# What Is a C3PAO? How to Choose One **URL:** https://theauditrail.com/frameworks/cmmc/c3pao/ **Published:** 2026-10-02 **Modified:** 2026-10-11 **Author:** The Audit Trail editorial desk > A C3PAO performs CMMC Level 2 certification assessments. The Cyber AB reported 107 in June 2026, for 76,598 organizations. --- [CMMC guide](https://theauditrail.com/frameworks/cmmc/) # What Is a C3PAO? How Many There Are and How to Choose One A C3PAO performs CMMC Level 2 certification assessments. The Cyber AB reported 107 authorized C3PAOs in June 2026, for 76,598 organizations that may need one. The Audit Trail editorial desk Updated Oct 11, 2026 · First published Oct 2, 2026 [Some vendors pay us to be assessed or listed. Payment never changes a score, a rank or a verdict.](https://theauditrail.com/how-we-make-money/) In brief - A C3PAO is the firm that performs CMMC Level 2 certification. - The Cyber AB reported 107 authorized C3PAOs in June 2026. - The Department of War's demand estimate works out to about 716 organizations per C3PAO. - The department puts a small entity's Level 2 certification cost at $101,752. - Phase II is suspended, so self-assessment is the rule today. A C3PAO (CMMC Third-Party Assessment Organization) is the authorized organization that performs a CMMC Level 2 certification assessment. It assesses contractors through the certified professionals and assessors it employs, known as CCPs and CCAs. As of June 2026, the Cyber AB reported 107 authorized C3PAOs. The Department of War estimates that 76,598 organizations will need a Level 2 certification assessment. That works out to about 716 organizations for every C3PAO. Compliance software prepares a contractor for the assessment, and the C3PAO performs it. The demand figure is a plan for now. The Department of War suspended Phase II of [the CMMC program](https://theauditrail.com/frameworks/cmmc/) on July 13, 2026, and Phase 1 self-assessment remains the rule in force. ## What a C3PAO does Each CMMC level has its own assessor: - **Level 1** is an annual self-assessment of the basic safeguards for federal contract information. - **[Level 2](https://theauditrail.com/frameworks/cmmc/level-2/)** covers the 110 requirements in NIST SP 800-171 Revision 2. A contractor meets it with a self-assessment every three years or with a C3PAO certification assessment, depending on what the solicitation calls for. - **Level 3** adds enhanced requirements from NIST SP 800-172. The government performs that assessment through DIBCAC. The C3PAO’s job is the Level 2 certification assessment. The Cyber AB keeps assessors and advisers in separate roles. A Registered Practitioner Organization (RPO) gives advisory help to get ready and does not conduct certified assessments. ISACA is now the authorized body for the CCP, CCA and Lead CCA credentials that assessors hold. A contractor passes by meeting all 110 requirements. It can also score at least 80 percent with only permitted gaps, which earns a Conditional status and a Plan of Action and Milestones (POA&M). Every POA&M item has to close within 180 days, verified by a second assessment called a POA&M closeout assessment. A Final status is valid for three years, and the contractor affirms compliance every year in SPRS. ## How many C3PAOs there are The Cyber AB reported 107 authorized C3PAOs as of June 2026, per the [June 2026 town hall recap](https://www.cmmc.com/newsroom/cyber-ab-town-hall-06-2026). The count moves as firms are authorized: it stood at 103 in March 2026. The department’s own estimate, in Table 5 of the 32 CFR Part 170 final rule, puts demand at 76,598 organizations needing a Level 2 certification assessment. That total is 56,689 small entities and 19,909 that are other than small. Source C3PAOs Organizations per C3PAO Cyber AB, June 2026 107 about 716 ## Capacity at the peak year The department’s model phases Level 2 certifications in over four years. It expects 517 new certifications in year 1, 2,599 in year 2, 8,666 in year 3 and 16,610 in year 4. The rule says the department chose year 4 as the peak “based on the projected capacity of the CMMC Ecosystem to grow.” The current count measures that ecosystem as it stands today. At the June count, the year 4 figure means about 155 certifications per C3PAO in a single year. That ratio divides the department’s demand by today’s supply. It leaves out assessment length, team size and any new C3PAOs that join. ## What the Phase II suspension changes Phase II was the step that would have made a Level 2 (C3PAO) status a condition of award on applicable contracts. It was scheduled for November 10, 2026. On July 13, 2026, the Department of War suspended it and set up a CMMC reform task force. No new start date has been announced. Phase 1 stays in force. It began on November 10, 2025, and asks for a Level 1 or Level 2 self-assessment status on applicable contracts. The rule also lets the department require a Level 2 (C3PAO) status during Phase 1 at its discretion. While Phase II is suspended, the Department says it will enforce NIST 800-171 Revision 2 through self-assessments and select government-led assessments. That makes the 76,598 a planning estimate for a full rollout. It shows the demand the department modeled, and no contract requirement in force today matches it. ## How to choose a C3PAO The Cyber AB Marketplace answers the first questions: - **Confirm the role.** Look for the C3PAO role on the firm’s listing. An RPO is an advisory role and cannot conduct a certified assessment. - **Check standing.** Each listing carries an active and in-good-standing flag. - **Check the people.** CCAs and Lead CCAs have their own Marketplace listings. Ask which assessors will work on your assessment, then look them up. - **Plan for a closeout.