Moderate (or equivalent) status for cloud services handling CUI
- Hashed evidence artifacts. You’ll provide a list of artifact names and hash values, and keep the artifacts for six years.
- An honest self-assessed SPRS score, with a plan for any remaining gaps
Most organizations do a readiness or gap assessment first, close high-value gaps, then schedule the C3PAO. See CMMC Level 1 vs. Level 2 if you’re not sure which level applies.
What changed with the Phase II suspension?
The CMMC Phase II suspension paused the requirement that would have made a C3PAO Level 2 certification a condition of award in many contracts handling CUI. It did not change the rest:
- DFARS 252.204-7012 still requires NIST SP 800-171. See DFARS 252.204-7012 explained.
- SPRS scores and CMMC Level 1 and Level 2 self-assessments with annual affirmations still apply where your contract requires them.
- Voluntary C3PAO assessments remain available. Some contractors pursue one to show primes they’re ready.
Frequently Asked Questions
Is USCIBER a C3PAO?
No. USCIBER is a readiness consultant. We help you scope, close gaps, write your SSP and POA&M, and prepare for assessment. We don’t conduct CMMC certification assessments, issue certificates, or guarantee results.
Can the same company help me prepare and then assess me?
Not for the same assessment. CMMC conflict-of-interest rules bar ecosystem members from taking part in a certification assessment of an organization they consulted for to prepare for a CMMC assessment within the previous 3 years.
Who assesses CMMC Level 1 and Level 3?
Level 1 is a self-assessment with annual affirmation. Level 2 is either a self-assessment or a C3PAO certification assessment, depending on the contract. Level 3 assessments are performed by DCMA DIBCAC, and require a Final Level 2 (C3PAO) status first.
What happens if I fail a C3PAO assessment?
If your score and gaps meet the POA&M rules, you can receive a Conditional status and close the gaps within 180 days. If not, you don’t receive a Level 2 (C3PAO) status for that scope. You can remediate and be assessed again. You can also appeal findings through the C3PAO and, if unresolved, the Accreditation Body.
How USCIBER can help
USCIBER prepares defense contractors for CMMC assessments: scoping, gap assessment, an accurate SPRS score, and the documentation a C3PAO will ask for. Start with a CMMC Readiness Review from $7,500, or have us build your SSP and POA&M through the Compliance Documentation Project.
Sources
- 32 CFR Part 170 — § 170.8 Accreditation Body, § 170.9 C3PAOs, § 170.11 CMMC Certified Assessor, § 170.17 Level 2 certification assessment, § 170.18 Level 3, § 170.21 POA&M requirements (eCFR)
- DoD CIO — Cybersecurity Maturity Model Certification
- The Cyber AB — Marketplace
This article is general information, not legal advice.