112CyberClearwater, FL, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
CMMC third-party assessment organizations.
Level 2 certification assessments are performed by C3PAOs authorized or accredited by the Cyber AB. Consultants who helped you prepare cannot assess you.
Share
Ad from the publisher
Find
help
help
Consultants Assessors Quotes
Matched3 quotesone form
The Shortlist is Yoursfrom this directory
Shortlist the Modern WayCMMC C3PAOs
01
Listings sourced
A card shows a public register or the date we read the firm’s website
02
Published prices where they exist
“Quote only” where we confirmed it, “Not published” where we have not
03
Up to three quotes, one form
Firms don’t see you until you choose
House ad. This slot is open to firms listed for this page.
Get help →Advertise here →
Who can do what
A CMMC Level 2 certification assessment can only be performed by a CMMC Third-Party Assessment Organization (C3PAO) authorized or accredited by the Cyber AB, the program’s accreditation body. Each C3PAO must also meet ISO/IEC 17020 within 27 months of authorization. Anyone may help a contractor prepare. Some consultants hold the Cyber AB’s Registered Practitioner Organization (RPO) designation; it is a Cyber AB program, not a requirement of the CMMC rule.
The independence rule
The CMMC rule, 32 CFR Part 170, bars anyone who consulted to prepare a company for a CMMC assessment within the previous 3 years from taking part in that company’s Level 2 certification assessment (§ 170.8(b)(17)(ii)(G)). Several C3PAOs sell preparation as well as assessments. If one firm prepared you, choose a different C3PAO for the assessment.
How this list was built
We checked each firm’s own website, and each card shows the date we read it. We list what each firm says about itself: that it is a C3PAO, an RPO, or a consultant. A listing is not a recommendation. Before you engage a firm, confirm its status on the Cyber AB’s CMMC Marketplace.
Listed in random order, reshuffled each time the page loads. Firms that pay for a listing are shown at the top, labeled Sponsored.
Firms whose websites say they are C3PAOs
We checked each firm's own website; each card shows the date. Confirm a firm's status on the Cyber AB Marketplace before you engage it. 92 listed.
123 Efficient CMMCLos Angeles, CA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website offers CMMC assessments, not preparation.
- Standards
- Pricing
- Not published
Ace of Cloud
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
Anthony TimbersHerndon, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for PCI DSS (QSA).
- Standards
- Pricing
- Not published
AprioAtlanta, GA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Says its advisory and assessment teams are separate. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for ISO 22301, ISO 27001, ISO 27701, ISO 42001 and more.
- Standards
- Pricing
- Not published
ATX DefenseAustin, TX, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
Auditwerx
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years. Its website says it also assesses for ISAE 3402, ISO 27001, PCI DSS (QSA), SOC 1 and more.
- Standards
- Pricing
- Not published
Axiotrop
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
BARR AdvisoryFairway, KS, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Says its advisory and assessment teams are separate.
- Standards
- Pricing
- Not published
BomberJacket NetworksAndover, MN, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
Booz Allen HamiltonMcLean, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
Boston Government Services
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Business Transformation Institute
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
CG Silvers ConsultingAtlanta, GA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Check AzimuthUnited States
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Cherry Bekaert
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
CISEVE
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Coalfire Federal
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for ISO 20000-1, ISO 22301, ISO 27001, ISO 27701 and more.
- Standards
- Pricing
- Not published
CohnReznick
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
CyberNINESMadison, WI, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
CyberRx
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Cybersec InvestmentsMelbourne, FL, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website offers CMMC assessments, not preparation.
- Standards
- Pricing
- Not published
CyNtellNorth Bethesda, MD, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
DataBrackets
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
DataSoftNow
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
DeMase Technical Services
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Dickman Technology Consultants (DTC)
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Digital BeachheadColorado Springs, CO, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says its assessor does not consult for a company that assessor assesses.
- Standards
- Pricing
- Not published
Dunlop Security Group
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
ecfirstWaukee, IA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Edwards Performance SolutionsColumbia, MD, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Eide BaillyFargo, ND, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Emagine IT
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
Emerald Technical SolutionsHavre de Grace, MD, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
First Information Technology Services (FITS)Arlington, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
FortreumLeesburg, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for PCI DSS (QSA).
- Standards
- Pricing
- Not published
Forvis Mazars
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it also assesses for SOC 1, SOC 2, SOC for Cybersecurity.
- Standards
- Pricing
- Not published
Gray AnalyticsHuntsville, AL, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
GuardianShield CybersecurityFrederick, MD, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
H2L Solutions
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Hive SystemsRichmond, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
IBSSSilver Spring, MD, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website offers CMMC assessments, not preparation.
- Standards
- Pricing
- Not published
Init Cyber
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
Insight Assurance
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for PCI DSS (QSA).
- Standards
- Pricing
- Not published
Integrated Quality Corporation (IQC)Chantilly, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
iPowerReston, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
IS PartnersDresher, PA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years. Its website says it also assesses for PCI DSS (QSA).
- Standards
- Pricing
- Not published
Kieri Solutions
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Kimmell CybersecurityFairlawn, OH, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
KLC Consulting
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
KNC Strategic ServicesCarlsbad, CA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Kompleye
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
Koniag Cyber Services
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
Kratos Cybersecurity
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
KTL SolutionsFrederick, MD, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Lazarus Alliance
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for PCI DSS (QSA).
- Standards
- Pricing
- Not published
Life Cycle EngineeringNorth Charleston, SC, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
Lunarline
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
MAD Security
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
ManageIT SecurityArlington, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
McKonly & Asbury
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
MNS Group
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
OSC Edge
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
Paragon Cyber SolutionsTampa, FL, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
PenacityHanover, Maryland, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
Perezdiaz
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
PKF O'Connor DaviesNew York, New York, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Says its advisory and assessment teams are separate. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
Prescient SecurityNashville, TN, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for PCI DSS (QSA).
- Standards
- Pricing
- Not published
Provincia Government SolutionsFranklin, TN, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
Ramparts
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Redspin
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
Reef Systems Security
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Regola Cyber
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
REI Systems
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
RSI Security
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
RSM USUSA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
S3 Security
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for. Its website says it also assesses for PCI ASV, PCI DSS (QSA).
- Standards
- Pricing
- Not published
Schellman
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website offers CMMC assessments, not preparation. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for PCI 3DS, PCI DSS (QSA), PCI P2PE, PCI PIN and more.
- Standards
- Pricing
- Not published
Schneider Downs
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Secure Operating SolutionsMissouri City, TX, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
SecureSoft TechnologiesGreenbelt, MD, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Sentar
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO). Its website says it also assesses for GovRAMP.
- Standards
- Pricing
- Not published
Sera-BrynnPlano, TX, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
ShellProof SecurityGreenvale, NY, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
Smithers Quality Assessments
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
SSE (Systems Service Enterprises)St. Louis, MO, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
SteelToadCatonsville, MD, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years. Also a recognized FedRAMP assessor (3PAO).
- Standards
- Pricing
- Not published
SysAudits
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
TechellenceSaddle Brook, NJ, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Its website says it will not assess a company it has consulted for.
- Standards
- Pricing
- Not published
The CMMC TeamWashington, DC, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO. Also sells CMMC preparation, so it cannot assess a company it prepared in the last 3 years.
- Standards
- Pricing
- Not published
The Governance Group
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Wise Technical Innovations (WTI)Norfolk, VA, USA
- What they do
- CMMC C3PAO (per its website)
- Which standards
- Its website says it is a CMMC C3PAO.
- Standards
- Pricing
- Not published
Need a hand implementing it?
Find a Consultant for CMMC/NIST 800-171
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff