Choosing a C3PAO for CMMC Level 2 | Who may assess

How to choose a C3PAO for a CMMC Level 2 certification assessment

A contract or customer now asks for a CMMC Level 2 certificate, and the first decision is who will perform the assessment. Under 32 CFR 170.17, only a C3PAO authorized or accredited by the CMMC Accreditation Body may perform a Level 2 certification assessment, and that body is currently The Cyber AB. Before you sign anything, confirm the firm's status on the Cyber AB Marketplace, where authorized firms are listed as Authorized C3PAOs. Context matters too: on 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, so confirm with your contracting officer which level your contract actually requires before you commit to an assessment date.

The right C3PAO depends on three things: the scope you will present, the independence of the assessment team from the people who prepared you, and the contract terms you can enforce. Start by asking whether the firm has assessed organizations of your size and asset mix, and how it staffs teams for a scope like yours. Then check independence. Under 32 CFR 170.8(b)(17)(i)(G), ecosystem members may not assess an organization they consulted for on any CMMC assessment within the previous three years, and assessors who took part in any way in your preparation cannot sit on your assessment team. Ask every firm on your shortlist to name its consultants and to confirm in writing that none of them worked for you. Your readiness partner, including DeployOpen, prepares systems, documentation and evidence, but it does not assess, score or certify. Only the independent C3PAO and its assessors do that, and the separation must hold from the first conversation.

For the contract, request a mutual non-disclosure agreement, which the CMMC Assessment Process v2.0 expects, and a written scope, schedule and deliverables list tied to the assessment phases. Check that the agreement contains no guarantee of a result or a fee contingent on certification, because the same process prohibits both. Ask who the Lead CCA will be, how the firm's quality assurance reviewer is independent of the team, and what the certificate will show, including the CAGE codes in scope and the assessment unique identifier. Ask for the firm's ISO/IEC 17020:2012 status as well, since authorized C3PAOs must reach accreditation within 27 months of authorization under 32 CFR 170.9(b)(2). Price is not set by DoD, so compare written quotes against the same scope rather than against each other's assumptions.

How to verify a C3PAO's authorization on The Cyber AB Marketplace

This sequence confirms that a candidate firm holds the right status, that the people named for your assessment hold current credentials, and that every check is preserved as a dated record in your procurement file before you sign.

Confirm the firm is listed as an authorized C3PAO
Search The Cyber AB Marketplace for the firm by its legal name and any trading name it uses. A Level 2 certification assessment must be performed by a C3PAO authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB, and The Cyber AB's FAQ says authorized firms appear on the Marketplace as Authorized C3PAOs. Confirm the listing shows that status, not a consultant, practitioner or training listing. The output of this step is a saved screenshot or printed record showing the firm name, status and the date you checked.
Confirm the authorization status is current
Check that the firm's listing is active on the day you verify it, not only that it has appeared at some point. Ask the firm in writing to confirm its current authorization status and to identify any change since its listing was made. Under 32 CFR 170.9(b)(2), an authorized C3PAO must achieve and maintain compliance with ISO/IEC 17020:2012 within 27 months of authorization to become accredited, so ask where the firm stands on that path. Record the answer, the date and the name of the person who gave it.
Verify the named assessors hold current CCA credentials
Firm-level authorization does not show who will conduct your assessment. Ask the C3PAO to list the assessors proposed for your team, including the Lead CCA and at least one other CCA, as 32 CFR 170.9(b)(12) requires. Look up each individual on The Cyber AB's directory of certified assessors and confirm the credential is active. Also ask for confirmation that each person has completed the background investigation and foreign ownership review obligations the C3PAO must meet. The output is a named roster with each credential status and check date.
Screen the proposed team for conflicts of interest
Ask each proposed assessor and the C3PAO to state in writing whether they, or anyone at the firm, have consulted for your organization or taken part in any CMMC preparation for it. Under 32 CFR 170.8(b)(17)(i)(G), CMMC ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within the previous 3 years. Your own consultant and the assessing firm must be kept separate. The output is a signed conflict statement from the C3PAO and each named assessor.
Ask for the firm's accreditation progress in writing
Request a written statement of where the firm stands toward accreditation, including whether it has passed the Level 2 assessment by DCMA DIBCAC required for authorization under 32 CFR 170.9(b)(6) and the status of its ISO/IEC 17020:2012 work. Ask the firm to name the dates it reached each milestone it has completed, and what remains open. Confirm the answer matches what the Marketplace shows. The output is a dated progress letter that you can attach to the procurement file.
Record each check in the procurement file
Gather the Marketplace record, the status confirmation, the assessor roster with credential checks, the conflict statements and the accreditation progress letter into one procurement file. Label each item with the date it was obtained and the person who obtained it. Repeat the Marketplace and credential checks before the assessment is scheduled, because status and individual credentials can change. The output is a complete, dated verification file that supports the contract decision and any later review.

