What a CMMC RPO is
CMMC, the Cybersecurity Maturity Model Certification, is the Department of War (formerly DoD) program that checks whether contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program rule is 32 CFR Part 170. Around it sits an ecosystem of organizations and people registered, authorized or certified by the Cyber AB, the program’s accreditation body.
A Registered Provider Organization is the advisory side of that ecosystem. To be listed, a firm registers with the Cyber AB and agrees to its Code of Professional Conduct, which bars RPOs and their practitioners from misrepresenting their status. The RPO then appears in the Cyber AB Marketplace with an organization key, so buyers can check it.
RPO status describes what the firm is allowed to do for clients. It does not say anything about the firm’s own systems: an RPO is not “CMMC certified” just because it is an RPO.
RPO vs C3PAO vs Registered Practitioner
The acronyms are easy to mix up. This is who does what:
| Role | What it is | What it does | What it does not do |
|---|---|---|---|
| RPO (Registered Provider Organization) | A consulting firm registered with the Cyber AB | Scoping, gap assessments, remediation, SSP and POA&M, assessment preparation | Conduct certification assessments or issue CMMC status |
| RP (Registered Practitioner) | An individual registered with the Cyber AB | Gives CMMC advice, usually working through an RPO | Assess or certify anyone |
| RPA (Registered Practitioner Advanced) | An RP with additional training and vetting | More complex advisory work | Assess or certify anyone |
| C3PAO (Third-Party Assessment Organization) | An organization authorized by the Cyber AB | Conducts official Level 2 certification assessments and records the results for the Department | Consult for the companies it assesses |
| CCP and CCA | Certified CMMC Professionals and Certified CMMC Assessors | Serve on C3PAO assessment teams; CCAs perform and lead assessments | Act as your consultant on an assessment they work on |
| DCMA DIBCAC | The Government’s Defense Industrial Base Cybersecurity Assessment Center | Conducts Level 3 assessments | Provide consulting |
| OSC (you) | The Organization Seeking Certification or Assessment | Performs Level 1 and Level 2 self-assessments and affirms in SPRS | Hand the affirmation to a consultant |
The short version: you hire an RPO to prepare, and a C3PAO to be assessed when your contract calls for Level 2 (C3PAO). The two must be independent. The longer comparison is on our C3PAO vs RPO page.
What an RPO can do
- Read your clauses and set your level. FAR 52.204-21, DFARS 252.204-7012, -7019, -7020 and -7021 point to Level 1 or Level 2; see our DFARS clause guide.
- Scope your environment. Map where FCI and CUI live so the assessment covers only what it must.
- Run a gap assessment. Check each of the 17 Level 1 practices or 110 NIST SP 800-171 requirements and estimate your SPRS score.
- Help you remediate. Work with your IT team or managed service provider to close gaps and capture evidence.
- Write the documentation. System Security Plan, policies, procedures and a POA&M.
- Rehearse the assessment. Walk the assessment objectives the way an assessor would, before the real one.
What an RPO cannot do
- Conduct a CMMC Level 2 (C3PAO) or Level 3 assessment, or issue a CMMC status or certificate.
- Enter assessment results for the Department; an authorized C3PAO does that for third-party assessments.
- Make your annual affirmation. Your company’s Affirming Official affirms in SPRS and owns the result.
- Assess a company it consulted for, or promise that you will pass.
Do you need an RPO?
No rule requires one. Since the Department of War suspended the move to Phase 2 on July 13, 2026, new requirements may only call for Level 1 (Self) or Level 2 (Self), and in both cases your own company does the assessing. An RPO is useful when your team lacks the time or the CMMC knowledge to check every requirement, gather evidence and write clear documentation, or when a prime has asked for your SPRS score and you want a defensible answer. Read what the Phase 2 suspension means.
How to verify an RPO on the Cyber AB Marketplace
- Open the Marketplace from cyberab.org and search for the firm by name.
- Confirm the listing type is RPO. A firm that offers official assessments should be listed as a C3PAO instead.
- Check the status reads active and in good standing, and note the organization key (for example, RPO-73372).
- Look up the person who will do your work and confirm they are listed as a Registered Practitioner.
- Compare the name and contact details with the proposal you received, and ask about any difference.
A listing confirms registration. It does not rate quality, so also ask for a sample deliverable and a fixed written scope.
What Galaxy does as an RPO
Galaxy Consulting, LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) and a Cyber-AB Registered Provider Organization, organization key RPO-73372, with a Registered Practitioner on staff. Galaxy has completed its own CMMC Level 1 and Level 2 self-assessments and affirmed them in SPRS. It is not a C3PAO, does not conduct official assessments and does not certify anyone.
Our work is preparation: readiness and gap assessments, remediation support, SSP and POA&M writing, mock assessment preparation and ongoing compliance, each with a fixed written scope. We are based in Fort Washington, Maryland, and work with defense contractors in every state, remotely and on site by arrangement. See our CMMC services and the markets we serve.
Frequently asked questions
What does RPO stand for in CMMC?
RPO stands for Registered Provider Organization: a consulting firm registered with the Cyber AB, the accreditation body of the CMMC ecosystem, to give CMMC advisory and preparation services to defense contractors.
Is an RPO the same as a C3PAO?
No. An RPO advises and prepares you. A C3PAO (CMMC Third-Party Assessment Organization) is authorized by the Cyber AB to conduct official Level 2 certification assessments. Conflict-of-interest rules keep the firm that prepared you from assessing you.
What is the difference between an RPO and a Registered Practitioner?
The RPO is the organization; a Registered Practitioner (RP) is an individual registered with the Cyber AB to give CMMC advice. An RPO delivers its advisory work through its RPs. Neither assesses nor certifies anyone.
Can an RPO certify my company for CMMC?
No. An RPO cannot conduct a certification assessment, issue a CMMC status or enter assessment results for the Department of War. Level 2 certification assessments are conducted by an authorized C3PAO, and Level 3 assessments by DCMA’s DIBCAC.
Do I have to hire an RPO to meet CMMC?
No rule requires one. Level 1 (Self) and Level 2 (Self) are assessments your own company performs. Many small contractors use an RPO because it is faster to have someone who knows the requirements scope the work, find the gaps and write the documentation.
How do I check that a company is really a CMMC RPO?
Search for it in the Cyber AB Marketplace on cyberab.org. Confirm the listing type is RPO, the status is active and in good standing, and the person who will do your work is listed as a Registered Practitioner.
Is Galaxy Consulting a Registered Provider Organization?
Yes. Galaxy Consulting, LLC is listed in the Cyber AB Marketplace as an RPO, organization key RPO-73372, with a Registered Practitioner on staff. Galaxy is not a C3PAO and does not certify anyone.
Related CMMC pages
- C3PAO vs RPO: who assesses and who helps you prepare
- Do you need an RPO for a self-assessment?
- Galaxy’s CMMC services and the free readiness call
- NIST 800-171 gap assessment
- Markets we serve nationwide
Talk to a Registered Practitioner
Galaxy Consulting is a veteran-owned Cyber-AB Registered Provider Organization (RPO-73372) working with defense contractors in every state, remotely and on site by arrangement. A free 30-minute readiness call covers your contract clauses, your likely CMMC level and what to fix first. No obligation.
General information, not legal advice. Check your own contract clauses with your contracting officer or counsel.