C3PAO vs RPO: Who Does What in CMMC

By Shaheer Malik · Updated Oct 16, 2026

A C3PAO assesses and certifies you; an RPO helps you get ready. A CMMC Third-Party Assessment Organization (C3PAO) conducts Level 2 certification assessments and issues the Certificate of CMMC Status.^[1] A Registered Provider Organization (RPO) is a company registered to deliver CMMC consulting; it cannot certify you.^[2]

C3PAO: the assessor

Under the CMMC Program rule, C3PAOs “are responsible for conducting Level 2 certification assessments and issuing Certificates of CMMC Status,” and must be authorized or accredited by the Accreditation Body.^[1] An assessment team includes a Lead Certified CMMC Assessor and at least one other assessor.^[1]

C3PAOs must follow the Accreditation Body’s conflict-of-interest policy and keep records of organizations they have provided consulting services to.^[1] Ask any firm that offers both consulting and assessment how they keep the two apart.

RPO: the consultant

An RPO helps with gap assessments, scoping, remediation planning and documentation before the official assessment. Secureframe counted 387 RPOs and 103 C3PAOs in March 2026.^[2]

Which do you need?

• Preparing for Level 2: an RPO, or in-house staff with the right skills.
• Getting certified at Level 2: a C3PAO. Mandatory Level 2 (C3PAO) certification under Phase 2 is suspended while the Department of War reviews the program, but a contract can still require it under Phase 1.^[4] Before the suspension, Secureframe noted that at least 80,000 organizations were expected to need Level 2 certification, against about a hundred C3PAOs.^[2]
• Level 1: an annual self-assessment; no C3PAO is involved.^[1]

Check any firm’s current status on the Cyber AB Marketplace before you sign.^[3]

FAQ

Can an RPO certify my company?

No. Only an authorized or accredited C3PAO can conduct a Level 2 certification assessment and issue a Certificate of CMMC Status.

Can the same firm consult and assess?

C3PAOs must follow the Accreditation Body’s conflict-of-interest policy and record whom they have consulted for. Ask the firm how it separates the two.

Sources

1. Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)
2. Secureframe: The CMMC ecosystem (figures as of March 2026) (checked Oct 16, 2026)
3. Cyber AB Marketplace (checked Oct 16, 2026)
4. Holland & Knight: DOW Suspends CMMC Phase II Requirements (July 2026) (checked Oct 16, 2026)