** A Conditional status brings a POA&M, 180 days to close it and a second assessment. Ask how the firm handles the POA&M closeout assessment before you sign. Budget from [the department’s own figures](https://theauditrail.com/frameworks/cmmc/cost/). It estimates the cost to support a Level 2 certification assessment and affirmation at $101,752 for a small entity and $112,345 for one that is other than small. Over three years, with annual affirmations, it puts the totals at $104,670 and $117,768. Some platforms name C3PAO partners. Vanta names A-LIGN and Schellman. ## Where compliance software fits The platforms in our [CMMC compliance software ranking](https://theauditrail.com/best/cmmc-compliance-software/) prepare the evidence, the System Security Plan (SSP) and the POA&M. None of them performs the assessment, which stays with the C3PAO. SOC 2 splits the work the same way, with [a licensed CPA firm performing the audit](https://theauditrail.com/frameworks/soc-2/who-performs-a-soc-2-audit/) after the software gets the company ready. **[Vanta](https://theauditrail.com/vendors/vanta/)** names SSP generation, POA&M management and an SPRS score monitor as features. It says it partners with Cyber AB-listed RPOs for readiness and with C3PAOs for certification, naming A-LIGN and Schellman. ![Vanta logo](https://theauditrail.com/logos/vanta.png) Vanta 82/100 Strong [Scorecard](https://theauditrail.com/vendors/vanta/) [Vanta site](https://www.vanta.com) **[Secureframe](https://theauditrail.com/vendors/secureframe/)** sells a dedicated CMMC product, Secureframe Defense. It says teams can build SSPs and POA&Ms and monitor live SPRS scores there. Secureframe has also been through a C3PAO assessment itself. It holds a CMMC Level 2 certification, earned in September 2025 after an assessment by Redspin. ![Secureframe logo](https://theauditrail.com/logos/secureframe.png) Secureframe 75/100 Strong [Scorecard](https://theauditrail.com/vendors/secureframe/) [Secureframe site](https://secureframe.com) **[Sprinto](https://theauditrail.com/vendors/sprinto/)** ranks first of the six at 84. It pairs a contractor with an RPO from its own partner network for scoping, with SSP templates and a preliminary gap analysis. **[Drata](https://theauditrail.com/vendors/drata/)** tracks POA&M items with an owner, a status and linked evidence. It maps CMMC requirements to shared controls, with continuous evidence and a named owner for each. **[Scrut](https://theauditrail.com/vendors/scrut/)** lists CMMC 2.0 Levels 1 and 2 in its framework catalog. **[Thoropass](https://theauditrail.com/vendors/thoropass/)** builds its CMMC product for Level 1, which a contractor self-assesses without a C3PAO. Most of that work is [compliance automation](https://theauditrail.com/blog/grc/compliance-automation/): evidence collection, control monitoring and keeping documents current between assessments. Our [rubric](https://theauditrail.com/rubric/) credits a named C3PAO partner list under audit path, the 15-point criterion for how short the road is from ready to a signed assessment or report. The same six platforms carry the same scores in our [compliance management software ranking](https://theauditrail.com/best/compliance-management-software/). The subscription is a separate cost from the assessment. [Starting prices](https://theauditrail.com/research/compliance-software-pricing-2026/) for the six platforms, as listed on AWS Marketplace and on secureframe.com, run from $7,500 a year for Secureframe Fundamentals to $15,000 for Scrut and for Drata’s Foundation Package, which covers 1 to 50 employees. Drata’s separate listing for a 100-person organization costs $32,500 with one framework. Those are general plan prices. ## Where the numbers come from The Cyber AB count comes from its town hall recaps, which gave 103 authorized C3PAOs in March 2026 and 107 in June 2026. The department’s demand figures come from the entity tables in the 32 CFR Part 170 final rule: Table 5 for the 76,598 total, and Tables 6 and 7 for the yearly phase-in. Platforms in this article [![Sprinto logo](https://theauditrail.com/logos/sprinto.png)Sprinto (84/100)](/vendors/sprinto/)[ ![Vanta logo](https://theauditrail.com/logos/vanta.png)Vanta (82/100) ](/vendors/vanta/)[ ![Drata logo](https://theauditrail.com/logos/drata.png)Drata (76/100) ](/vendors/drata/)[ ![Secureframe logo](https://theauditrail.com/logos/secureframe.png)Secureframe (75/100) ](/vendors/secureframe/)[ ![Scrut logo](https://theauditrail.com/logos/scrut.png)Scrut (72/100) ](/vendors/scrut/)[ ![Thoropass logo](https://theauditrail.com/logos/thoropass.png)Thoropass (52/100)](/vendors/thoropass/) ## Frequently asked questions - What is a C3PAO? A C3PAO, or CMMC Third-Party Assessment Organization, is the authorized organization that performs a CMMC Level 2 certification assessment. It assesses contractors through the certified professionals and assessors it employs, and it is listed on the Cyber AB Marketplace. - How many C3PAOs are there? The Cyber AB reported 107 authorized C3PAOs in June 2026. The Department of War estimates that 76,598 organizations need a Level 2 certification assessment, which is about 716 organizations per C3PAO. - Does a defense contractor need a C3PAO today? Only when a solicitation calls for one. The Department of War suspended Phase II on July 13, 2026, and Phase 1 self-assessment remains in force. Under Phase 1, Level 2 can be met with a self-assessment every three years unless a solicitation requires a C3PAO certification assessment. - Can compliance software perform a CMMC assessment? No. Platforms such as Vanta, Secureframe and Sprinto prepare the evidence, the System Security Plan and the POA&M. A C3PAO performs the certification assessment itself. - What does a CMMC Level 2 certification cost? The department estimates the cost to support a Level 2 certification assessment and affirmation at $101,752 for a small entity and $112,345 for an entity that is other than small. Over three years, with annual affirmations, it puts the totals at $104,670 and $117,768.