What Does an RPO Referral Partnership Actually Look Like?
For RPOs and MSPs whose clients are being asked for CMMC: what an RPO is and isn't, how a referral partnership splits the work, the Code of Conduct rules both partners carry, and what changes when the client is ready for certification.
Sooner or later, a client asks the question. A prime has sent a CMMC flow-down, or a contracting officer wants an SPRS score, and the client turns to the people who already run their IT: “Can you get us through this?”
For a Registered Practitioner Organization (RPO) or an MSP, there are three answers. Build the full CMMC capability yourself, say “that’s not what we do,” or bring in a partner. The first takes time and credentials. The second invites a competitor to answer for you. This post is about the third: what a referral partnership actually involves, what the rules say about it, and where its lines sit.
What an RPO is, and isn’t
An RPO is a Cyber AB designation, not a role in the CMMC regulation. The Cyber AB describes RPOs as organizations that deliver “a non-certified advisory service through the employment of RPs” and “do not conduct Certified CMMC Assessments” (Cyber AB, Ecosystem Roles). To become one, an organization associates at least one Registered Practitioner (RP), passes an organizational background check, signs the Code of Professional Conduct and an RPO agreement, and is then listed on the CMMC Marketplace.
RPs, in the Cyber AB’s words, “provide CMMC implementation consulting services… to assist in identifying gaps and providing mitigation strategies.” That’s real, useful work. Two things are worth being clear about with clients, though:
- Nobody is required to hire an RPO. 32 CFR Part 170 never mentions Registered Practitioners; the only reference is a commenter in the rule’s preamble (89 FR 83163). An organization can prepare with its own staff, an MSP, an RPO, or a readiness firm.
- An RPO can’t certify anyone. Level 2 certification assessments are conducted by authorized or accredited C3PAOs, with assessors working “only under the direct employment or contract” of one (CMMC Code of Professional Conduct v2.0, Appendix B.1(a)).
So the RPO’s natural place is on the client’s side of the table: preparing them, and staying with them through the assessment.
How a referral partnership splits the work
The point of a referral partnership is that each partner does what it’s best at, and the client sees one coordinated effort rather than two firms competing for the same work. On our side, that means a clear lane split agreed up front: the RPO or MSP keeps the client relationship and the IT work, and we bring assessor-grade CMMC readiness. Here’s how that typically maps onto a client’s path to a Level 2 assessment:
The thread doesn’t break. The client stays yours at every stage, including the assessment, where you can be their point of contact.
The specifics vary by partner. Some RPOs already have strong RPs and want assessor eyes only for the mock. Some MSPs want help from the first scoping call. What matters is that the boundaries are written down before anyone talks to a client, because a lane that’s decided mid-engagement is a lane someone feels pushed out of.
What goes in the agreement
A partnership agreement doesn’t need to be long, but it should settle five things:
Who owns the relationship. Who the client calls, who leads meetings, and who sends what. In our model that’s the RPO or MSP, every time.
Who delivers what. Scoping, the gap assessment, the SSP, policy writing, technical remediation, the mock. Named, not implied, so nothing gets done twice and nothing falls between you.
How findings flow. When a gap assessment turns up an MSP-managed control that isn’t working, the finding goes to the partner first, not straight to the client. Nobody should learn about a problem with their own work from a slide in a client meeting.
How client information is handled. The Code’s confidentiality duty continues “even after the work has ended” (CoPC § 2.3(b)), and it prohibits “providing customer data to an Internet-accessible AI application” (§ 2.8(c)). Agree how files move between the two firms, and who can see them.
What happens at certification. Who helps the client choose a C3PAO, and the fact that anyone who helped prepare the client can’t be on its assessment team. More on that below.
The rules both partners carry
RPOs, RPs, assessors and C3PAOs are all bound by the same Code of Professional Conduct (CoPC § 1.2), and a few of its rules shape any partnership directly.
- No guarantees. Members forgo “making guarantees of assessment or certification results” (§ 2.1(e)), including the implied version: that a client will succeed because it hired a credentialed partner.
- No borrowed status. The Cyber AB lets an RPO represent itself as “familiar with the basic constructs of the CMMC Standard” with its RPO logo. The Code bars using Cyber AB marks to represent an authorization, accreditation or certification status you don’t hold (§ 2.4(e)).
- Clear roles. Members maintain “clear boundaries between roles (e.g., assessor, instructor, practitioner)” (§ 2.2(h)). When a partner’s people wear more than one hat, the client should always know which one is on.
The Code has no clause about referral fees. What it has is the general rule: avoid any arrangement “that could result in an actual or perceived conflict of interest” (§ 2.2(c)). Any money that moves between partners because of a client should be measured against that, and the client should know about it.
When the client is ready for certification
This is where a referral partnership earns its keep, and where it has to be most careful. The CMMC rule bars anyone who “previously served as a consultant to prepare the organization for any CMMC assessment within 3 years” from that organization’s certification assessment (32 CFR § 170.8(b)(17)(ii)(G)). That covers the RPs who prepared the client and the CCAs who ran the gap assessment and mock. It’s why the client needs a C3PAO, and a team, with no advisory history with them. We explain the rule in full in why the team that prepares you can’t certify you.
What doesn’t change is the relationship. The CMMC Assessment Process says the organization’s point of contact for the assessment “could be a contractor, consultant, or advisor, such as a CMMC Registered Practitioner (RP).” The RPO that prepared the client can sit beside them through the assessment. And when it’s time to pick the C3PAO, our checklist for choosing one is written for the client, which makes it easy to hand over.
If you’re the MSP, you may be in scope too
An MSP that manages a client’s security tools or systems often handles Security Protection Data, and its services sit inside the client’s assessment scope even when the MSP itself doesn’t need a certificate. That’s worth knowing before the gap assessment, not during it. We covered it in Is my MSP CMMC compliant? and in the MSP shared responsibility matrix.
Refer now, build the bench as you go
A referral partnership doesn’t have to be permanent, and it doesn’t have to be the only track. A partner can refer its first clients while getting its own people credentialed, so the in-house capability grows alongside the partnership. Our CCP and CCA courses are taught live by instructors who assess for a living, which suits technicians who need to understand what an assessor will look for in the environments they run.
Partner with us, build the expertise in-house, or both. If your clients are starting to ask, see how our partnerships work.
Sources: Cyber AB, Ecosystem Roles and Consulting and Implementation pages (checked October 2026); Cyber AB, CMMC Code of Professional Conduct v2.0 (December 2024), §§ 1.2, 2.1(e), 2.2(c) and (h), 2.3(b), 2.4(e), 2.8(c) and Appendix B.1(a); Cyber AB, CMMC Assessment Process v2.0 (December 2024), definition of the OSC point of contact; 32 CFR Part 170, § 170.8(b)(17)(ii)(G); 89 FR 83092 (October 15, 2024), preamble at 83163.