CMMC is deliberately built with a wall down the middle. One kind of organization helps you prepare, a Registered Provider Organization, and a separate kind of organization certifies you, a Certified Third-Party Assessment Organization, or C3PAO. The Cyber AB, the body that governs the program, does not allow the same firm to consult on your readiness and then assess you for certification. Hire the wrong combination and you can find yourself locked out of the assessor you actually wanted to use.
That structural rule is also the reason this category is confusing to buy in. Some firms hold only a consulting registration. Others hold both designations and have to firewall the two functions internally, client by client. Neither structure is wrong, but a buyer who does not understand the difference can end up disqualifying their preferred path to certification without realizing it until it is too late to fix cheaply.
Final Level 2 CMMC certificates had been issued as of the Cyber AB’s May 2026 town hall, and none of them were invalidated by the program pause that followed. An existing Level 2 certification still satisfies a lower contractual requirement during the current suspension.
Cyber AB, May 2026 town hall, as reported by industry legal analysis, July 2026.
Defense Industrial Base contractors are expected to eventually need to meet some level of CMMC certification as a condition of Department of Defense contract award, once the full phased rollout is complete.
CMMC Accreditation Body program materials, widely cited industry figure.
of cybersecurity teams experienced at least one significant security consequence caused directly by a skills gap in 2025, with 69% reporting multiple incidents, the underlying reason most defense contractors bring in outside CMMC expertise rather than building it from scratch internally.
ISC2 Cybersecurity Workforce Study, 2025.
Read together, those figures describe a program that is real, has already certified organizations under its current rules, and will eventually reach a very large share of the defense industrial base, even as the specific enforcement timeline for third party certification has been paused for review.
This guide explains the current state of the CMMC program, the structural difference between a consultant and an assessor, and compares leading U.S. consulting firms across the criteria that actually determine whether your certification path stays open.
Three kinds of organizations operate in this space, and the distinction between them is not optional or a matter of firm preference. It is a Cyber AB conflict of interest rule.
A Registered Provider Organization, or RPO, is a consulting entity registered with the Cyber AB to provide advisory and preparation services. An RPO can perform a gap assessment, help you write policy, guide remediation, and prepare your documentation. An RPO cannot issue a certification and cannot represent that hiring them guarantees a passing assessment.
A Certified Third-Party Assessment Organization, or C3PAO, is an accredited body authorized to conduct the official assessment and issue certification. A C3PAO is required to maintain independence and generally cannot provide consulting or remediation services to an organization it also assesses.
Some firms hold both designations. This is allowed, but the Cyber AB requires the two functions to be firewalled per client. If a firm consults with you as your RPO, that same firm cannot then serve as your C3PAO, even if it holds both accreditations. Hiring a dual designation firm as your consultant quietly removes that firm from your list of eligible assessors, which is worth knowing before you sign, not after.
One practical consequence follows directly from this structure: your consultant should have a clear, independent relationship with one or more C3PAOs they can refer you to, separate from any internal firewall. Ask how that referral works before you engage anyone, since it determines whether your path to certification stays genuinely independent.
CMMC consultants generally fall into one of four approaches. Matching the approach to what your organization needs matters more than comparing marketing language, since most firms describe themselves in similar terms.
This changes fast enough that it deserves its own section rather than a footnote. As of this writing, the Department of War suspended CMMC Phase 2, the phase that would have made mandatory third party C3PAO certification for Level 2 the default, on July 13, 2026. A CMMC Reform Task Force was stood up to review the program, with a report expected in the September to October 2026 window. No new Phase 2 start date has been set as of this guide’s publication.
What did not change is easy to miss and expensive to ignore. The CMMC program rule itself, 32 CFR Part 170, and the DFARS acquisition rule, remain fully in effect. Phase 1 is live: new solicitations require Level 1 and Level 2 self-assessments, and contractors must maintain current scores in the Supplier Performance Risk System. DFARS 252.204-7012 safeguarding requirements and the 72-hour incident reporting obligation to DIBNet continue to apply regardless of the Phase 2 pause. Existing Final Level 2 certificates already issued remain valid and continue to satisfy lower contractual requirements.