What C3PAOs and their assessors must meet

A C3PAO is the organization that performs a Level 2 certification assessment, and it must be authorized or accredited by the CMMC Accreditation Body, which is currently The Cyber AB. Under 32 CFR 170.9(b)(2), an authorized C3PAO has 27 months from authorization to achieve and maintain compliance with ISO/IEC 17020:2012 and become accredited, so a firm's status can change over time. Under 32 CFR 170.9(b)(6), the firm must also pass a Level 2 assessment by DCMA DIBCAC that meets the requirements for Final Level 2 (C3PAO) as part of authorization.

Authorization status: Confirm that the firm is listed as an Authorized C3PAO on The Cyber AB Marketplace before any contract is signed.
Accreditation timing: Ask whether the firm has achieved accreditation or is still within its 27-month window, and what it will do if the window closes.
DIBCAC result: Ask for confirmation that the firm passed the DCMA DIBCAC assessment required for authorization.
Ecosystem roles: Ask how the firm separates its assessment business from any consulting work it offers.

Before contracting, check the Marketplace listing yourself and record the status date, because a buyer relying on an outdated or secondhand claim carries the risk if the firm's standing changes.

Why your consultant cannot also be your assessor

A consultant who prepares your environment and an assessor who scores it must be different people, and the rules set a time bar and a team-membership test that apply to both. Each card below covers one check you can make before signing a C3PAO contract, and the organization always owns its controls while only the assessor issues the certificate.

The three-year consultant bar

Under 32 CFR 170.8(b)(17)(i)(G), CMMC ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within the previous three years. The bar applies to the firm and its people, so a C3PAO that helped you prepare in the last three years cannot assess you. Ask the C3PAO to confirm in writing that it has not advised your organization in that window.

No preparer on the assessment team

The Cyber AB states that certified CMMC assessors who took part in any capacity with an organization preparing for CMMC cannot serve on that organization's assessment team. This is broader than the firm-level bar, because it reaches individual assessors. Ask who on the proposed team has any prior involvement with your environment, including informal reviews, mock assessments and document comments.

Separate prep and assessment vendors

Keep the firm that builds controls and gathers evidence separate from the firm that certifies them. A preparation vendor is paid to make your systems ready, and an assessor is paid to test them without bias. If one firm does both, the certificate loses its independence and may be challenged later. Decide the split in writing before work starts, and record which vendor owns each deliverable.

What counts as taking part

Taking part is wider than signing the assessment report. Reviewing your system security plan, running a mock assessment, sitting in on interviews, drafting policies for you or advising on scoping can all count as preparation. Ask your prospective C3PAO to list every type of engagement its staff have had with your organization, including through a related firm, and to confirm that none fall within the rules.

Who owns controls and who issues the certificate

Your organization owns its controls, its evidence and its system security plan. A preparation partner may help configure systems and assemble documents, but it does not attest that you meet the requirements. Only the C3PAO issues the Certificate of CMMC Status, which must name the CAGE codes in scope, the C3PAO, the assessment unique identifier, the contractor and the status date and level. Confirm that the certificate will come from the assessor, not from any consultant.

What to get confirmed in writing

Before you sign, ask the C3PAO for a written conflict of interest statement that covers the three-year bar, prior involvement of each proposed assessor, the separation of any affiliated preparation firm and the Quality Assurance reviewer's independence. The contract should also include a mutual non-disclosure agreement and a statement that no fee or result is contingent on a certificate being issued, as the CAP v2.0 requires.

