What is a C3PAO?

Where C3PAOs fit in CMMC

CMMC has three levels. Level 1, for Federal Contract Information, is a yearly self-assessment. Level 2, for Controlled Unclassified Information, is a self-assessment for some contracts and a C3PAO certification assessment for most, repeated every three years. Level 3 is assessed by the government and requires a Level 2 certification first.

The Cyber AB is the accreditation body that the Department of Defense recognises for the programme. It authorises C3PAOs, and each C3PAO uses Certified CMMC Assessors, led by a Lead CCA, to carry out the work.

What the assessment involves

The assessment team starts from your System Security Plan and the boundary of the systems that handle CUI. For each of the 110 requirements it examines documents and records, interviews the people who run the controls, and tests where needed, then scores the requirement as met, not met or not applicable.

If every requirement is met, you receive Final Level 2 status, valid for three years. If the score reaches at least 80 per cent and the unmet requirements are ones the rules allow on a Plan of Action and Milestones, you receive Conditional status and have 180 days to close the open items and pass a closeout assessment. The C3PAO submits the results to the Department of Defense, and the status appears in SPRS.

Choosing and preparing for one

Check that the firm is authorised on the CMMC Marketplace, and contact assessors well before a contract needs the certificate, because their calendars fill early. Ask whether they have assessed environments like yours.

• Independence. A C3PAO cannot assess an organisation it has helped prepare. Use a separate firm for consulting.
• SSP and scope. A current System Security Plan, network diagram and asset list, agreed internally before the assessor arrives.
• Evidence. Records for each requirement, organised so an assessor can follow them without a guided tour.
• People. Control owners briefed and available for interviews during the assessment window.

Related terms

NIST SP 800-171

The US standard of 110 security requirements for protecting Controlled Unclassified Information in non-federal systems, and the control set behind CMMC Level 2.

System Security Plan (SSP)

The CMMC and NIST SP 800-171 document describing the system boundary and how each of the 110 requirements is met. The assessor starts from it.

Plan of Action and Milestones (POA&M)

The CMMC and NIST document listing unmet requirements with the planned fix, owner and date. Only a limited set of requirements may sit on a POA&M at a CMMC assessment.

Controlled Unclassified Information (CUI)

US government information that is not classified but must be protected under law or policy. Handling CUI brings a defence contractor under CMMC Level 2.

Federal Contract Information (FCI)

Information provided by or generated for the US government under a contract and not intended for public release. Handling FCI brings a contractor under CMMC Level 1.