What Is C3PAO (CMMC Third-Party Assessment Organization)?

A C3PAO is an independent assessment firm authorized within the CMMC ecosystem, accredited through the CMMC Accreditation Body (the Cyber AB), to perform Level 2 certification assessments. In a certification assessment, the C3PAO's certified assessors examine evidence, interview staff, and test controls to verify that a contractor has implemented the 110 requirements of NIST SP 800-171 within its defined assessment scope. A passing assessment results in a CMMC status recorded in DoD systems; a conditional status is possible when remaining gaps are limited to requirements eligible for a POA&M.

C3PAO assessments matter to contractors whose contracts specify CMMC Level 2 with a certification assessment rather than a self-assessment, which the DoD has indicated will cover much of the CUI-handling supply chain over the program's phase-in.

The current status is important to state precisely. In July 2026, DoD memoranda suspended Phase 2, the phase that would have made C3PAO certification assessments a condition of new awards, pending a Reform Task Force review of the program. Phase 1 obligations continue unchanged. The prudent posture is to treat the suspension as schedule relief, not requirement relief: the underlying NIST SP 800-171 obligations under DFARS 252.204-7012 never paused. See CMMC Level 2 requirements for small business for what an assessment-ready posture looks like.