A CMMC Registered Provider Organization (RPO) is a consulting firm that the Cyber AB has authorized to give advisory and preparation services to companies getting ready for CMMC. An RPO helps you understand the requirements, fix gaps, build your documentation and prepare for your assessment. It does not conduct the official assessment, and it does not certify anyone.
Who does what: RPO, RP, C3PAO and DIBCAC
CMMC comes with a lot of short names, and they are easy to mix up. Here is who does what:
- The Cyber AB (formerly the CMMC Accreditation Body) is the accreditation body for CMMC. It authorizes RPOs and accredits C3PAOs.
- RPO (Registered Provider Organization): a consulting firm authorized by the Cyber AB to provide advisory and preparation services. It helps you get ready. It does not assess you.
- RP (Registered Practitioner): a person employed by an RPO, trained and vetted to help DoD contractors understand CMMC requirements, identify gaps, implement controls and prepare documentation. An RP advises and never certifies.
- C3PAO (CMMC Third-Party Assessment Organization): a firm accredited by the Cyber AB to conduct official third-party CMMC assessments. C3PAOs are independent from RPOs and do not provide consulting services.
- DIBCAC (part of DCMA): the Government team that conducts Level 3 assessments.
Put simply, RPOs and RPs help you prepare, C3PAOs conduct official third-party assessments, and the Government handles Level 3. Knowing these roles helps you hire the right kind of help and spot a claim that does not fit.
What an RPO can and cannot do
An RPO's job is preparation. Working through its Registered Practitioners, it can help you:
- understand what CMMC asks of your company
- find the gaps between what you do today and what is required
- put security controls in place to close those gaps
- build the documentation you will need
- get ready for your assessment
What it cannot do matters just as much. An RPO does not conduct the official assessment, and it does not certify you. On the other side, a C3PAO conducts official third-party assessments but does not offer consulting. So the firm that helps you prepare is not the firm that assesses you. If one company offers to do both, ask it to explain before you sign anything.
Do you need an RPO for a self-assessment?
Not always. Level 1 is a self-assessment you can conduct yourself, so technically you do not need an RPO for it. Level 2 (Self) is a self-assessment too: your own company does the assessing, and no C3PAO is involved.
Whether outside help makes sense depends on your team. Ask a few honest questions:
- Does anyone on staff know the CMMC requirements well?
- Do you have the time to check every requirement and gather proof?
- Can someone write clear documentation of how your systems are set up and protected?
If the answers are mostly yes, you may be able to handle the work in-house. If not, an adviser can help with the parts you cannot cover. Either way, the self-assessment belongs to your company. For the Level 1 steps, see the CMMC Level 1 self-assessment process.
How to check a provider in the Cyber AB Marketplace
The Cyber AB Marketplace is the official place to verify RPO, C3PAO and RP listings. Before you hire anyone, look the firm up there yourself instead of relying on a logo or a sales page.
When you search, check two things:
- The firm is listed. If you cannot find it, ask the firm why.
- The listing matches the pitch. A firm that calls itself an RPO should be listed as one. If it says its people are RPs, look them up too. A firm that offers an official third-party assessment should be listed as a C3PAO.
Keep a short note of what you find for each firm on your shortlist, so you can compare them side by side. To find the Marketplace, start with the official CMMC resources page, which links to it along with other official sources.
What the Phase 2 suspension changes
On July 13, 2026, the Department of War (DoW, formerly DoD) suspended the move to CMMC Phase 2. During the suspension, program offices may not require third-party certification or Level 3. That did not switch CMMC off, though: for now, new requirements may only call for Level 1 (Self) or Level 2 (Self).
That shapes the kind of help that fits. If a new requirement can only ask you for a self-assessment, the help you need is advice and preparation, which is the work RPOs and RPs do. Check what your own solicitations and contracts call for before you decide how much help to buy. For the details, read CMMC Phase 2 Is Suspended.
Questions to ask before hiring help
Before you sign with any adviser, ask:
- Where are you listed in the Cyber AB Marketplace, and in which role?
- Who will do the work, and is that person a Registered Practitioner?
- Will you stick to advice and preparation, and leave the assessment to us or to an independent assessor?
- Which level are you preparing us for, Level 1 (Self) or Level 2 (Self), and why?
- What exactly is in scope, and is the price fixed for that scope?
- What will our own team still need to do?
Clear, direct answers are a good sign. Be careful with anyone who talks more about results than about the work.
How Galaxy can help
Galaxy Consulting is a service-disabled veteran-owned small business. Its CMMC work is advisory and self-assessment preparation: it helps you get ready, and it does not assess you. Through Galaxy's RP Staffing service, you can access its Cyber-AB Registered Practitioner on a project or ongoing basis, for Level 1 and Level 2 self-assessment preparation. Galaxy offers fixed-scope engagement pricing.
Read about Galaxy's CMMC advisory services to see what each service includes, and browse the CMMC FAQ for common questions. When you are ready to talk it through, contact Galaxy Consulting. The initial consultation is free.