Full disclosure up front: we are a CMMC compliance company writing about how to choose a CMMC compliance company. So judge us by the same checklist below — every question in it is one we are comfortable answering on the record, and the fastest way to filter the market is to find out who else is.
Know the roles: RPO vs. C3PAO
A Registered Provider Organization (RPO) is a consulting firm registered with the Cyber AB — the CMMC ecosystem’s accreditation body — that has agreed to its code of professional conduct and employs trained Registered Practitioners (RPs) to prepare organizations for assessment. A C3PAO is the independent assessment organization that conducts the certification assessment itself.
The roles are deliberately separated: the organization that assesses you cannot also be the one that consulted on building your program — that conflict of interest is prohibited. The practical consequence: you want a preparation partner (an RPO) with real engineering capability, and a separately chosen C3PAO. Anyone offering to do both for the same environment is describing something the ecosystem does not allow.
Registration is verifiable — never take it on faith. Every legitimate RPO and RP appears in the Cyber AB marketplace; here is our listing.
The questions that sort the market
- Have you been through a C3PAO assessment yourselves — as the assessed party? There is no substitute for having sat in that room. (We hold CMMC Level 2 as an organization; ask any prospective partner for their equivalent.)
- Who does the remediation engineering — you, or a subcontractor I have not met? Advisory-only firms hand you a findings report and leave; the gap between “advised” and “implemented” is where timelines die.
- Show me a sanitized SSP and evidence package you have produced. Format and depth tell you more than any slide deck.
- What is your position on scoping — and can you build the enclave (including Microsoft 365 GCC High) if that is the right answer?
- Will you be in the room during our assessment, and what does post-certification operation look like?
The defense industry publishes its own version of this list: ND-ISAC’s 33-question MSP shopping guide. We answered it publicly, line by line — hand the questionnaire to everyone else you are evaluating too.
Red flags worth walking away from
- “Guaranteed pass” or certification promised on a fixed short timeline. No legitimate RPO controls the assessor’s verdict.
- Compliance sold as a software license alone. Tools help — we built one ourselves — but 110 controls include policy, process, and physical security no product can install.
- Pressure-selling the deadline during the Phase 2 pause. Urgency is real (primes, queues, 7012), but a vendor who misstates the current rule status to scare you will cut other corners too.
- No verifiable footprint: not in the Cyber AB marketplace, no named practitioners, no address in the region they claim to serve.
Local matters more than it should
CMMC Level 2 includes physical protection, media handling, and onsite realities that remote-only providers handle by questionnaire. A Northern Virginia contractor working with a Northern Virginia provider gets site walks, in-person assessment support, and someone who understands the prime landscape from the Beltway to Dulles. That is the logic behind our service-area coverage across NoVA, DC, and Maryland.
Want to see this checklist answered in full, on the record? We published our own case for the best CMMC compliance company in Northern Virginia — every claim on it verifiable.