Know which role you are hiring. A C3PAO is the only type of organization that can perform a CMMC Level 2 certification assessment, and it cannot assess a company it consulted for in the previous three years. An RPO (Registered Provider Organization) is a Cyber AB registered advisory firm that helps you prepare but cannot certify you. A managed service provider runs and secures your systems day to day; if it touches your CUI environment it is part of your assessment scope. Most Ohio manufacturers need preparation help from one firm and an independent C3PAO for the assessment itself.
| What they do | What they cannot do | How to verify | |
|---|---|---|---|
| C3PAO | Performs Level 2 certification assessments using Certified CMMC Assessors and submits results to DoD | Consult for or implement controls at a company it will assess within 3 years | Cyber AB Marketplace (cyberab.org) |
| RPO | Readiness and advisory: scoping, gap assessments, SSP and POA&M help, remediation guidance | Perform certification assessments or issue a CMMC status | Cyber AB Marketplace |
| MSP or MSSP | Runs IT and security operations; often implements and operates the controls | Certify you; it is assessed as part of your environment if it handles CUI or Security Protection Data | Ask for its own security practices and how it fits your SSP |
Federal rules do not require you to use an RPO. You can prepare in-house, with an RPO, or with another qualified consultant. What matters is that the work is accurate and that your assessor is independent.
Under 32 CFR Part 170 and the Cyber AB Code of Professional Conduct, a C3PAO cannot conduct your Level 2 certification assessment within three years of providing consulting, implementation or product services to you, and the rule applies to the whole firm, not just individual assessors. Be cautious of any firm that offers to both prepare and certify you.
Many Ohio defense suppliers are machine shops, fabricators, aerospace component makers and electronics manufacturers, so CUI often lives in CAD files, ERP and MES systems and shop floor PCs, not just email. Choose a consultant who has worked in manufacturing environments and can be on site in Cleveland, Columbus or wherever your plants are.
TRNSFRM is an Ohio managed IT and cybersecurity provider headquartered in North Royalton with a Columbus-area presence. We perform CMMC gap assessments, build SSPs and POA&Ms, implement the controls, and operate them as your MSP, including Microsoft GCC High. We are not a C3PAO and do not certify anyone, which means we can prepare you and you remain free to choose any independent C3PAO for your assessment.
Or call (877) 777-6855
Gap assessment, remediation and readiness.
The 110 requirements and how the assessment runs.
Process and DoD cost estimates.
Real budgets compared with DoD estimates.
What changed and what still applies.
How we work with the defense supply chain.
Executive security leadership.
A conversation about your contracts and what a paid gap assessment involves.