Terms / Assessment
Cyber AB
The Accreditation Body. It is the single organization DoD contracts with to authorize and accredit the assessors and other ecosystem members.
Also called Accreditation Body, CMMC Accreditation Body, The Cyber AB.
Official Source Material
Accreditation Body is defined in § 170.8 and means the one organization DoD contracts with to be responsible for authorizing and accrediting members of the CMMC Assessment and Certification Ecosystem, as required. The Accreditation Body must be approved by DoD. At any given point in time, there will be only one Accreditation Body for the DoD CMMC Program.
Source: 32 CFR 170.4, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
There is exactly one Accreditation Body, and it does not assess you.
The rule is explicit that only one exists at any time. It authorizes and accredits the organizations and people who perform assessments, and it maintains the public list of them. It does not conduct your assessment, issue your status, or decide whether you passed. Confusing the Accreditation Body with a C3PAO leads companies to contact the wrong organization.
Use its list to check who you are hiring.
The practical value of the Accreditation Body to a small company is verification. Before you sign with an assessment organization or a consultant claiming a certification, check the published list. A company that is not on it is not what it claims, whatever its website says.
Certified people are a separate matter from authorized organizations.
Individuals are trained and certified through a separate organization responsible for training, testing, and certifying assessors, instructors, and professionals. A certified individual is not an authorized assessment organization. Both appear in marketing, and only one of them can conduct your assessment.
Your status lives with the Government, not with this body.
Your result is recorded in the Supplier Performance Risk System and, for a certification assessment, presented on a certificate. Questions about your status, your affirmation, or your contract go to the Government or your contracting officer.
What falls short
- A provider named as accredited with no entry on the published list. The list is the check.
- Treating a certificate held by one employee as an organizational authorization. They are different things.
- Sending assessment disputes to the Accreditation Body first. The assessment organization and the contract are where those start.
Edge cases
- Your assessment organization is authorized rather than accredited. Both may conduct Level 2 certification assessments.
- A consultant holds a professional certification and offers to assess you. A certified individual working outside an authorized organization cannot conduct your certification assessment.
- You need a Level 3 assessment. The Government performs it, and the ecosystem the Accreditation Body manages does not.
Over-engineering
- Choosing a provider by how many certified staff it lists. Availability, scope experience, and a workable date matter more.
- Waiting for the ecosystem to mature before you prepare. Your obligations under NIST SP 800-171 do not wait.