ResourcesGlossary
What is C3PAO?
A C3PAO is an organization authorized by the Cyber AB to conduct official CMMC Level 2 certification assessments.
C3PAO stands for CMMC Third-Party Assessment Organization.
A CMMC Third-Party Assessment Organization (C3PAO) is the entity that performs your formal Level 2 assessment and issues certification. C3PAOs are authorized and listed on the Cyber AB Marketplace.
C3PAOs continue to conduct authorized Level 2 assessments, but the Department suspended the Phase II transition and future implementation milestones on July 13, 2026. Organizations should schedule against actual contract and flow-down requirements rather than the former November deadline.
A C3PAO cannot both consult for and assess the same client within a defined window, which is why readiness partners (RPOs) and assessors work as separate roles in the ecosystem.
Related records
Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.
- proof.state
- Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- proof.change
- Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
- proof.agency
- Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- architecture
- Architecture. How the chain is built and where the evidence is stored in each delivery mode.
- authorization
- Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
- baseline
- NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.
Related terms and reading
Know the term. Then see the record behind it.
- Published
- Last updated