Which kind of partner fits which job

This table compares the three kinds of help a defense contractor can bring to a CMMC Level 2 effort: a C3PAO, a Registered Practitioner Organization or consultant, and an internal team. Read the independence column first, because it determines who can later sit on the assessment team.

Role	What it issues	Independence limits	When it fits
C3PAO (certification assessor)	The Level 2 certification assessment result and the Certificate of CMMC Status, issued through the assessment process	Assesses the organization; may not have served as its consultant for that CMMC preparation within the previous 3 years	When the organization has final evidence and needs the independent certification required for applicable contracts
RPO or consultant	No certificate or assessment report; delivers gap analyses, documents, configuration support and mock assessments	Cannot take part in the certification assessment of an organization it helped prepare	When controls, policies or the system security plan need outside expertise before an assessment
Internal team	No external report; owns controls, runs the Level 2 self-assessment and submits SPRS entries	Not independent of the organization, but accountable for the accuracy of its own scores and affirmations	When the organization runs its own readiness work and manages the day-to-day controls
DeployOpen (implementation partner)	No assessment report or certificate; prepares systems, controls and evidence in the client's environment	Sits in the preparation column; must stay clear of the assessment team for the same organization	When a self-hosted platform needs to be planned, configured and documented to produce evidence for the assessor
Who signs off the score	The organization's Affirming Official and, for certification, the C3PAO's assessment team	Only the C3PAO's assessors score a certification assessment	Confirm which party will be responsible for each claim before work starts
Verification of status	Authorized status shown on The Cyber AB Marketplace for C3PAOs; consultant credentials listed by ecosystem role	Verify the firm and the individuals before contracting	Ask any firm to show its current listing before signing an engagement
Typical contract type	Assessment fee quoted from scope, team size and hours; prep work quoted from a written scope	Keep the two contracts separate and document who does what	Use separate engagements when the same firm is considered for both preparation and assessment

Questions to ask a C3PAO before signing

A C3PAO will hold your evidence, see your environment and issue a status that your contracts may rely on. The cards below cover the questions that separate a firm you can verify and trust from one you cannot. Each card describes what a good answer sounds like, so you can judge responses against the same standard.

Authorization status and accreditation timeline

Ask the firm to show its Authorized C3PAO listing on The Cyber AB Marketplace, and check that the name and address match the contracting entity. Ask whether the firm is working toward ISO/IEC 17020:2012 accreditation and by what date, because an authorized firm must achieve that accreditation within 27 months of authorization under 32 CFR 170.9(b)(2). A good answer gives the listing, the status and a dated plan, with no vague claims of being "certified" or "approved".

Assessor credentials and team composition

Ask who will sit on the assessment team, their Certified CMMC Assessor credentials, and whether each person has a current Tier 3 background investigation or equivalent. The team must include a Lead CCA and at least one other CCA, and the firm must have a quality assurance reviewer who is not on the team. A good answer names the people, confirms their credentials on the Marketplace and states who performs quality review.

Conflict disclosures

Ask the firm to state in writing whether it, or any assessor it proposes, has consulted for your organization or any part of it on CMMC preparation in the past three years. Under 32 CFR 170.8(b)(17)(i)(G), an ecosystem member that served as your consultant may not assess you in that window. A good answer is a signed disclosure that names every prior role and confirms that no one on the proposed team helped you prepare.

Scope and sampling approach

Ask how the firm will confirm your assessment boundary, which assets it will examine directly, and how it selects samples where a population is large. Ask how it will treat external service providers and cloud environments inside your scope. A good answer describes a documented method that follows the Cyber AB assessment process, with agreed scope written into the statement of work before the kickoff and no open-ended promise to examine everything.

Handling of artifacts under the NDA

Ask what the mutual non-disclosure agreement covers, where evidence is stored, who can access it, how long it is retained and how it is destroyed. Ask whether the firm will use hashed artifacts and how it records what it reviewed. The Cyber AB Assessment Process v2.0 requires a mutual NDA, so confirm that its terms cover CUI handling and data residency. A good answer is a written data handling procedure that your security team can review before any evidence is shared.

