What is a CMMC Registered Practitioner Organization, and when do you need one?
A CMMC Registered Practitioner Organization (RPO) is a firm registered with The Cyber AB to provide CMMC implementation consulting, helping an organization find gaps against the Level 2 practices and plan the fixes. An RPO cannot assess or certify anyone. Its registration lets it describe itself as familiar with the basic constructs of the CMMC standard and places it in the CMMC marketplace, but the designation does not authorize it to issue a result. Your situation usually starts with a contract or a prime contractor's flowdown that asks you to show Level 2 status before you can bid or keep working on controlled unclassified information. At that point you need to separate two questions: who will help you build and document the environment, and who will judge it. The organization owns its controls, its system security plan and the affirmation made by its Affirming Official. An RPO, or any implementation partner you hire, prepares systems, configurations and evidence with your team, and it can tell you where the evidence falls short of the assessment objectives. Only a C3PAO, a certified third-party assessment organization authorized through The Cyber AB, performs a Level 2 certification assessment and issues the result. Your decision is therefore less about whether you need an RPO and more about whether you need outside implementation help at all. Some organizations with mature IT teams build the environment internally and bring in a consultant only for a readiness review. Others hire a firm to run the program end to end. Before you sign anything, confirm the firm's registration status and designation on The Cyber AB directory, ask who on its roster would do the work, and get the scope in writing so that the firm's role stays advisory and implementation-focused. Also confirm that the people who helped you prepare will not be assigned to assess you, because the rules bar that conflict. Ask whether the firm has ever done work for a company that a C3PAO you are considering is also reviewing, and treat any promise of a guaranteed pass as a warning sign.
How RP, RPA and RPO designations fit together
The three Cyber AB designations form a ladder for people and firms that help companies prepare for CMMC. Each one adds a requirement or a firm-level registration, and none of them lets the holder assess. Read the cards in order, then check each designation against the firm or individual you are considering.
Registered Practitioner (RP)
Any individual holding an RP designation may provide CMMC implementation consulting, identifying gaps and mitigation strategies for an organization preparing for assessment. An RP can work for a Registered Practitioner Organization or contract as an individual. Ask for the RP certificate and confirm it is current, because the designation requires annual renewal. The RP credential shows training in the basic constructs of the standard, not hands-on engineering depth.
Registered Practitioner Advanced (RPA)
An RPA must first be an active RP and must have implemented at least 50 cybersecurity framework controls that directly correlate to the 110 CMMC Level 2 practices. This experience requirement is the main reason to prefer an RPA for hands-on remediation work, such as configuring logging, access control or encryption. Ask for a description of the controls the person implemented and for which kinds of environments, since the count alone does not show depth.
Registered Practitioner Organization (RPO)
An RPO is the firm-level registration that lets a company list itself in the CMMC marketplace and offer implementation consulting under the Cyber AB name. The registration applies to the firm, so an RPO may employ RPs and RPAs but the individuals still carry their own designations. Check that the firm's registration is active and that the people staffing your engagement are named in your contract, not only in the marketing material.
Logo and marketplace listing
RPs and RPOs may represent themselves, with a Cyber AB-provided logo, as familiar with the basic constructs of the CMMC standard, and they appear in the CMMC marketplace. The logo and listing signal registration only. Confirm the firm's status directly on the Cyber AB registry before you rely on it, because a logo can outlast a lapsed renewal.
No authority to assess
None of the RP, RPA or RPO designations authorizes an assessment. Level 2 certification assessments are performed by C3PAOs, and the individuals on those teams hold assessor certifications. A consultant who advertises a CMMC audit or pre-certification as a substitute for a C3PAO assessment is describing a service the designation does not grant. Ask who on the proposal would sign any assessment-related document.
Conflict of interest check
Individuals who hold both an RP or RPA designation and an assessor certification cannot assess a company if they previously helped implement CMMC for that same company. Under 32 CFR 170.8(b)(17)(i)(G), ecosystem members also may not take part in a Level 2 certification assessment of an organization they consulted for within the previous 3 years. Before hiring a consultant, ask whether the firm or any staff member has assessor roles, and keep those roles separate from your preparation work.
