The Audit Trail
For vendors
For vendors
Firm list

CMMC Consultants and RPOs (2026): 404 Registered, 104 Pass All Four Checks

The Cyber AB Marketplace lists 404 Registered Provider Organizations on October 29, 2026. 104 of them pass all four checks anyone can run on the Marketplace record.

The Audit Trail editorial desk
Published Oct 29, 2026

Some vendors pay us to be assessed or listed. Payment never changes a score, a rank or a verdict.

The Cyber AB Marketplace lists 404 Registered Provider Organizations (RPOs) on October 29, 2026, down from 416 on October 2. An RPO gives advisory help to get a contractor ready for a CMMC assessment and cannot perform one. 104 of the 404 pass all four checks that anyone can run on a firm’s Marketplace record: founded in 2016 or earlier, Assessment Services, Governance, Risk & Compliance and Security Program Development declared, all US states served, and 12 or more of the 17 service categories declared. The 104 are listed alphabetically below. Ask any firm for references before signing.

What an RPO does

CMMC runs in Phase 1 only. The Department of War suspended Phase II on July 13, 2026, so a self-assessment and an SPRS score are what most contractors file today. An RPO helps with that work: scoping, gap analysis and writing the System Security Plan. The certified Level 2 assessment is a different job, covered in the C3PAO guide and in the phase-by-phase assessment guide. The Marketplace lists the roles side by side on October 29, 2026:

Marketplace roleListings
Registered Provider Organization (RPO)404
Certified Third-Party Assessment Organization (C3PAO)121
Registered Practitioner (RP)2,156
Registered Practitioner Advanced (RPA)301
Certified CMMC Professional (CCP)2,350
Certified CMMC Assessor (CCA)1,190

Total listings across all roles: 7,350. The Department of War’s own figures for Level 2 assessment costs cover the assessment itself, and the Level 2 requirements guide covers what the 110 requirements ask of a contractor.

The 404 RPOs by region, age and service

Of the 387 RPOs that list a time zone, 244 are Eastern, 62 Central, 36 Pacific and 26 Mountain. 9 list Korea and 10 list another zone. Virginia, Maryland, California, Florida and Texas have the most RPOs by headquarters state.

Years in businessRPOs
Under 572
5 to 1073
10 or more259

59 of the 404 list remote services globally and 345 do not. Each RPO ticks the service categories it offers. Consulting, governance and assessment work lead the counts:

Service categoryRPOs declaring it
Cybersecurity Consulting355
Governance, Risk & Compliance317
Assessment Services293
Security Awareness and Education285
Security Program Development283
Virtual CISO271
Penetration Testing & Phishing252
Managed IT Security Services250
Training226
Cybersecurity Monitoring & Surveillance225
Security Products210
Third-Party Risk Management209
Managed Detection and Response204
SOC Services & CyberOps185
Audit Services180
Other111
Digital Forensics97

The 104 RPOs that pass all four checks

The four checks, all readable on the Marketplace record:

  1. Founded in 2016 or earlier, which is the Marketplace’s 10 or more years in business band.
  2. Declares Assessment Services, Governance, Risk & Compliance and Security Program Development.
  3. Serves all US states.
  4. Declares 12 or more of the 17 service categories.

104 of the 404 RPOs pass all four. The list is alphabetical.