Certificate content and status terms

Ask a sample of what the Certificate of CMMC Status will show. Under 32 CFR 170.9(b)(18), the certificate must include at least the CAGE codes in scope, the C3PAO name, the assessment unique identifier, the contractor name, and the CMMC status date and level. A good answer shows a sample certificate and confirms that the CAGE codes match your registrations, because a mismatch can delay contract use of the status.

Re-evaluation, appeals and fees

Ask how the firm handles re-evaluation after findings, the window for correcting them, the process for an appeal and who pays for a second visit. Confirm that the contract contains no guarantee of a passing result and no fee that depends on certification, since the Cyber AB process prohibits both. A good answer gives written timelines, names the appeal path and states fees as a fixed schedule in the quote.

What to put in the C3PAO contract

The contract with a C3PAO should settle the terms that protect your systems and your schedule before any assessor opens an evidence folder. Start with a mutual non-disclosure agreement, which the CMMC Assessment Process (CAP) v2.0 requires between the C3PAO and the contractor. Confirm that it covers the system security plan, network diagrams, policies and any hashed artifacts you share, and that it sets how long the C3PAO must retain assessment records. Also confirm that the C3PAO will not guarantee a result or tie its fee to a certificate being issued, because CAP v2.0 prohibits both. A firm that promises a pass is a warning sign.

Define the assessment scope in writing by the CAGE codes in scope and by asset category, and attach the list of in-scope systems, enclaves and external service providers. The certificate must name the CAGE codes covered, so an imprecise scope becomes an imprecise certificate. Name the Lead CCA and each other assessor on the team, and state how the C3PAO will replace an assessor who leaves or who has a conflict. Write the schedule as dependent on your readiness: the start date should follow confirmation that your documents and evidence are final, not drafts. Agree on who pays for a re-evaluation if the first assessment does not meet the requirements, and on the window for requesting one. Ask for the hashed artifact handling process in writing, including where hashes are stored, who holds them and how long they are kept.

Have counsel review every term before signing, and do not treat this list as legal advice. Because the Department of War suspended CMMC Phase II on 13 July 2026, a contract signed now may depend on rules that change during the engagement. Include a clause that says what happens if the required level, the assessment method or the Accreditation Body changes, including whether fees are refunded or re-priced and whether the schedule can be paused without penalty. Before signing, confirm the firm's current Authorized C3PAO status on The Cyber AB Marketplace and check the latest CMMC rules with your contracting officer, since the rule text and the official program pages may not match.

What drives the cost of a C3PAO engagement

A C3PAO certification fee follows from how much assessor time the scope needs. DoD's 2024 final rule estimated $52,056 for an other-than-small entity (5 people, 200 hours at $260.28 per hour) and $31,234 for a small entity (3 people, 120 hours), but it also said market supply and demand, not DoD, will set actual C3PAO prices. The cards below show which factors move assessor hours up or down and what to request in a written quote.

Scope size and asset count

Assessor hours grow with the number of in-scope systems, users, locations and asset categories the assessment must sample and examine. A small enclave with a few servers and a single office takes far less time than a company with several sites and many endpoints. Before you ask for quotes, finalize a System Security Plan and asset inventory so each firm prices the same boundary. Ask each C3PAO to state the team size and hours it assumed, and whether those assumptions match DoD's 2024 estimate of 5 people and 200 hours for a larger entity.

Number of enclaves

Each separate enclave that handles CUI adds boundaries, diagrams, configurations and evidence the team must review. Splitting a network into several enclaves can reduce the in-scope footprint, but every enclave still needs its own evidence. Ask the C3PAO how it will sample across enclaves, and whether a shared service such as identity or logging will be assessed once or repeated for each boundary.

Readiness of evidence

Assessors score a requirement as MET only when every applicable objective is met with evidence in final form, so drafts and missing policies extend the engagement. Organizations that arrive with final policies, a current SSP and a completed mock assessment usually need fewer clarification rounds. Ask whether the quote includes a pre-assessment review, and whether the firm charges separately for re-review of artifacts it asked you to fix.