What registration costs and how long it takes
This table compares the three Cyber AB registration tracks by one-time application fee, annual renewal and processing time. Read the fees as registration costs only, since consulting and implementation work is priced separately by each firm. Confirm current fees on the Cyber AB site before you budget, because the schedule can change.
| Designation | One-time application fee | Annual renewal | Processing time |
|---|---|---|---|
| Registered Practitioner (RP) | $600 (application, training and testing), per The Cyber AB | $500 per year, per The Cyber AB | About 3 weeks, including background check |
| Registered Practitioner Advanced (RPA) | $1,000, per The Cyber AB | $750 per year, per The Cyber AB | About 3 weeks, including background check |
| Registered Practitioner Organization (RPO) | $6,000 application, per The Cyber AB | $5,000 per year, per The Cyber AB | About 3 weeks, including background check |
| Who pays | The individual or firm applying | The individual or firm renewing | Confirm start dates with The Cyber AB |
| What the fee buys | Registration status, not consulting capacity | Continued listing eligibility | Not an assessment or certification |
| RPA prerequisite | Must already be an active RP | Must keep RP status active | Plan for the RP step first |
Why the same firm cannot consult and then assess you
An RPO that helped you implement CMMC cannot assess you. The conflict rule has two parts. The Cyber AB states that individuals who hold an RP or RPA designation and an assessor certification cannot assess a company they previously helped implement CMMC for. Separately, 32 CFR 170.8(b)(17)(i)(G) bars CMMC ecosystem members from taking part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within the previous 3 years. The first rule targets individuals who wear both hats. The second reaches the organization and its people, so a firm that prepared you in the last three years cannot staff your certification assessment, even with a different assessor on the team. Read the regulation text and the Cyber AB guidance together before you sign a consulting contract, because the look-back period means a consulting engagement can block an assessment long after the project ends.
Before you engage an RPO, ask the firm which of its people have a background in your environment and whether any of them might later be proposed to a C3PAO, or to any assessor, for your certification. Then ask the C3PAO you intend to hire for a written independence statement that confirms its assessment team has no prior consulting role for your organization, and that it has checked the 3-year window against your consulting history. Ask whether that statement covers the C3PAO's subcontractors and the individual assessors, not only the firm. Keep the file. It is the record that shows an independent assessment, and it is the first thing a contracting officer or a reviewer will look for if your certification is questioned.
On the project itself, keep the consultant and the assessor apart. The consultant may help you prepare evidence, close gaps and rehearse answers, but the assessor should receive your documentation through your own team, not through the consultant. Do not let the consultant host the assessment kickoff, write the answers to assessor questions, or sit in interviews as your spokesperson. Your Affirming Official and internal staff should own the system security plan, the evidence and the attestations, which the assessor will test directly. A clear split of roles protects your organization as well as the assessor, because a blurred line gives a C3PAO a reason to decline or to re-scope your assessment.
How to check a firm before you sign
This sequence confirms that the firm and its people hold the designations they claim, that the designations are current, and that no one on the team creates a conflict with your assessment. You finish with a set of records you can file with your contract documents before any work starts.
Confirm the firm is a listed RPO
Search The Cyber AB's listings for the firm's exact legal name and any trading names it uses in proposals. Confirm that the entity appears as a Registered Practitioner Organization and that its status is active, not lapsed or suspended. Save a dated screenshot or printout of the listing and note the legal entity name it shows, because that name should match your contract and invoices. The output is a dated record that the organization itself is registered.
Verify each named practitioner's designation
Take the list of individuals the firm names in its proposal and check each one against The Cyber AB's directory. For each person, confirm the designation (Registered Practitioner or Registered Practitioner Advanced), that it is active, and that the person is tied to the firm if the firm is claiming them as staff. A designation held by someone who has left the firm, or one that has lapsed, does not count toward the team you are buying. The output is a name-by-name verification record.