The practical read for a contractor is straightforward. The suspension is a pause on the mandatory third party certification deadline, not a pause on your underlying security obligations, and not a reason to stop preparing. Organizations that keep working toward Level 2 readiness during this window will be ahead of the market whenever Phase 2 resumes, and organizations that stop entirely are choosing to redo the same work later under more time pressure. Our own analysis on why the Phase 2 suspension does not pause your security requirements covers this in more detail.
Provider profiles below are drawn from publicly available service descriptions, Cyber AB Marketplace listings, and each firm’s own published materials. They describe how each firm is structured within the RPO and C3PAO framework and which consulting approach it primarily represents, not measured engagement quality or any specific client outcome.
Cyber AB designations, accreditation status, and program details referenced in this guide change as firms complete or renew accreditation cycles. Verify current designation status directly on the Cyber AB Marketplace before treating any firm’s stated designation as current.
Echelon Risk + Cyber publishes this guide and is included in it as a consulting only firm, not a dual designation firm, which is a structural fact stated plainly rather than a claim of superiority. Echelon maintains independent relationships with several accredited assessment organizations for client referral, which are listed on our Partners page alongside our other audit relationships. Request references, a sample gap assessment methodology, and clarity on assessment referral independence from every firm on your shortlist, including ours.
Category: Consulting only RPO positioning, delivered through CMMC 2.0 Compliance Consulting alongside a broader security program.
Best for: Mid market defense contractors and subcontractors that want CMMC readiness connected to a genuine, ongoing security program rather than a standalone documentation project, and that want assessment independence kept structurally simple.
Strengths: Consulting only positioning within the RPO and C3PAO structure, with no internal firewall required, since Echelon does not hold C3PAO accreditation and refers clients to independent assessment partners. CMMC readiness work connected to risk advisory and GRC, defensive hardening, and offensive security testing, so controls are genuinely implemented rather than only documented for an assessor. Independent relationships with multiple accredited audit partners for client referral, listed on Echelon’s Partners page, which keeps the consulting and assessment functions separated by organization rather than by internal policy alone. Named CMMC readiness work with defense industrial base clients including PJ Dick, Trumbull, The Lindy Group, and Aalyria, already published and referenceable. vCISO leadership available to own the broader security roadmap CMMC readiness feeds into, useful for contractors without a dedicated security executive. Practical guidance through the current Phase 2 suspension, helping clients continue toward readiness without overreacting to or ignoring the program pause.
Considerations: Organizations wanting a single firm relationship covering both consulting and eventual assessment, accepting the internal firewall that requires, will want a dual designation firm instead. Delivery is U.S. centric and mid market focused. Organizations with very large, multi-facility defense manufacturing operations may need a larger firm’s logistics capacity. Best suited to organizations that want CMMC readiness integrated into a real security program rather than treated as an isolated compliance exercise.
Category: Registered Provider Organization specializing in Microsoft government cloud environments for the defense industrial base.
Best for: Organizations building or migrating to Microsoft GCC High or Azure Government environments specifically to meet CMMC and NIST 800-171 requirements.
Strengths: Deep, well documented specialization in Microsoft GCC High and Azure Government environments, a specific technical requirement many CMMC readiness projects turn on. Consulting only RPO positioning, with no C3PAO accreditation to create internal firewall questions. Reports a track record of supported clients passing formal assessment, though this is the firm’s own published figure and should be verified rather than taken as independently audited. Serves a large, well established base of defense industrial base clients across company sizes.
Considerations: Specialization in Microsoft cloud environments is a strength primarily for organizations actually adopting that architecture, and less differentiated for contractors on other platforms. Broader security program work beyond CMMC and Microsoft cloud enablement is less central to the firm’s positioning. Verify current client outcome statistics directly, since firm published pass rate figures are marketing claims rather than independently audited results.