Sampling and interviews

The number of systems, personnel and artifacts an assessment team examines depends on the assessment methods and the sample it selects. A larger, more varied population means more interviews, more screenshots and configuration reviews, and more days on site. Ask the C3PAO to describe its sampling approach in writing, how many interviews it expects, and whether remote and on-site days are priced differently.

Re-assessment and remediation windows

If a requirement is not met, the process can include a re-evaluation window, and additional assessor time to review corrected evidence. Confirm in writing how many re-evaluation rounds are included, the price of each additional round, and who pays for delays caused by the organization. Remember that a Level 2 certification is valid for three years, so ask how the firm prices the next cycle and whether it discounts a repeat assessment of an unchanged scope.

What to request in a quote

A comparable quote states the assessment scope, the CAGE codes and assets covered, team size and roles, estimated hours by phase, travel and report costs, and the re-evaluation terms. Require a statement that the firm does not guarantee a result or tie its fee to a certificate being issued, which the Cyber AB's CAP v2.0 prohibits. Make sure the mutual non-disclosure agreement is signed before you share evidence.

How the selection and engagement run

The sequence moves a defense contractor from a short list of candidate firms to a signed, scoped agreement with a C3PAO that has no conflict with its preparation work. Each step produces a written record that the next step depends on.

Verify authorization on the Marketplace
Before any conversation about price, confirm that each candidate firm appears on The Cyber AB Marketplace as an Authorized C3PAO. The Cyber AB's FAQ names this listing as the place to confirm a firm's status. Record the firm name, listing date and status in your selection file, and confirm that the assessors you expect to see are certified. Confirm that the firm you contract with is the one that will actually perform the assessment, since subcontracting arrangements should be disclosed and checked. Output: a verified shortlist with status documented.
Issue a scoped request for proposal
Send each verified firm the same written description of your environment: the CAGE codes in scope, the asset categories, enclaves, external service providers, cloud services and the systems holding CUI. Describe your current SSP, POA&M status and any specialized assets. Ask each firm to respond against that scope in writing rather than with a generic quote. Output: a request package that every candidate answers from identical facts.
Collect written scopes and proposals
Ask each firm to return a proposal that states the assessment scope it assumes, the team size and assessor certification levels, the hours it estimates, the assessment phases it covers, what it needs from you before the assessment starts, and how it will handle artifacts and evidence. Check that the scope in each proposal matches your request. Where a firm assumes a narrower or broader scope, ask it to explain why. Output: comparable written scopes from each candidate.
Compare scopes and disclosed conflicts
Compare proposals on the same scope, not on price alone. Require each firm to disclose in writing any consulting, remediation or preparation work it or its assessors have done for your organization in the previous three years. Under 32 CFR 170.8, a CMMC ecosystem member that served as your consultant may not take part in your Level 2 certification assessment. The Cyber AB says certified assessors who took part in any capacity in your preparation cannot serve on your assessment team. Output: a conflict disclosure from each firm and a shortlist of firms that can assess you.
Review the contract terms
Have counsel review the agreement against the CAP v2.0 requirements and the terms your procurement team needs. Confirm that the agreement includes a mutual non-disclosure agreement, that no guarantee of results or fee contingent on certificate issuance appears, and that the scope, deliverables, assessor roles and responsibilities are written out. Also confirm how the firm will treat CUI in its own systems and what happens if the assessment does not conclude with a certificate. Output: a marked-up agreement that reflects the agreed scope.
Sign the mutual non-disclosure agreement
Execute the mutual non-disclosure agreement before you share detailed system documentation, network diagrams, SSP drafts or evidence samples with the firm. Keep a signed copy in your compliance records. This step should happen before any substantive technical exchange, so that your sensitive information is protected during scoping and assessment planning. Output: a signed NDA on file and a controlled list of what has been shared.
Sign the agreement and hold kickoff
Sign the services agreement with the selected firm and hold a kickoff meeting. Confirm named contacts on both sides, the assessment phases and milestones, the evidence the firm will need and the dates it will need it by. Document the decisions in writing and confirm who in your organization owns each open item. Output: a signed agreement, a kickoff record and a dated list of evidence requests that starts the assessment preparation work.

