Picking the wrong CMMC assessor or adviser costs months: a consultant who later cannot assess you, a C3PAO without capacity, or a readiness firm that sells documents instead of evidence. This buyer's guide is for defence contractors choosing a Certified Third-Party Assessment Organization (C3PAO) for a Level 2 certification assessment, and a Registered Practitioner Organization (RPO) or other adviser for readiness work. It covers the rules in 32 CFR Part 170 that shape the choice, how to compare firms, the questions to ask and the warning signs. It does not repeat the standard itself: see the NIST SP 800-171 and CMMC 2.0 Guide. Status checked on the DoD CIO About CMMC page on 8 November 2026.
Key takeaways
- Timing has changed. The DoD CIO states that Phase 1 began on 10 November 2025 and is paused, and that Phase 2, planned for 10 November 2026, was suspended on 13 July 2026 while a reform task force reviews the programme. Self-assessment requirements remain in place.
- Adviser and assessor must be different firms. 32 CFR 170.8(b)(17)(ii)(G) bars any CMMC Ecosystem member from taking part in a Level 2 certification assessment of an organisation it consulted for, to prepare for any CMMC assessment, in the prior three years.
- C3PAO authorisation is regulated, RPO status is not. A C3PAO must be authorised or accredited by the Accreditation Body, pass its own DCMA DIBCAC Level 2 assessment and meet FOCI and personnel vetting rules (170.9(b)). RPO is a Cyber AB designation that Part 170 does not define.
- Buy evidence quality, not paperwork. Final status needs every requirement MET or a POA&M closed within 180 days of the Conditional status date (170.17). A readiness partner earns its fee by producing assessable evidence.
- Price is not regulated. The final rule states it does not address recovery of assessment costs, so scope the work in writing before comparing quotes.
Define requirements
Before contacting firms, settle four inputs. Without them every quote is a guess.
- Level and assessment type: confirm whether your contracts call for Level 2 self-assessment or Level 2 (C3PAO) certification. During the pause the DoD CIO says it enforces NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments, so a C3PAO assessment may be a voluntary, customer-driven or forward-looking decision.
- Scope: the CMMC Assessment Scope drives effort. Document CUI assets, Security Protection Assets, Contractor Risk Managed Assets and any enclave. See the CMMC Scoping Guide.
- Providers in scope: list cloud service providers (FedRAMP Moderate or equivalent under 170.17(c)(5)) and external service providers, whose services are assessed against Level 2 requirements and must appear in your SSP with a customer responsibility matrix (170.17(c)(6)).
- Readiness evidence: a current SSP (an assessment cannot complete without one), SPRS score, POA&M and evidence map against NIST SP 800-171A objectives.
Small versus large contractors: a small firm with a single enclave or tenant usually needs one adviser for gap closure and one C3PAO, and should favour advisers who leave it able to run evidence collection alone. A larger contractor with several business units, ESPs and CAGE codes should agree scope boundaries with the C3PAO early, consider separate assessments per scope, and keep a register of every firm that has done CMMC preparation work anywhere in the group, so the three-year conflict rule is checked before a C3PAO is engaged. In both cases decide who internally owns the relationship and the senior Affirming Official role, because affirmations continue annually after any certificate is issued.
Capability areas
The two roles need different capabilities. Keep them in separate procurements.
