Contractors meet two kinds of CMMC firm, and the acronyms make them easy to mix up. The short version: you hire an RPO to prepare and a C3PAO to be assessed. If you want the longer background on the advisory side first, read What is a CMMC RPO? For the program as a whole, see the CMMC hub.
Side-by-side comparison
| RPO | C3PAO | |
|---|---|---|
| Full name | Registered Provider Organization | CMMC Third-Party Assessment Organization |
| Role | Advises, prepares, remediates, documents | Conducts the official third-party assessment |
| Authorized by | Registered with the Cyber AB | Authorized by the Cyber AB |
| People | Registered Practitioners (RP) and RP Advanced (RPA) | Assessors (CCAs) and professionals (CCPs) on the assessment team |
| Deliverables | Gap report, roadmap, SSP, policies, POA&M, SPRS support | Assessment results recorded for DoW, which determine CMMC status |
| When you need it | Before any assessment, and between cycles | Only when a contract or prime calls for a third-party assessment |
The most important row is the role. An RPO can tell you what an assessor will look for and help you build it. Only an authorized assessment organization can produce an official third-party result, and an RPO does not certify anyone.
Why one firm should not do both
The CMMC program rule, 32 CFR Part 170, includes conflict-of-interest requirements for the assessment ecosystem. In plain terms, an assessor may not grade work that it, or its own organization, helped design or implement. That is why a contractor normally uses one firm to prepare and a separate, independent organization for any third-party assessment. If a provider offers to do both for you, ask how it keeps them separate and expect a clear answer. The rule text is on ecfr.gov.
The other players you will hear about
- RP (Registered Practitioner). An individual registered with the Cyber AB to give CMMC advice. An RP is a consultant and does not certify anyone.
- RPA (Registered Practitioner Advanced). A registered practitioner with additional training and vetting for more complex advisory work.
- CCP and CCA. Credentialed people who serve on assessment teams; a CCA can lead or perform assessments for an authorized assessment organization. Galaxy has no CCP or CCA credentials and does not need them for advisory work.
- DIBCAC. The Defense Industrial Base Cybersecurity Assessment Center, the government team that conducts Level 3 assessments and DoD Medium and High NIST SP 800-171 assessments.
- The Cyber AB. The accreditation body for the ecosystem. It authorizes C3PAOs and registers RPOs and RPs. It does not set CMMC policy.
- DoW CIO. The Department of War (formerly DoD) runs the CMMC program through its Chief Information Officer. Official program material is on dodcio.defense.gov.
How to check the Cyber AB Marketplace
- Go to cyberab.org and open the Marketplace.
- Search by company name and confirm the listing type: RPO, C3PAO, or both.
- For an RPO, check the Registered Practitioners listed with it and confirm the person you will work with is one of them.
- For an assessment organization, confirm its authorization is current before you schedule.
- Compare the name, address and contact details with the proposal you received.
How to choose an RPO
Questions worth asking before you sign:
- Who is the Registered Practitioner on my engagement, and can I see their Marketplace listing?
- How will you define my CUI boundary, and would an enclave make sense for a company my size?
- What exactly do I receive at the end of the gap assessment, and how long does it take?
- Will you write the SSP and POA&M, or only review mine?
- Do you work with my existing IT provider or require your own tools?
- How do you handle the annual SPRS affirmation between assessment cycles?
Be wary of any firm that promises an outcome. Your company makes the affirmation in SPRS and owns the result; an advisor prepares you for it.
How the Phase 2 suspension changes timing
On July 13, 2026 the Department of War suspended the move to Phase 2, which had been due November 10, 2026. While the suspension is in place, program offices may not require Level 2 (C3PAO) or Level 3 in new requirements, and new solicitations may only call for Level 1 (Self) or Level 2 (Self). Voluntary C3PAO assessments remain available, and DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply. A CMMC Reform Task Force is reviewing the program. See the suspension explainer for detail.
What that means in practice
For now most contractors need readiness help and a sound self-assessment more than an assessor. That is RPO work. If a prime asks you for a voluntary third-party assessment, prepare first and then book an independent C3PAO. The CMMC assessment checklist shows what to have ready either way.
Where Galaxy fits
Galaxy Consulting, LLC is a Cyber-AB Registered Provider Organization with one Registered Practitioner on staff and a Service-Disabled Veteran-Owned Small Business. Galaxy is not a C3PAO, does not conduct official assessments and does not certify anyone. It prepares you: scope and level determination, gap assessments against the 17 Level 1 or 110 Level 2 practices, remediation, documentation, and self-assessment and SPRS affirmation support. Galaxy has affirmed its own Level 1 and Level 2 self-assessments in SPRS. See CMMC services, read the CMMC FAQ, or book a free discovery call.
Frequently asked questions
What is the difference between a C3PAO and an RPO?
An RPO (Registered Provider Organization) is a consulting firm registered with the Cyber AB to advise and prepare contractors for CMMC. A C3PAO (CMMC Third-Party Assessment Organization) is authorized by the Cyber AB to conduct official CMMC assessments. An RPO does not assess or certify anyone.
Can the same company be my RPO and my C3PAO?
Not for the same engagement. CMMC conflict-of-interest rules keep an assessor from assessing work it helped build. If a firm offers both kinds of service, the consulting and the assessment for your company must come from separate, independent providers.
Do I need a C3PAO right now?
Probably not for new contracts. Since the Department of War suspended the move to Phase 2 on July 13, 2026, new requirements may only call for Level 1 (Self) or Level 2 (Self), and program offices may not require a third-party assessment. Voluntary C3PAO assessments are still available if a prime asks for one.
Do I need an RPO at all?
No rule requires one. Some contractors complete the work with their own staff. Many small companies use an RPO because it is faster to have someone who knows the 110 requirements map the gaps, write the documentation and support the self-assessment.
How do I check that a firm is really an RPO or C3PAO?
Look it up in the Cyber AB Marketplace on cyberab.org. Every RPO, C3PAO, Registered Practitioner and assessor is listed there with its current status. If you cannot find the firm, ask why before you sign.
Is Galaxy Consulting a C3PAO?
No. Galaxy Consulting is a Cyber-AB Registered Provider Organization with one Registered Practitioner on staff. It does readiness, gap assessments, remediation, documentation and self-assessment support. It does not conduct official assessments and does not certify anyone.
Related CMMC pages
- What is a CMMC RPO?
- Galaxy CMMC readiness services
- CMMC Level 2 requirements
- CMMC Level 2 assessment cost
- The Phase 2 suspension explained
Talk it through with a Registered Practitioner
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO) in Fort Washington, Maryland. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.