CMMC Certification and C3PAO Assessments

What CMMC certification is, and who can issue it

CMMC certification is the Level 2 (C3PAO) or Level 3 (DIBCAC) status a contractor earns from an outside assessment; Level 1 and Level 2 (Self) are self-assessments, not certifications ⁵⁷. Only authorized C3PAOs can conduct CMMC certification assessments at Level 2 ¹. Level 3 assessments are done by the government's DCMA DIBCAC, not by C3PAOs ⁷.

The CMMC ecosystem has three groups worth knowing:

• The Cyber AB, the accreditation body that authorizes C3PAOs and runs the CMMC Marketplace ¹.
• C3PAOs, which employ Certified CMMC Professionals (CCPs) and Certified CMMC Assessors (CCAs) to perform assessments ⁶.
• Registered Practitioners and RPOs, consultants who help companies prepare but do not conduct certified assessments ⁸. Our CMMC compliance services guide covers them.

There are more than 100 authorized C3PAOs, based on the Cyber AB's September 2026 town hall data and an independent snapshot of the Marketplace in July 2026 ²⁹. The number changes as firms are added or drop out, so use the live Cyber AB Marketplace as your C3PAO list rather than any published count.

C3PAO requirements while Phase 2 is paused

Right now no new DoD contract can require a C3PAO assessment. On July 13, 2026 DoD suspended Phase 2, which would have made Level 2 (C3PAO) a condition of award on November 10, 2026 ³. The implementing memo says contracting officers may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) during the review, that those requirements are to be removed from existing contracts by modification, and that no waivers will be granted ⁴. A September 2026 class deviation kept that instruction in contracting rules, as reported by Washington Technology ¹⁰.

DoD gave two reasons: compliance costs and the number of available assessors, which it said was not large enough to finish evaluations before the November deadline ¹¹. When the rule was written, DoD projected 135 C3PAO assessments in year one, rising to 4,452 in year four ¹².

Many companies already hold C3PAO certification: the Cyber AB reported 2,362 Final Level 2 certificates as of September 29, 2026, according to a tracker of its town hall data ². Some companies pursue certification anyway because a prime asks for it or because they expect the requirement to return. Whether that is worth it now depends on your contracts. The schedule may change; check the DoD CIO CMMC page for current status ³.

How a CMMC assessment works

A Level 2 certification assessment checks each of the 110 NIST SP 800-171 Rev 2 requirements against its assessment objectives and scores the result ⁵¹³. The assessment procedures come from NIST SP 800-171A, which uses three methods: examining documents and settings, interviewing staff, and testing how systems behave ¹⁴.

What the rule sets out:

• Who performs it. An authorized or accredited C3PAO ⁵.
• Scoring. Each NOT MET requirement subtracts 5, 3 or 1 points from 110 ¹³.
• Final vs Conditional. If every requirement is MET, you get Final Level 2 (C3PAO) status. If your score is at least 88 and only allowed 1-point items are open, you can get Conditional status with a POA&M ¹⁵.
• Closeout. Open items must be closed and confirmed by a closeout assessment within 180 days, or the Conditional status expires ¹⁵.
• Records and affirmation. Results go into CMMC eMASS, the status lasts three years, and a senior official affirms at assessment and every year ⁵¹⁶.

The details of the 110 requirements and the POA&M limits are on our CMMC Level 2 page.

CMMC assessment guide and scoping guide

DoD publishes an assessment guide and a scoping guide for each level on the DoD CIO site, and those are the documents your assessor will work from. The Level 2 Scoping Guide (Version 2.13, September 2024) sorts assets into five categories ¹⁷:

• CUI Assets, assessed against all Level 2 requirements.
• Security Protection Assets, such as firewalls, identity systems and log servers, assessed against the requirements relevant to what they do.
• Contractor Risk Managed Assets, documented in the system security plan but not required to be separated from CUI assets.
• Specialized Assets, such as IoT, operational technology, government-furnished equipment and test equipment, documented but not assessed against other requirements.
• Out-of-Scope Assets, which must be physically or logically separated from CUI assets.

These categories also appear in the rule at 32 CFR 170.19 ¹⁸. Scope drives both effort and price. A company that puts all CUI into a separated enclave can keep most of its network out of scope; our GCC High and enclave guide explains how. If you use an outside provider such as an MSP or cloud service, the rule requires its role to be documented in your system security plan with a service description and a customer responsibility matrix ¹⁸.

How to choose a C3PAO

Choose a C3PAO the way you would choose an auditor: for independence, availability and fit, not for promises about the outcome. Start with the Cyber AB Marketplace, which lists authorized C3PAOs ¹.

Questions to ask:

• Are you authorized now, and who will be on my assessment team? Ask for the CCAs and CCPs assigned.
• Did your firm or anyone on the team help us prepare? 32 CFR 170.8 requires the Cyber AB's code of professional conduct to bar CMMC ecosystem members from taking part in a Level 2 certification assessment of a company they helped prepare within the previous three years ¹⁹. Your consultant and your assessor must be different.
• What is your experience with companies like us, such as our size, our cloud setup, or manufacturing floors with specialized assets?
• What do you need from us before the assessment, and how do you handle the POA&M closeout?
• How do you price, and what is included if a closeout assessment is needed?

DoD's regulatory impact analysis estimated a small entity's cost to support a Level 2 C3PAO assessment and affirmation at $101,752 ²⁰. That is a DoD planning estimate, not a market quote, and it does not include the cost of fixing gaps ²¹. For what drives that number, see CMMC cost.

CMMC readiness before you book an assessment

Be ready before you book, because the POA&M rules leave little room for gaps found on assessment day. A readiness check should confirm ¹⁵:

• A complete, current system security plan, which can never be on a POA&M.
• A self-assessed score close to 110, with no 5-point or 3-point items open.
• Evidence gathered for each requirement and objective.
• Physical controls for visitors, logs and access devices fully in place, since those cannot be deferred.
• Outside providers documented with a customer responsibility matrix ¹⁸.

Most companies get a readiness or gap assessment from a consultant or RPO first. What that should deliver is covered in our CMMC compliance services guide, and the underlying requirements are in our NIST 800-171 guide. For the overall program and timeline, see the CMMC overview.