| Area | C3PAO (assessor) | RPO or other adviser (readiness) |
|---|---|---|
| Basis of status | Authorised or accredited by the Accreditation Body (170.9(b)(1)); ISO/IEC 17020:2012 compliance within 27 months of authorisation (170.9(b)(2)) | Cyber AB registration; consultants may hold CCP certification, and 170.13 lets CCPs give consulting advice |
| Own security | Assessed by DCMA DIBCAC at the Final Level 2 standard, with no status issued (170.9(b)(6)) | Not regulated by Part 170; ask for their own controls if they will touch CUI |
| People | Team of at least a Lead CCA and one other CCA; CCPs may join (170.9(b)(12)); Tier 3 background investigation or equivalent (170.9(b)(3)-(4)) | Experience implementing 800-171 in environments like yours (cloud tenant, enclave, OT) |
| Quality | Independent QA reviewer who is a CCA not on the team (170.9(b)(13)-(14)) | Peer review of deliverables; evidence mapped to 800-171A objectives |
| Outputs | CMMC Assessment Findings Report, eMASS upload, Certificate of CMMC Status (170.17(c)(1), 170.9(b)(18)) | Gap assessment, SSP, POA&M, remediation plan, mock assessment |
| Disputes | Handles OSC appeals, escalation to the Accreditation Body (170.9(b)(19)) | Contractual only |
Evaluation criteria
| Criterion | What good looks like | Evidence to request | Weight |
|---|---|---|---|
| Status and eligibility | Authorised C3PAO status shown on the Cyber AB Marketplace; non-disqualifying FOCI determination | Marketplace listing, written confirmation of authorisation date | Gate |
| Independence | No consulting to you, or to an affiliate acting for you, in the last three years | Signed conflict declaration covering parent and sister companies and subcontracted assessors | Gate |
| Capacity and timeline | Named Lead CCA and team, dates held in writing | Draft schedule: pre-assessment, active assessment, report delivery | High |
| Relevant experience | Assessed environments like yours (multi-tenant cloud, enclave, ESP-heavy) | Anonymised scope summaries, team CVs | High |
| Method clarity | Explains evidence sampling, interviews, testing and the 10-business-day re-evaluation window (170.17(c)(2)) | Assessment plan template | High |
| Data handling | Encrypts PII (170.9(b)(11)); clear rules for viewing CUI on your systems; artefact hashing support | Data handling procedure | Medium |
| Commercial terms | Fixed fee per scope, clear charges for POA&M closeout and rescheduling | Itemised quote | Medium |
For readiness advisers, replace the status gate with demonstrable implementation experience and add a criterion for knowledge transfer: you must be able to maintain the evidence after they leave, because affirmations are annual.
Questions to ask vendors
- Is your C3PAO status authorised today, and when did your DIBCAC assessment complete?
- Have you, a parent, subsidiary or any assessor you will use provided us with CMMC preparation consulting in the last three years?
- Who is the Lead CCA, who does QA, and will any assessors be subcontracted?
- How do you handle the pre-assessment readiness review, and what do you need from us before the active assessment starts?
- How do you assess ESP and CSP inherited controls, and what customer responsibility matrix evidence do you expect?
- What is included for a POA&M closeout assessment within 180 days, and how is it priced?
- How do you handle a requirement scored NOT MET when we can show evidence within ten business days?
- What is your appeals process, and how quickly do you respond before escalation to the Accreditation Body?
- For advisers: will your team provide CCP-certified staff, and do you also operate a C3PAO? If so, how do you keep the two apart?
- For advisers: show us an evidence map against 800-171A objectives from a past engagement, redacted.
Red flags
- "We can prepare and assess you." The three-year rule makes this impossible for the same Ecosystem member. Affiliated firms need explicit separation.
- Guaranteed pass. No firm can guarantee MET findings; scoring follows the CMMC Scoring Methodology and DIBCAC can override results (170.17(a)(1)(iv)).
- Template SSPs. Generic policies with your logo pasted in fail interviews and tests. Identity controls such as MFA and service accounts expose this fastest: see the Defence Industrial Base Identity Security Guide.
- Vague scope pricing. A quote with no asset counts, locations or ESPs listed will change later.
- Candidate status sold as authorised. Check the Marketplace yourself.
- Urgency selling. Claims that certification is required by a date that contradicts the DoD CIO status page.
Proof of concept
You cannot trial an assessment, but you can test a firm before committing.
- Verify status and independence first: Marketplace listing, signed conflict declaration, named team.
- Run a paid readiness review or mock assessment with your adviser against 800-171A objectives, then fix gaps before booking a C3PAO.
- Ask two shortlisted C3PAOs to review your scope documents and give a written schedule and fee. Compare their questions: good assessors ask about ESPs, enclaves and asset categories.
- Confirm logistics: on-site versus remote, CUI viewing rules, artefact hashing and the six-year retention you must keep (170.17(c)(4)).
- Agree contract terms for rescheduling, closeout, appeals and confidentiality before the active assessment.
- After the assessment, check the eMASS record details against the Findings Report and certificate. See the CMMC 2.0 Level 2 Assessment Guide.
How NHI Mgmt Group can help
We provide independent identity security advisory and evaluation support, including CMMC identity and non-human identity readiness. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: NIST SP 800-171 and CMMC 2.0 Guide · CMMC Certified Professional and Assessor (CCP, CCA) Guide · NIST SP 800-171A Rev 3 Assessment Guide · DFARS 252.204-7012 Guide. This guide summarises 32 CFR Part 170 and DoD CIO programme status and is not legal advice.