Check the marketplace listing against the claims
Compare the firm's marketplace listing with its proposal language. Confirm that the listing describes consulting and implementation services and does not describe the firm as authorized to assess CMMC. Check that any logo or wording the firm uses is consistent with what The Cyber AB permits RPs and RPOs to say, which is that they are familiar with the basic constructs of the CMMC standard. Flag any claim that implies certification, accreditation or assessment authority. The output is a short note recording each claim and whether it matches the listing.
Ask who will do the work and their experience
Request a named roster of the people who will perform the engagement, including their roles, their designations, and a description of the CMMC implementation work each has done. For Registered Practitioner Advanced staff, ask for the basis of the designation, since the Cyber AB requires implementation of at least 50 cybersecurity framework controls that correlate to the 110 Level 2 practices. Ask the firm to state which people will be on the engagement from start to finish. The output is a signed roster that becomes an attachment to the statement of work.
Confirm whether any staff are assessors
Ask the firm in writing whether any person on the proposed team, or any owner or employee of the firm, holds a CMMC assessor certification or works for a C3PAO. If the answer is yes, ask which people hold it and whether the same people would be in a position to assess your company. Also ask the firm to confirm that no assessor on its staff will join your assessment team. The output is a written staff disclosure covering every person with assessor or C3PAO ties.
Get the independence position in writing
Ask the firm to confirm in a signed statement that it, and each person it names, has not been and will not be part of a certification assessment for your organization, and that anyone who previously helped implement CMMC for your company is barred from assessing it. Ask how the firm will keep its implementation staff separate from any assessor you later engage, and confirm the firm understands the three-year restriction on ecosystem members taking part in a Level 2 certification assessment for a company they consulted for. The output is a signed independence letter that you keep with the contract file.
Reconfirm listings before signature and at renewal
Repeat the registry and marketplace checks on the day before you sign, because status can change between the first search and the contract date. Diary a recheck at each renewal point the firm and your procurement team agree, since RP and RPO designations carry annual renewal fees and can lapse. Ask the firm to notify you if any named person leaves or changes status during the engagement. The output is a dated final check recorded in the contract file, with the next recheck date noted.
What an RPO cannot promise, and what it can responsibly deliver
An RPO cannot issue a CMMC certification, assess your environment, guarantee a score, or promise a passing result. Only a C3PAO can run a Level 2 certification assessment, and the Registered Practitioner designation does not authorize anyone to assess. The Cyber AB states that RPs and RPOs may present themselves as familiar with the basic constructs of the CMMC standard and may use a Cyber AB-provided logo, but that is the full extent of what the designation signals. Any proposal that describes an RPO as able to certify you, or that ties its fee to a result, should be treated as a warning sign. Ask the firm in writing which parts of its work it will stand behind and which parts depend on the assessor's findings.
What an RPO can responsibly deliver is preparation work: a gap analysis against the 110 Level 2 requirements, a mitigation plan with owners and sequencing, help drafting the System Security Plan, and help collecting evidence in the form assessors will review. It can also help you prepare the environment itself, including configuration, documentation and internal readiness checks. Your organization still owns every control and the Affirming Official must still own the affirmation. An RPO's staff can recommend what to change, but they cannot attest that the change is in place. Keep that line clear in your statement of work so no one later mistakes a consultant's draft for your evidence.
Your current obligation depends on your contracts. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to begin 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in effect. Before you buy any consulting, confirm with your contracting officer or prime which assessment type each contract requires and when. Ask the RPO how its scope maps to those obligations, and whether it will document the work so your own team can maintain the environment after the engagement ends.
Who does what: your team, an RPO and a C3PAO
Your organization owns the CMMC environment, the controls, the evidence and the decisions that go with them. The Affirming Official signs for the company, and no consultant or assessor can take that responsibility away. Your team also decides scope, funds the work and keeps the system running after any assessment is over.
