Topic · c3pao

C3PAO

Certified Third-Party Assessment Organizations — the CMMC assessor accreditation tier.

RSS feed ↗

trade-press
CMMC program operational despite phase-two pause, Cyber AB says
The pause is tactical, not strategic, but the task force's mandate to "drastically reduce costs" could reshape level two for small and non-traditional shops before anything becomes contractually mandatory.
CMMC's phase-two implementation timeline is on hold after DoD's July 13 pause and 60-day task-force review, but Cyber AB CEO Matthew Travis told a July 28 town hall that the program itself remains operational: C3PAOs are conducting level two certifications, DFARS 252.204-7012 compliance is still in force, and both CMMC portals remain open. Travis framed certification as "the best insurance policy against False Claims Act risk" and urged contractors to respond to DoD's RFI by the Aug. 14 deadline. The task force's authority to alter the rule's cost, scope, or timing remains undefined, and the Cyber AB hasn't been contacted for tier-four participation yet.
AUG 25
trade-press
Contractors continue CMMC assessments through DoD pause
A paused mandate still leaves contractors choosing between preserving sunk C3PAO spend and betting against whatever regime follows.
Federal News Network reports that Professional Services Council President Stephanie Kostro says PSC members already midway through Cybersecurity Maturity Model Certification (CMMC) assessments are staying with Certified Third Party Assessment Organizations (C3PAOs) despite DoD’s suspension. PSC has 400 member companies, about 40% with Defense Department work. The lesson is operational: companies have sunk assessment costs, protected government information to secure and no evidence that contractor cybersecurity requirements are disappearing.
JUL 21
trade-press
House NDAA amendment targets CMMC cost burden
Congress is no longer just watching CMMC rollout mechanics; it is asking whether the market structure is pricing out small suppliers.
Inside Cybersecurity reports that House Armed Services advanced the fiscal 2027 National Defense Authorization Act, 44-12, with a Rep. Jeff Crank amendment requesting a Defense Department briefing on Cybersecurity Maturity Model Certification reforms by March 1, 2027. The amendment cites excessive regulatory burdens, small-business disadvantage, and fee transparency concerns involving the Cyber AB and CMMC Third-Party Assessment Organizations. Primes, subs, assessors, and the Cyber AB get the message: CMMC cost is now a Hill oversight target.
JUN 5
regulator
GovRAMP adds five 3PAOs to assessment discount program
The roster now covers ten accredited firms, but the 30% discount only reaches providers who have already completed GovRAMP's preparatory pathway.
GovRAMP added 360 Advanced, Data Lock Consulting Group, Lunarline, Schellman, and Securisea to its 3PAO Discount Program, bringing total participating firms to ten. The program offers up to 30% off independent security assessments, but only for providers that have completed the GovRAMP Progressing Security Snapshot or achieved GovRAMP Core verification. Founding participants A-LIGN, Prescient Security, Coalfire, Fortreum, and RISCPoint remain in the program. The discount is explicitly scoped to smaller and midsize technology vendors pursuing SLED and federal government work through GovRAMP verification.
MAY 22

C3PAO

CMMC program operational despite phase-two pause, Cyber AB says

Contractors continue CMMC assessments through DoD pause

House NDAA amendment targets CMMC cost burden

GovRAMP adds five 3PAOs to assessment discount program