How to Choose a C3PAO: A Real Checklist
How to pick the C3PAO that will certify you: what 'authorized' and 'accredited' really mean, what the rules require of every C3PAO, the questions worth asking, and the red flags that should end the conversation.
Nobody is going to pick your C3PAO for you. The CMMC Assessment Process is explicit that the Cyber AB, the CAICO and the Department will never “provide recommendations or facilitate introductions to any C3PAO” (CAP v2.0, footnote 5). With more than a hundred C3PAOs to choose from, most of the advice you’ll find boils down to price and availability. Both matter. Neither tells you whether the C3PAO is entitled to certify you, how it will run your assessment, or what it will do when something goes wrong.
The rules answer more of those questions than most people realize. Here’s how to use them.
Start with status: authorized, accredited, or neither
The Cyber AB Marketplace lists C3PAOs, but not everything on it can certify you. The rule says C3PAOs “must be accredited or authorized by the Accreditation Body” (32 CFR § 170.9(a)), and the CAP says any C3PAO listed as “authorized” or “accredited” is “eligible to conduct a CMMC Level 2 certification assessment” (CAP P.2).
- Can’t certify youApplicant or candidateIn the Cyber AB’s process, not yet authorized. Listed on the Marketplace, and they outnumber authorized firms about five to one.
- Can certify youAuthorizedMet every criterion except ISO/IEC 17020 accreditation, which it must reach within 27 months of authorization.
- Can certify youAccreditedAuthorized, plus ISO/IEC 17020 accreditation. Evidence of a mature quality system, not a stronger certificate.
The distinction people get wrong is between authorized and accredited. Authorized is an interim status: the C3PAO has met every criterion except ISO/IEC 17020 accreditation, and it has 27 months from its own authorization date to get there (§ 170.9(b)(2)). Both kinds can conduct assessments and issue certificates, and a certificate from one is worth exactly the same as a certificate from the other. Accreditation is evidence of a mature quality system, which is worth asking about. It isn’t a reason to rule out an authorized C3PAO.
What does rule a firm out is being neither. The Cyber AB’s own FAQ is plain: “Only Authorized C3PAOs can conduct CMMC assessments for certification.”
Check the C3PAO’s own security
You’re about to show this organization your architecture, your weaknesses and possibly your CUI. The rule requires every C3PAO to “undergo a Level 2 certification assessment” by DCMA DIBCAC (§ 170.9(b)(6)), and the Code of Professional Conduct limits assessors to IT provided by a C3PAO that has passed that assessment, with no personal devices. The CAP adds that CUI “is not shared electronically” during the assessment unless both sides are working in Level 2-conforming environments (CAP 2.7). Ask how they meet both.
Meet the team before you sign
The person who matters most is your Lead CCA. The CAP has the C3PAO “propose to the OSC the name of the Lead CCA” and screen that person for conflicts of interest (CAP P.14), and you’re asked to concur. A team must include “at least two people: a Lead CCA… and at least one other CCA” (§ 170.9(b)(12)), plus a quality assurance reviewer who “must be a CCA and cannot be a member of an Assessment Team” they review (§ 170.9(b)(13)). Everyone on it needs a Tier 3 background investigation.
So ask for names, not just headcount. Who’s our Lead CCA, how many Level 2 assessments have they led, and what happens to our dates if they become unavailable? With fewer than six Lead CCAs for every C3PAO nationally (see how many C3PAOs there are), that last question has a real answer or it doesn’t.
Independence cuts both ways
A C3PAO can’t certify an organization it helped prepare. The rule bars anyone who “previously served as a consultant to prepare the organization for any CMMC assessment within 3 years” (§ 170.8(b)(17)(ii)(G)), and the Code applies that bar to the whole C3PAO, not just the individuals. The responsibility for screening conflicts “cannot be delegated” to the team or to you (CAP P.12).
That’s why a C3PAO offering to fix your gaps is a red flag, not a convenience. It also explains what a C3PAO can offer: a formal mock assessment, run by the book, with a documented result and no advice, doesn’t create a conflict (CoPC § 3.4). A C3PAO that explains that line clearly understands its own rules. (More in what a mock assessment covers.)
Read the contract like an assessor would
The CAP requires a written agreement between you and the C3PAO, with a mutual non-disclosure agreement, and neither the Cyber AB nor DoD is a party (CAP P.17–P.19). Two things can’t be in it. The C3PAO “is prohibited from offering any ‘guarantees’ or ‘promises,’” and it may not include “any incentives or bonus payments contingent on the issuance of a Certificate” (CAP P.20).
Price deserves a second look in both directions. The Code bars a “deceptively or unrealistically low price” as well as price gouging (CoPC 2.1(d)). A quote far below the others usually means a smaller team, less time, or work that will be billed later.
Ask how the assessment will actually run
Three practical questions separate a C3PAO that has planned your assessment from one that hasn’t. Which objectives will they validate in person? The CAP lists 18, mostly physical protection, where on-site validation should be considered (CAP P.11). How will they handle your MSP and cloud providers? The CAP expects a responsibility matrix and the provider’s people “present and actively participating” (CAP 1.6). And how do they handle the 10 business days after the assessment, when a NOT MET can be re-evaluated on additional evidence?
Know the appeals route before you need it
Every C3PAO must “address all OSC appeals,” and either side can take a dispute to the Cyber AB “for final determination” (§ 170.9(b)(19)). The first appeal goes to the same C3PAO, handled by someone who wasn’t on your team, and the decision comes in writing; you can escalate to the Cyber AB within 15 business days, and its decision is final (CAP 3.23–3.28). Ask for the C3PAO’s written appeals process up front. A good one has it ready.
The one-page version
- VerifyListed as authorized or accredited on the Cyber AB MarketplaceCAP P.2
- VerifyHas had its own Level 2 assessment by DCMA DIBCAC§ 170.9(b)(6)
- VerifyWill name your Lead CCA and screen them for conflictsCAP P.14
- ProbeTeam of a Lead CCA plus at least one CCA, with a separate CCA for quality assurance§ 170.9(b)(12)–(13)
- ProbeHow it handles your MSP, your cloud providers and their peopleCAP 1.6–1.8
- ProbeWhich objectives it will validate on siteCAP P.11
- ProbeWhether it offers a formal mock, and on what termsCoPC § 3.4
- ProbeIts appeals process, in writing§ 170.9(b)(19)
- Walk awayPromises you’ll pass, or offers a money-back guaranteeCAP P.20; CoPC 2.1(e)
- Walk awayTies any fee to whether you’re certifiedCAP P.20
- Walk awayOffers to fix your gaps, sell you templates, or consult on your readiness§ 170.8(b)(17)(ii)(G); CoPC 3.3
- Walk awayQuotes a price that looks too good to be realCoPC 2.1(d)
Where we fit
1st Defense isn’t a C3PAO. Our Lead CCAs assess through partner C3PAOs, and our readiness practice is kept separate from any assessment we take part in, for exactly the independence reasons above. If you’re getting ready to choose, a readiness review is a good way to know what you’re asking a C3PAO to assess before you sign.
Sources: 32 CFR Part 170, § 170.4, § 170.8(b)(17)(ii), § 170.9; Cyber AB, CMMC Assessment Process v2.0 (December 2024), P.2, P.11–P.20, 1.6–1.8, 2.7, 3.23–3.28; Cyber AB, CMMC Code of Professional Conduct v2.0 (December 2024), §§ 2.1, 3.3 and 3.4, Appendix B; Cyber AB FAQ.