- Owning the controls: Your staff operate, monitor and change the systems that handle CUI, and they must be able to show how each NIST SP 800-171 Rev. 2 requirement is met.
- Keeping the SSP current: The system security plan describes your environment in your own words and must match what is actually deployed.
- Signing and affirming: The Affirming Official attests to the status posted in SPRS, so that person needs real knowledge of the environment.
- Producing final evidence: Assessors accept only evidence in final form, so your team must finish policies, logs and records rather than leave drafts behind.
- Managing outside help: You set written scope and deliverables, and you decide which vendor tasks you keep in-house.
Before engaging anyone, confirm internally who will own each control area after the consultant leaves.
A Registered Practitioner Organization is a firm whose registered practitioners may provide CMMC implementation consulting, such as identifying gaps and suggesting mitigation strategies. The Cyber AB lists RPOs in its marketplace, but the designation does not authorize a firm to assess. An implementation partner such as DeployOpen prepares systems and evidence. It does not issue reports or certificates.
- Gap analysis and planning: Consultants compare your environment to the Level 2 requirements and propose a remediation sequence.
- Building or hardening systems: Partners configure identity, logging, encryption and other controls that you then own and operate.
- Preparing evidence: Partners help draft procedures, collect configuration records and organize artifacts for your assessor.
- Training staff: Partners can help your team understand the requirements so that operations continue after the engagement.
- Independence limit: If the firm helped implement CMMC for your company, its assessor-certified staff cannot assess you under the Cyber AB rule.
Ask any firm to name the people who would touch your environment and confirm their designations before you sign.
A CMMC Third-Party Assessment Organization is the body that performs a Level 2 certification assessment, and it must be authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. Its assessors examine your environment against the NIST SP 800-171A assessment objectives and determine whether each requirement is met. The C3PAO is independent of the consultant who helped you prepare.
- Scoping the assessment: The C3PAO confirms which assets are in scope and how they are bounded.
- Testing objectives: Assessors interview staff, examine documents and test systems against each applicable objective.
- Issuing the outcome: Only the C3PAO and the CMMC program issue the certification result, not your consultant.
- Evidence standards: Assessors accept final evidence, not drafts, so preparation work must be finished before assessment day.
- Independence rules: The C3PAO cannot be the firm that consulted you within the restricted window in the rules.
Confirm the C3PAO's authorization or accreditation status with The Cyber AB before you contract, and do not accept a fee arrangement that depends on the result.
Frequently asked questions about RPOs and CMMC consultants
Can an RPO assess us for CMMC?
No. A Registered Practitioner Organization (RPO) provides implementation consulting, helping you identify gaps and plan mitigation before an assessment. The designation does not authorize assessment. Level 2 certification assessments are performed by C3PAOs, and the assessor team must be independent of the consulting work. The Cyber AB says RPs and RPOs may present themselves as familiar with the basic constructs of the CMMC standard, and they are listed in the CMMC marketplace, but that listing does not make them an assessor. Confirm any firm's authorization on The Cyber AB's directory before you rely on it for assessment.
Do we need an RPO to pass a CMMC assessment?
No. Nothing in the CMMC program requires you to hire an RPO or any consultant. The assessed organization owns its controls, its System Security Plan and its evidence, and the assessment checks whether those are met. A consultant can shorten the path by finding gaps early, but your own team can prepare the environment and evidence if it has the skills and time. The practical drivers are the size of your environment, how many systems hold Controlled Unclassified Information, and whether your staff has run a NIST SP 800-171 self-assessment before. Ask any firm to explain which parts of the work it would perform and which would remain yours.
How much does Registered Practitioner registration cost according to The Cyber AB?
The Cyber AB lists $600 for a Registered Practitioner (RP) application, training and testing, with a $500 annual renewal. It lists $1,000 for a Registered Practitioner Advanced (RPA), with a $750 renewal, and $6,000 for a Registered Practitioner Organization (RPO) application, with a $5,000 annual renewal. These are individual and firm fees paid to The Cyber AB, not the price of consulting. Consulting engagements are priced separately, based on your scope, the number of systems in the boundary, the amount of documentation to build, and how much remediation your team does itself. Fees may change, so confirm the current schedule on The Cyber AB's website before budgeting.