Mistakes that delay or derail a C3PAO selection

Most C3PAO selection problems start before any assessor arrives: a prep vendor that later sits on the assessment team, a certificate promised for a fee, or a firm that was never verified. The cards below cover the decisions that quietly change who can assess you, what they will look at, and when the assessment can actually start.

Hiring the prep team as assessor

A consultant who helped you prepare generally cannot later serve on the assessment team for your organization. Under 32 CFR 170.8(b)(17)(i)(G), ecosystem members may not take part in a Level 2 certification assessment of an organization they consulted for within the previous 3 years, and The Cyber AB states that certified assessors who took part in any capacity with your preparation cannot sit on your team. Before signing, ask the C3PAO to confirm in writing that none of its proposed assessors helped you prepare, and ask your preparation vendor the same question about its own staff.

Buying a guaranteed certificate

The CMMC Assessment Process prohibits guarantees of results and fees contingent on a certificate being issued. A proposal that promises a pass, or ties payment to a certificate, is a warning sign about how the firm treats assessment independence. Assessors evaluate evidence against the NIST SP 800-171A objectives, and only a finished, evidenced environment can meet them. Ask for the assessment process, the fee structure and the scope of the engagement in writing, and confirm that payment is not conditional on the outcome.

Unverified C3PAO status

Not every firm that markets CMMC services is authorized to perform Level 2 certification assessments. Under 32 CFR 170.17, only a C3PAO authorized or accredited by the CMMC Accreditation Body may perform them, and The Cyber AB lists Authorized C3PAOs on its Marketplace. Check the firm's name, status and listing yourself before any contract or deposit is paid, and record the date you checked. A firm with a similar name, or one that describes itself as certified without a Marketplace listing, needs further questions.

Scope that changes after contracting

A C3PAO prices the engagement from the scope it is given, including the number of CAGE codes, the assets in scope and the external service providers involved. If the scope grows after signing, the team size, hours and timeline shift, and the quote no longer matches the work. Agree the in-scope systems, sites, enclaves and CAGE codes in writing before contracting, and state how a scope change is priced, approved and scheduled. Note that DoD's 2024 final rule estimate of $52,056 for an other-than-small entity assumed a 5-person team for 200 hours, so your own scope drives what a fair quote looks like.

Evidence not final at assessment start

Assessors score a requirement as MET only when every applicable objective is satisfied with evidence in final form, not drafts. Teams that book an assessment before policies, the system security plan, network diagrams and logs are finalized often discover that the assessment cannot proceed as planned. Use the C3PAO's pre-assessment checks as a gate: confirm which documents must be final, who signs them, and how many weeks of operating evidence the assessors will sample before you commit to a start date.

Ignoring the Phase II suspension

On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Choosing a C3PAO on a fixed date without checking the current requirement can lock you into a booking your contract does not yet need, or leave you unprepared if a contract later requires certification. Confirm with your contracting officer which level your contracts require today, and keep Phase I obligations such as SPRS postings and DFARS 252.204-7012 on your calendar regardless.

Frequently asked questions about choosing a C3PAO

Do we need a Level 2 certification from a C3PAO right now?

Not for every contract today. On 13 July 2026 the Department of War suspended CMMC Phase II, which would have required Level 2 C3PAO certification for applicable contracts, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Because the schedule is changing, confirm the current requirement in each solicitation and with your contracting officer, and check the DoW CIO About CMMC page for the latest status. Selecting a C3PAO early still makes sense if your contracts are likely to require certification later, since good assessors book out and selection takes time.

Can the same firm prepare us for CMMC and then assess us?

No. A firm or person that consulted with your organization to prepare for any CMMC assessment cannot take part in your Level 2 certification assessment. Under 32 CFR 170.8(b)(17)(i)(G), this bar lasts three years from the consulting work. The Cyber AB also states that certified assessors who took part in any capacity with an organization preparing for CMMC cannot serve on that organization's assessment team. Plan two separate firms: one to prepare your environment and evidence, and an independent C3PAO to assess it. Ask every candidate in writing whether it, or any assessor it would assign, has advised your organization.

How do we confirm that a C3PAO is authorized?

Check The Cyber AB Marketplace before you sign anything. The Cyber AB lists firms it has authorized as Authorized C3PAOs, and that listing is where you confirm status. Then verify the individual assessors your firm proposes, since assessment teams must include certified assessors. Ask the C3PAO to name its team, and record the listing details and the date you checked in your procurement file. Note that authorization is not the same as accreditation: under 32 CFR 170.9(b)(2), an authorized C3PAO has a defined period to achieve ISO/IEC 17020:2012 accreditation, so ask where the firm stands on that timeline.

What does a C3PAO certification assessment cost?

The C3PAO sets its own price, and the market sets it. DoD's 2024 final rule estimated $52,056 for an other-than-small entity (a 5-person team working 200 hours at $260.28 per hour) and $31,234 for a small entity (3 people working 120 hours). DoD also said that supply and demand, not DoD, will set C3PAO prices. The fee covers the assessment only. It does not include the cost of implementing NIST SP 800-171, consultants, scoping work, enclave changes or a re-assessment. When you request quotes, ask for the team size, hours, travel, the assessment scope in CAGE codes and assets, and what happens if a re-evaluation is needed.

How long does choosing a C3PAO take?

The length depends mainly on how large and complex your assessment scope is. A small, single-site environment with few assets is quicker to scope and quote than a multi-enclave environment with external service providers. Allow time for shortlisting from the Marketplace, requesting written scopes, checking conflict of interest statements, reviewing the contract, and agreeing dates. Ask each C3PAO for its current scheduling lead time, since assessor availability varies. Your readiness work should be far enough along that the C3PAO can start on the agreed date, because assessors check final evidence, not drafts.

Can DeployOpen act as our C3PAO?

No. DeployOpen is not a C3PAO and does not perform CMMC assessments or issue certificates. Only an authorized or accredited C3PAO can perform a Level 2 certification assessment. DeployOpen can plan, implement and harden self-hosted open-source platforms inside your own infrastructure, prepare systems and evidence for assessment, and run security testing, but it cannot assess you. Because the consultant-assessor separation applies, DeployOpen would not be eligible to assess an organization it has helped prepare.

What must our organization provide before a C3PAO can start?

Your organization must own the controls and have the evidence ready in final form. Before engaging a C3PAO, gather a defined and documented assessment scope with CAGE codes and in-scope asset inventories, a current system security plan, final policies and procedures, network diagrams, responsibility matrices for any external service providers, and evidence that each requirement is operating. Name an executive or accountable owner who can sign off, and allocate staff to answer assessor questions and demonstrate systems. Assessors test against NIST SP 800-171A objectives, so evidence drafted but never approved will not count as MET.

How DeployOpen prepares your environment for the assessor you choose

DeployOpen plans, implements, hardens and documents the self-hosted open-source platforms that hold your CMMC environment, inside your own infrastructure. We prepare systems and evidence so your chosen C3PAO can assess them, while the assessment itself stays with an independent assessor that DeployOpen does not select, staff or coach.

How we scope

We agree a written scope covering the systems, enclaves and assets your Level 2 environment includes before work starts.
Scope documents list which assets handle CUI, which are out of scope, and which external service providers are involved.
Scope and deliverables are fixed in writing, so any change to the assessor's expectations is handled through a documented change.
We confirm with your team which Level 2 requirements the environment must meet, and which items your own policies must cover.

How we build

We deploy and harden open-source platforms in your cloud accounts, data centers or air-gapped networks to meet the agreed requirements.
We configure logging, access control, encryption and configuration baselines so that the resulting evidence is produced by the systems themselves.
We test the environment against the NIST SP 800-171A objectives, so gaps are found and closed before any assessor sees the system.

How we hand over

You receive system documentation, architecture diagrams, configuration records and an evidence index mapped to each requirement.
Policies and procedures are delivered in draft for your leadership to review, approve and make final before assessment.
We run a readiness review with your team so that you can answer an assessor's questions about your own environment directly.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the assessment is complete.
Retainers can keep configuration baselines, evidence collection and the system security plan current between assessment cycles.
Confirm with DeployOpen in writing which support, upgrade and testing services are included before you sign the scope.