Category: Dual designation firm holding both C3PAO and RPO accreditation, a division of Clearwater, and one of the first organizations authorized as a C3PAO.
Best for: Organizations comfortable with a dual designation firm’s internal firewall structure and interested in a long established, historically first mover C3PAO relationship for eventual assessmen.
Strengths: Among the first organizations authorized as a C3PAO under the CMMC program, with correspondingly long operating history in the space. Holds both RPO and C3PAO accreditation, offering the option of a longer term relationship spanning readiness through eventual assessment, with the required internal firewall.Managed cloud and secure enclave services alongside consulting, useful for organizations needing infrastructure alongside advisory work. Backed by Clearwater’s broader regulated industry cybersecurity and testing practice.
Considerations: Dual designation structure means engaging Redspin as your consultant removes Redspin specifically from your list of eligible assessors for that engagement, by rule. Scale and structure as a division within a larger regulated industry cybersecurity firm may mean less individualized attention for a very small subcontractor relative to a boutique DIB specialist. Confirm current designation status and which specific entity within the Clearwater structure holds which accreditation before engaging either function restructuring.
Category: Dual designation firm holding both C3PAO and RPO accreditation, operating within a large, publicly traded defense and federal technology company.
Best for: Large or complex defense industrial base organizations, including manufacturers and cloud service providers, wanting a single large scale firm across consulting and assessment functions.
Strengths: Among the first organizations named a CMMC C3PAO, with deep, long standing experience across defense, space, and federal cybersecurity environments. Holds both RPO and C3PAO accreditation, again with the required internal firewall between the two functions per client. Backed by the scale and engineering depth of a large, publicly traded defense and federal technology company. Experience spans a wide range of defense industrial base client types, from manufacturers to managed service providers.
Considerations: Dual designation structure carries the same conflict of interest firewall as any other firm holding both accreditations, and engaging Kratos as consultant removes Kratos as an eligible assessor for that engagement. Scale and positioning as part of a large public company may mean higher cost and less individualized attention relative to a boutique consultant, particularly for smaller subcontractors. Best suited to organizations whose scale genuinely benefits from a large firm’s engineering and program management depth.
Category: Registered Provider Organization focused exclusively on defense industrial base CMMC and NIST 800-171 readiness.
Best for: Defense industrial base organizations wanting a consultant whose entire practice is built around this specific compliance requirement.
Strengths: Exclusive focus on defense industrial base cybersecurity and CMMC or NIST 800-171 readiness, rather than CMMC as one service line among many. Consulting only RPO positioning, avoiding the dual designation firewall question entirely. Depth specifically in the readiness and implementation work that precedes formal assessment. Narrower focus can mean faster, more specific guidance for organizations whose only compliance question is CMMC.
Considerations: Narrow focus on CMMC and NIST 800-171 specifically means less breadth for organizations also managing other compliance frameworks or a broader security program. Verify current scale and delivery capacity directly, since narrower specialist firms can have more limited bench depth than larger generalist consultancies. Best suited to organizations whose compliance need is specifically and primarily CMMC, rather than part of a wider program.
Category: Regulated industry consulting firm with CMMC included within a broader compliance and cybersecurity advisory practice.
Best for: Organizations that need CMMC guidance alongside other regulatory obligations, particularly those also navigating financial services or broader risk management requirements.
Strengths: Established consulting practice with strong risk management and audit credentials across regulated industries. CMMC guidance delivered within a broader advisory relationship rather than as an isolated, one-time engagement. Long market tenure and trusted presence in regulated industry compliance work generally. Useful for organizations that would rather manage CMMC and other compliance obligations through a single advisory relationship.
Considerations: CMMC and defense industrial base focus is narrower than firms built exclusively around this specific requirement, and depth on defense specific nuance should be confirmed directly. Primarily advisory in nature, with less emphasis on the ongoing security operations work that sustains compliance between assessment cycles. Best suited to organizations for whom CMMC is one compliance obligation among several, rather than the primary driver of the relationship.