How long does Registered Practitioner registration take?
According to The Cyber AB, each of the RP, RPA and RPO registrations takes about 3 weeks, and that timing includes a background check. The clock depends on how quickly the applicant completes training and testing, and on how fast the background check clears. Plan for the individual steps to run in sequence, so a firm that needs an RPA for a specific engagement should start the application well before the work is scheduled. Check the current process on The Cyber AB's site, because the steps and timing are set by the accreditation body, not by the consulting firm you hire.
Can our own staff become Registered Practitioners?
Yes, individuals may pursue an RP designation, and the Cyber AB describes RPs as able to provide implementation consulting for organizations preparing for assessment. Before you go this route, check the rules that govern who may later assess you. An individual who holds both an RP or RPA designation and an assessor certification cannot assess a company they previously helped implement CMMC for. Your own employees also cannot both prepare your environment and act as your assessor. Staff who take the RP path will need time for training, testing and the background check, and they still need the experience to implement controls in your environment.
Can the firm that consulted us also be our assessor?
No, not for the same company. Under 32 CFR 170.8(b)(17)(i)(G), CMMC ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within the previous 3 years. The Cyber AB applies the same principle to people who hold both an RP or RPA designation and an assessor certification. Before you sign, ask the consulting firm to confirm in writing that it will not join your assessment team, and ask your chosen C3PAO to confirm that no one on its team consulted for you. This separation protects the independence of the assessment and avoids a result that a sponsoring contracting officer may later question.
How do we check whether an RPO or RP is legitimate?
Start with The Cyber AB's directory and the CMMC marketplace listings, then confirm the firm's registration status and the named practitioners' designations. A listing confirms the designation, not the quality of the work, so ask for specifics: which RPs will do the work, what their experience is in your environment type, and what the scope and deliverables are in writing. Request a written statement that the firm will not assess you and has not assessed you. Ask how the firm will document evidence and whether it will leave you with artifacts you own. Finally, ask for a written, fixed scope before any work starts so you can compare proposals on the same basis.
Can an RPO promise us a passing score?
No, and you should treat any such promise as a warning sign. Consultants can help you find gaps, prepare evidence and plan remediation, but the outcome of a CMMC assessment is decided by an authorized assessor against the assessment objectives in NIST SP 800-171A. A requirement is met only when every applicable objective is satisfied with evidence in final form, not drafts. Ask a consultant how it will measure readiness, which gaps it would leave for your team, and how it will handle requirements that remain unmet. A credible engagement describes its work and deliverables, not an assessment result.
How DeployOpen prepares your environment and evidence
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure, so the systems and evidence behind your CMMC Level 2 practices are ready for an independent assessment. DeployOpen prepares environments and evidence but does not issue assessment reports or certifications, and it does not assess the organizations it helps.
How we scope
- Engagements are fixed-scope, with the systems, boundaries and deliverables agreed in writing before work starts.
- The written scope names which CMMC practices and domains the work covers and which remain with your team.
- Ask us to state in writing which parts of the CMMC work DeployOpen will not perform, including any assessment activity.
How we build
- Systems are deployed and configured inside your own cloud accounts, data centers or air-gapped networks.
- Access control, audit logging and configuration baselines are set up to match the practices named in your written scope.
- Security testing of applications, APIs and infrastructure can be run against the built environment before the assessor arrives.
How we hand over
- Documentation covers how each platform is configured, operated and changed, so your staff can run it after handover.
- Evidence such as configuration records, logs and test results is organized so your assessor can trace it to each requirement.
- Your organization keeps ownership of the controls, the system security plan and any affirmations made to the government.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial scope is delivered.
- Retainers can cover platform patching, backups and evidence refreshes that keep your environment current between assessments.
- Confirm the support terms, response expectations and handover responsibilities in writing as part of your quote.
