C3PAOs and the Cyber AB

The Cyber AB

The Cyber AB is the trade name of the Cybersecurity Maturity Model Certification Accreditation Body, Inc., a Maryland nonprofit founded in January 2020. It works under a no-cost contract. Under 32 CFR 170.8, the accreditation body must be U.S.-based and must work toward compliance with ISO/IEC 17011, the standard for accreditation bodies.

The Cyber AB authorizes and later accredits C3PAOs to ISO/IEC 17020. A separate organization, the CMMC Assessor and Instructor Certification Organization (CAICO), trains and certifies the individual assessors and instructors.

What a C3PAO does

A CMMC Third-Party Assessment Organization (C3PAO) performs Level 2 certification assessments. That's its only job. Its assessment team is led by a Lead CMMC Certified Assessor and uses the NIST SP 800-171A procedures and the DoD's CMMC assessment guides. The C3PAO uploads results to the Department's CMMC eMASS system, which feeds the status to SPRS, and issues a certificate of CMMC status.

Vetting comes first. The Cyber AB screens applicants, including a Dun and Bradstreet risk review and a foreign ownership, control, or influence analysis that looks at who owns and directs the company. DIBCAC then assesses the C3PAO's own systems at Level 2. Personnel must meet background check requirements set in the rule.

Other roles in the program

Several roles appear in the CMMC Marketplace. They differ in what they're allowed to do.

• C3PAO: performs Level 2 certification assessments
• Certified CMMC Assessor (CCA): conducts assessments for a C3PAO
• Lead CCA: leads a C3PAO assessment team
• Certified CMMC Professional (CCP): supports assessments and readiness work
• Registered Practitioner and Registered Practitioner Organization: offer advice and readiness help, not assessments
• Approved Training Provider: delivers CAICO-approved courses

Scale of the program

In its July 15, 2026 statement, the Cyber AB reported 110 authorized C3PAOs, more than 1,000 Certified CMMC Assessors, more than 2,000 Certified CMMC Professionals, about 400 Registered Practitioner Organizations, 52 approved training providers, and nearly 2,000 contractors with a final Level 2 certification. It also confirmed that C3PAO Level 2 assessments continue during the Phase 2 suspension.

Demand for assessments dropped once Phase 2 was paused. Some primes still ask key subcontractors for a C3PAO certificate, though, and the Cyber AB argues a certificate helps with prime contractor reviews and False Claims Act risk.

Choosing and working with a C3PAO

The CMMC Marketplace on the Cyber AB site lists authorized C3PAOs, assessors, and practitioners. Check it before signing. Under 32 CFR 170.8, anyone who served as a consultant preparing a company for a CMMC assessment can't take part in that company's Level 2 certification assessment within 3 years.

Plan for the full timeline. Most companies need months of preparation, a readiness review, and then the assessment itself, which ends with a certificate valid for 3 years if all requirements are met or a conditional status if a POA&M is allowed. Ask for a written scope, a fixed price, and a clear statement of what evidence the team will want to see. Book early. When the Department sets a new Phase 2 date, demand for assessor time is likely to rise quickly, and the number of certified assessors grows slowly because each one must complete CAICO training, pass exams, and clear background checks.

References

1. The Cyber AB, The Cyber AB
2. CMMC Marketplace, The Cyber AB
3. Statement on the Department of War's suspension of CMMC Phase II requirements, The Cyber AB
4. 32 CFR part 170, CMMC Program, Electronic Code of Federal Regulations

General information, reviewed 2026-10-11. Not legal advice.