Terms / Assessment

C3PAO

A CMMC Third-Party Assessment Organization. It is the company that performs a Level 2 certification assessment and charges you for it.

Also called CMMC Third-Party Assessment Organization, third-party assessor organization.

Official Source Material

CMMC Third-Party Assessment Organization (C3PAO) means an organization that has been authorized or accredited by the Accreditation Body to conduct Level 2 certification assessments and has the roles and responsibilities identified in § 170.9.

Source: 32 CFR 170.4, eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

A C3PAO performs the assessment when your contract names Level 2 (C3PAO).

You hire it, you pay it, and it conducts the certification assessment against all 110 requirements. When your contract names Level 2 (Self) instead, you perform a self-assessment and no C3PAO is involved. Read the level in DFARS 252.204-7021 before you contact anyone, because the difference is a large bill.

Authorized and accredited mean different things, and both are allowed to assess.

An authorized organization has met the criteria other than the required international accreditations and may act for a specified time. An accredited organization has met all of them. Both may conduct Level 2 certification assessments. The Cyber AB maintains the list, and checking it is the way to confirm a company is what it says.

Capacity is limited, and readiness is what gets you a date.

Assessment organizations turn away bookings from companies that are not ready, because an assessment that cannot succeed wastes their schedule and your money. Have your system security plan finished and your evidence assembled before you ask for a date. Readiness is the thing you control.

The organization that assesses you may not also have built your environment.

An assessor cannot assess its own work, so the company that implemented your controls cannot be the company that certifies them. Plan for two relationships. Companies discover this late and lose months finding a second provider.

What falls short

A booking made before the plan is written. The assessment starts from the plan, and there is nothing to assess without one.
An assumption that a consultant's readiness review is the assessment. Only an authorized or accredited organization conducts the certification assessment.
Evidence assembled during the assessment week. The dates on records are part of what is examined.

Edge cases

Your contract names Level 3 (DIBCAC). The Government assesses you, not a C3PAO, though a C3PAO still performs your Level 2 assessment first.
You hold a Conditional status. A C3PAO performs the closeout assessment for a Level 2 certification, within 180 days of the status date.
Your external service provider has its own assessment. That can reduce effort during yours, and your own plan still has to describe the service.

Over-engineering

Interviewing many assessment organizations before you are ready. Availability matters less than your own preparation.
Paying for a mock assessment that repeats work your readiness evidence already shows. Spend it on the gaps you know about.

Connects to

Self-assessment An assessment you conduct on your own system. It carries the same requirements as a certification assessment and the same legal weight. Assessment
DFARS 252.204-7021 The contract clause that requires a current CMMC status at the level the contract names, an annual affirmation, and flow-down to subcontracts. The contract
Cyber AB The Accreditation Body. It is the single organization DoD contracts with to authorize and accredit the assessors and other ecosystem members. Assessment
System Security Plan (SSP) The document describing your system and how it meets each requirement. It is itself a requirement, and it cannot go on a POA&M. Assessment
Evidence What you show an assessor to prove a requirement is met. It must be final, not draft, and it must match what your plan claims. Assessment
External service provider An outside provider handling your CUI or your security protection data. What it handles decides how it enters your assessment. Scope and assets

Referenced by

Assessor The certified person who conducts your assessment. Assessors test objectives against evidence, and they do not advise you on how to fix gaps. Assessment
Cyber AB The Accreditation Body. It is the single organization DoD contracts with to authorize and accredit the assessors and other ecosystem members. Assessment
DCMA DIBCAC The Government team that assesses defense contractors directly. It performs Level 3 assessments and the High assessments under DFARS 252.204-7020. Assessment
Self-assessment An assessment you conduct on your own system. It carries the same requirements as a certification assessment and the same legal weight. Assessment
Conditional certification The status you hold when your assessment left items on a POA&M. It lasts 180 days and expires if the closeout does not happen. Certification
Level 2 The 110 requirements of NIST SP 800-171, assessed by you or by a C3PAO depending on what your contract says. This is where most CMMC work happens. Certification
Level 3 The 24 additional requirements from NIST SP 800-172, assessed by the Government. Final Level 2 (C3PAO) is a prerequisite for even starting. Certification