FirmFoundedCategories (of 17)
8 Consulting, LLC201215
Advania Sverige AB197117
Advantage Industries, Inc.199915
AG Schwallbach LLC201015
Alchemy Global Networks, LLC201512
All Covered, IT Services From Konica Minolta187315
Almond Consulting Group, Inc.200117
AM Data Service, Inc.200614
Anchor Cyber, Inc201415
ArcherHall (fka Vestige Ltd)200412
Brea Networks, LLC201016
Bridgehead IT201212
Bright Flow Technologies201313
Brightline Technologies, Inc200813
C3 Integrated Solutions200813
Calian Group Ltd198215
Caspian IT Group201213
CBIZ Technology198915
Centre Technologies, Inc.200615
CFGI Holdings LLC200013
Charles IT, LLC200615
CHRISTENSEN CREATIVE CONSULTING, LLC200612
Compass IT Compliance201015
CompassMSP201012
Concertium199615
Consist Tech, LLC201517
Coretek LLC.200513
Crimson Vista, Inc.201612
Cyber Advisors, LLC199716
Cyber Security Solutions, Inc201516
CyberSecOp LLC200116
Dean Dorton Allen Ford, PLLC192117
DIGIT3 LLC201514
DirectViz Solutions, LLC201312
Diversified Disaster Recovery Services, Inc.200615
DOOSAN CORPORATION DIGITAL INNOVATION BU199816
Earthling Security, LLC201217
Enterprise Unified Solutions, Inc199817
ERNST & YOUNG LLP184915
eTrepid Inc.201017
Executech Utah, LLC199917
Frazier & Deeter Advisory, LLC198112
GjB and Associates201512
Golden Five LLC201412
GoSecure Inc.200413
Hampton Roads Communications, Inc.198613
Heartland Business Systems, LLC.199017
Help Desk Cavalry LLC201313
Information Safeguard, Inc200313
INFOTEK CONSULTING LLC.200612
Insight Direct USA, Inc.198813
InterSec, Inc.201313
ISSE Services LLC200514
K2 Construction Consultants, Inc.199014
KAMIND IT200913
KMicro Tech, Inc.201415
KPMG187616
Leapfrog Services Inc.199816
Lumen Technologies Service Group, LLC196814
M3 Technical Solutions, LLC201515
MAD Security201017
Magnari Inc.201312
Marco Technologies, LLC197314
MelroseMac, Inc.200214
Miller Kaplan Arase LLP194113
MNSG Acquisition Company, LLC199915
Muscogee Business Services, LLC199916
Mytech Partners, Inc.200013
NCC Group199916
Netrio, LLC200315
Nettitude Inc200316
Nexigen Communications, LLC200317
Nexus Technologies, LLC199614
PeopleTec, Inc.200515
Petronella Technology Group, Inc.200217
Pinnacle Business Systems, Inc.198816
Plante & Moran, PLLC192417
Pondurance200814
Presidio Networked Solutions LLC200316
PwC185417
R3, LLC200815
RB Advisory LLC201617
Resource Computer Solutions, Inc.200115
Richey May Advisory LLC198517
Right Click, Inc.199716
Right Hand Technology Group Inc201415
Sandoval Technology Solutions LLC201217
Socium Security Inc201616
Solomon Security201014
Square One Technologies Inc.201414
STREAMSCAN AI INC201115
Structured Communication Systems, Inc.199212
SVAM International Inc.199413
SWICKtech200114
SynerComm, Inc.199112
Sysarc, Inc.200412
System High Corporation200516
Tangible Software, Inc.199812
Taylor Networks201416
The 20 LLC199614
Vanguard Management Solutions, Inc.201617
Vast Enterprises, Inc.201416
Waterleaf International LLC201014
Workplace IT201616

RPOs, platforms and the assessment

A contractor often pairs an RPO with software. Sprinto matches a contractor to an RPO from its partner network for scoping, and Vanta says it works with Cyber AB-listed RPOs on readiness. Secureframe, Inc. holds an RPO record of its own. The CMMC compliance software ranking scores what each platform does for SPRS scores, SSPs and POA&Ms.

A contractor whose CUI sits in a cloud service also needs that service to meet the FedRAMP Moderate baseline. The FedRAMP class guide explains how that baseline relates to Class C under the 2026 rules.

Frequently asked questions

  • What is a CMMC RPO?

    A Registered Provider Organization is a firm listed on the Cyber AB Marketplace that gives advisory help to get a contractor ready for a CMMC assessment. It cannot perform a certified assessment. That job belongs to a C3PAO.

  • How many CMMC RPOs are there?

    The Cyber AB Marketplace listed 404 Registered Provider Organizations on October 29, 2026. It listed 416 on October 2, 2026, so the count fell by 12 in four weeks.

  • How many CMMC RPOs pass all four checks?

    104 of the 404 pass all four: founded in 2016 or earlier, Assessment Services, Governance, Risk & Compliance and Security Program Development declared, all US states served, and 12 or more of the 17 service categories declared.

  • Can an RPO certify a company for CMMC?

    No. An RPO prepares a contractor for the assessment. A C3PAO performs the Level 2 certification assessment, and the Marketplace listed 121 C3PAOs on October 29, 2026.

  • How do I check that a consulting firm is an RPO?

    Search the Cyber AB Marketplace by the firm's name and filter to the RPO role. A firm that advertises CMMC consulting and has no RPO record is not a Registered Provider Organization.

Related rankings and guides