Written and maintained by CASRAI Editorial Board
Last updated
A C3PAO, short for CMMC Third-Party Assessment Organization, is the kind of organization that performs CMMC Level 2 certification assessments for a company that handles controlled unclassified information (CUI) for the Department of Defense. A C3PAO is not self-declared: it has to be authorized, and later accredited, by the program’s Accreditation Body. This guide covers the C3PAO as an organization (who authorizes it, what the rule requires of it, and what that means when you engage one). It does not repeat the self-assessment versus C3PAO comparison already set out in our CMMC Level 2 assessment guide. Everything below is as described in 32 CFR 170.8 and 170.9 and in the Federal Register final rule, as checked on 2026-10-29.
What a C3PAO is and who runs the program
The final rule describes C3PAOs as “the organizations that perform CMMC Level 2 certification assessments” for organizations seeking certification (OSCs). The rule creates a single body to oversee them: 32 CFR 170.8 says the Accreditation Body is responsible for authorizing and ensuring the accreditation of C3PAOs, and that “at any given point in time, there will be only one Accreditation Body for the DoD CMMC Program.” The Accreditation Body establishes the C3PAO authorization requirements and the C3PAO Accreditation Scheme, and submits both to the CMMC Program Management Office (PMO) for approval.
The rule also sets conditions on the Accreditation Body itself. It must be US-based, remain in good standing with the Inter-American Accreditation Cooperation (IAAC), and become a signatory to the International Laboratory Accreditation Cooperation (ILAC) Mutual Recognition Arrangement with a scope covering ISO/IEC 17020:2012(E). The Federal Register preamble summarizes its primary mission as authorizing and accrediting C3PAOs.
Eligibility: when a C3PAO is the assessor
An organization does not choose a C3PAO on its own initiative; the contract sets the assessment type. A C3PAO performs the Level 2 certification assessment where a solicitation requires Level 2 (C3PAO). Level 1 is a self-assessment (see CMMC Level 1 self-assessment), and Level 3 is assessed by the government’s DIBCAC rather than a C3PAO (see CMMC Level 3). Universities and research institutions should read the scoping questions in our CMMC guide for research institutions first.
Authorized versus accredited: the distinction that matters
32 CFR 170.9(a) says C3PAOs “must be accredited or authorized by the Accreditation Body.” The two words are not interchangeable. Under 170.8, before the Accreditation Body is fully operating its accreditation scheme, it authorizes C3PAOs that meet all of the requirements in 170.9, plus administrative requirements it sets, to conduct Level 2 certification assessments and issue Certificates of CMMC Status. Authorized C3PAOs must then achieve and maintain compliance with ISO/IEC 17020:2012(E) within 27 months of authorization. The final rule puts it this way: before a C3PAO is compliant with that standard, it “may be authorized but not accredited”; once compliant, it “may be accredited.”
In practice this means an authorized C3PAO and an accredited C3PAO can both lawfully perform Level 2 assessments, and the difference is where each sits on the path to ISO/IEC 17020 compliance.
What a C3PAO must meet
32 CFR 170.9(b) lists the obligations of the organization. The ones that bear most directly on your assessment are below.
| Requirement | What 32 CFR 170.9 says |
|---|---|
| Authorization or accreditation | Obtain it from the Accreditation Body under 170.8(b)(3)(i) and (ii). |
| ISO/IEC 17020:2012(E) | Achieve and maintain compliance within 27 months of authorization. |
| Personnel vetting | Personnel involved in the Level 2 certification assessment must complete a Tier 3 background investigation. |
| Team composition | The Assessment Team has at least two people: a Lead CMMC Certified Assessor (CCA) and at least one other CCA. |
| Independent quality assurance | The quality assurance individual must be a CCA and must not be on the team being reviewed. |
| Conduct | Comply with the Accreditation Body’s policies on conflict of interest, code of professional conduct and ethics. |
| Records | Retain assessment-related records for six years unless the CMMC PMO authorizes otherwise. |
| Audit access | Provide requested information to the Accreditation Body, including out-of-cycle requests. |
For the individual credentials behind these roles, see our guide to the Certified CMMC Professional (CCP).
Steps to engage a C3PAO
- Confirm from the solicitation or contract that Level 2 (C3PAO) is required, and define the assessment scope with the CMMC scoping guide.
- Prepare for the assessment against the 110 NIST SP 800-171 requirements and record your score in SPRS.
- Select a C3PAO. The final rule notes that organizations seeking assessment “can shop for C3PAOs on the CMMC Accreditation Body (AB) Marketplace.”
- The C3PAO conducts the certification assessment under 32 CFR 170.17, with results entered in eMASS by the C3PAO and transmitted to SPRS, as described in our Level 2 assessment guide.
Typical timeline phases
The rule defines phases for the C3PAO itself rather than a calendar for your assessment:
- Authorization. The Accreditation Body authorizes an organization that meets 32 CFR 170.9 and its own administrative requirements.
- Path to ISO/IEC 17020 compliance. Up to 27 months from authorization to achieve and maintain compliance.
- Accreditation. Once compliant, the C3PAO may be accredited.
- Ongoing duties. Six-year record retention and audit cooperation continue throughout.
Common mistakes
- Treating authorized and accredited as the same status. The rule treats them as different stages.
- Assuming every CMMC level uses a C3PAO. C3PAOs perform Level 2 certification assessments; Level 1 is self-assessed and Level 3 is assessed by DIBCAC.
Related programs
| Program element | Role relative to the C3PAO |
|---|---|
| Accreditation Body | Authorizes and accredits C3PAOs (32 CFR 170.8). |
| CMMC PMO | Approves the authorization requirements and accreditation scheme; may authorize exceptions to record retention. |
| Level 1 self-assessment | No C3PAO involved. See Level 1 guide. |
| Level 3 | Assessed by DIBCAC, not a C3PAO. See Level 3 guide. |
| SPRS and eMASS | Level 2 (C3PAO) results are entered in eMASS by the C3PAO and transmitted to SPRS. |
Frequently asked questions
What does C3PAO stand for?
CMMC Third-Party Assessment Organization.
Who authorizes a C3PAO?
The single Accreditation Body for the CMMC Program, under 32 CFR 170.8. It authorizes C3PAOs first and accredits them to ISO/IEC 17020:2012(E) once they comply.
Can a C3PAO be authorized but not accredited?
Yes. The final rule says that before a C3PAO is compliant with ISO/IEC 17020:2012(E) it may be authorized but not accredited, with 27 months from authorization to achieve compliance.
How many people are on a C3PAO assessment team?
At least two: a Lead CCA and at least one other CCA, under 32 CFR 170.9.
Where do I find a C3PAO?
The final rule says organizations can shop for C3PAOs on the CMMC Accreditation Body Marketplace.
Sources
- 32 CFR 170.8, Accreditation Body: https://www.law.cornell.edu/cfr/text/32/170.8 (checked 2026-10-29).
- 32 CFR 170.9, CMMC Third-Party Assessment Organization (C3PAO) requirements: https://www.law.cornell.edu/cfr/text/32/170.9 (checked 2026-10-29).
- Cybersecurity Maturity Model Certification (CMMC) Program, final rule (FR Doc. 2024-22905), published 2024-10-15: https://www.govinfo.gov/content/pkg/FR-2024-10-15/html/2024-22905.htm (checked 2026-10-29).
Programs change; the statements above are as described in the regulation text and final rule on 2026-10-29.