Based on publicly available service descriptions, Cyber AB Marketplace listings, and each firm’s own published materials as of Q3 2026. It reflects how each firm is structured within the RPO and C3PAO framework, not measured engagement quality, which depends on the specific consultants assigned
| Provider | Cyber AB Designation | Microsoft GCC High Depth | Broader Security Program | Assessment Independence | DIB Focus | Mid Market Fit |
| Echelon Risk + Cyber | RPO only | Available | Strong | Independent referral | Yes | 5 stars |
| Summit 7 | RPO only | Strong | Limited | Independent referral | Strong | 4 stars |
| Redspin | RPO and C3PAO | Yes | Yes | Internal firewall | Strong | 3 stars |
| Kratos | RPO and C3PAO | Limited | Yes | Internal firewall | Strong | 3 stars |
| CyberSheath | RPO only | Available | Limited | Independent referral | Strong | 4 stars |
| SBS CyberSecurity | RPO only | Limited | Yes | Independent referral | Limited | 4 stars |
Organizations are encouraged to conduct their own due diligence and request references before engaging any provider.
These seven questions separate a genuine, structurally sound CMMC engagement from one that could quietly limit your options later.
Is this firm an RPO, a C3PAO, or both?
Ask directly and verify on the Cyber AB Marketplace rather than relying solely on the firm’s own website. If the firm holds both designations, understand explicitly that engaging them as your consultant removes them as an eligible assessor for the same engagement.
How is the CMMC assessment independence maintained?
If the firm is consulting only, ask which accredited assessment organizations they refer clients to and how that relationship is structured. If the firm holds both designations, ask specifically how the internal firewall between the two functions is enforced and documented.
Does this CMMC consultant guarantee a passing assessment?
No legitimate RPO can guarantee a passing score, since the final determination rests entirely with the independent C3PAO. Treat any firm that offers an absolute guarantee as a sales tactic rather than a credible claim, and ask instead how they support you through remediation if gaps are found.
What happens to our readiness work if the assessment timeline changes?
Given the current Phase 2 suspension and ongoing program review, ask how the firm is advising clients to sequence work during this window, and whether their guidance changes if a new enforcement date is announced. A consultant with a clear, current answer is more current than one still describing a timeline predating the suspension.
Is CMMC readiness connected to real security controls or only documentation?
A System Security Plan and a set of policies satisfy the paperwork half of readiness. Ask specifically how the engagement verifies that the underlying technical controls, such as access management, logging, and encryption, are actually implemented and operating, not just described.
Who specifically will work on our engagement, and what is their background?
CMMC engagement quality depends heavily on the individual consultants assigned, including whether they hold current Registered Practitioner or Certified CMMC Professional credentials personally. Ask who will do the work, not just which firm is on the contract.
The consultant you choose determines more than how smoothly your assessment goes. It can determine which assessors remain available to you, and whether the work you pay for actually holds up under an examiner’s scrutiny or only looks good in a binder.
The firms in this guide are all legitimate participants in the CMMC ecosystem, and several will be a better fit than us for a specific situation. A firm specializing in Microsoft government cloud environments will serve an organization actually migrating to that architecture better than a generalist. A dual designation firm offers a genuine one-stop relationship for organizations comfortable with the internal firewall that requires. Those are real trade-offs, not marketing points, and we have stated them plainly.
What we see go wrong most often is not a failed assessment. It is a passed one built on documentation that does not reflect what is actually running in the environment, discovered months later during an incident or a follow-up examination. CMMC exists because controlled unclassified information genuinely needs protecting, not because a binder needs to exist.
Whichever consultant you choose, and regardless of when Phase 2 enforcement resumes, the work of actually implementing the controls is the part that protects you. The certificate is downstream of that, not a substitute for it.
If you are not sure whether your current CMMC preparation is real security work or just documentation, or if the recent program pause has you wondering whether to keep going, that conversation is worth having directly. CMMC 2.0 Compliance Consulting. Contact Us.