C3PAO Selection Guide
for DoD Contractors (2026)

For 24 years Petronella Technology Group has worked with DoD subcontractors across the Mid-Atlantic, and the conversation through 2026 sounds the same on every call: a prime contractor has flowed CMMC Level 2 down through the supply chain, the program manager still wants assurance the sub can protect CUI, and the sub is trying to work out what the July 2026 suspension of Phase 2 actually changed. Selection of the C3PAO is the single most external-dependent decision in a Level 2 program. Implementation is internal, evidence is internal, even mock assessment is internal, but the certificate that a contracting officer wants to see comes only from a C3PAO. Pick the wrong partner and the schedule slips.

The factors that shape a C3PAO decision in 2026:

• Phase 2 is suspended, so there is no certification clock right now. The Department of War suspended CMMC Phase 2 on July 13, 2026 (memo 26-P-1023). Phase 2 had been scheduled to start on November 10, 2026 and would have begun placing Level 2 assessment requirements into selected solicitations. A CMMC Reform Task Force is running a 60-day review with a public request for information, and the stated aim is to reduce certification burden rather than lower the cybersecurity baseline. DFARS 252.204-7012 and Phase 1 self-assessment requirements are unaffected. Running the C3PAO diligence without a deadline on your back is the low-stress version of this work.
• The C3PAO ecosystem is small. The organizations fully authorized to conduct CMMC Level 2 assessments number in the dozens, against a population estimated above 80,000 defense contractors and subcontractors that may need certification at full enforcement. The count changes month to month, so treat the Cyber AB directory as the current number rather than any figure quoted in a guide. The math is not favorable to last-minute scheduling.
• The Cyber AB DoD IG audit surfaced concerns. An Industrial Cyber report on the DoD IG audit documented gaps in the C3PAO authorization process, including authorizations issued without verified quality control leads in some cases. Translation: not every C3PAO is operating at the same maturity.
• Evidence demands vary widely between firms. Certified CMMC Assessors (CCAs) talking informally describe wildly different evidence requests for the same NIST 800-171 control. Some C3PAOs will accept a screenshot and a policy reference; others insist on raw configuration export plus a workflow walk-through. Picking a methodology that does not match your evidence library is a slow-motion fail.
• Assessor capacity is the bottleneck, not contractor readiness. Ready contractors are calling C3PAOs and being told the next available slot is 6 to 9 months out, sometimes longer for niche industry verticals. That is a scheduling problem you do not solve by working harder on remediation.

None of this means CMMC Level 2 is impossible. It means selecting the C3PAO is no longer an afterthought. It is a strategic decision that should happen during gap analysis, not after remediation is "done."

Petronella Technology Group is a Cyber AB Registered Provider Organization (RPO) #1449, verified at cyberab.org/Member/RPO-1449-Petronella-Cybersecurity-And-Digital-Forensics. We are not a C3PAO. We do not certify. The CMMC ecosystem is intentionally separated this way, and that separation is in the contractor's favor: the firm that helped you implement controls has a meaningful incentive to score them generously, so the assessor must come from a different organization. If a vendor offers to do both your remediation and your formal assessment, that is a red flag. The Cyber AB does not authorize that arrangement.

What that means in practice for a Level 2 contractor: you will engage two different organizations. An RPO (or in-house team plus consultancy) handles months 1 through 12, including gap analysis, policy authoring, technical remediation, evidence buildout, and a mock assessment. A C3PAO handles the formal assessment in months 13 through 22. Petronella Technology Group plays the RPO role end-to-end, and we coordinate with the C3PAO our client selects, but we do not certify, and we never claim that authority.

Honest framing first: this section does not list "best" or "worst" C3PAOs by name. We have not assessed every C3PAO in the ecosystem, no public comparative data set exists, and any ranking would be editorial speculation. Instead, here is what we know about the ecosystem, with sources.

Authorization counts. The population of fully authorized Level 2 C3PAOs is measured in dozens, not thousands, and it moves month to month as the Cyber AB authorizes additional firms. Any number printed in a guide like this one goes stale, so pull the live count from the Cyber AB directory before you plan around it. What has held steady is the direction: new authorizations have come slower than growth in contractor demand, so capacity remains constrained.

Geography. The C3PAO population is concentrated in the Mid-Atlantic and DC area, with smaller clusters in the Southeast (including North Carolina), the Midwest (Michigan, Ohio), and a handful in the Mountain West and Pacific Coast. Remote assessments are now standard practice, so geographic proximity is a logistics-and-budget consideration, not a capability constraint.

The official directory. The Cyber AB maintains the official directory of authorized C3PAOs at cyberab.org. This is the only authoritative source. Vendor lists from CMMC consultants, blog posts ranking "top 10 C3PAOs," and industry conference promotions are secondary at best.

How to research a specific C3PAO. Start with the Cyber AB directory entry, which lists authorization status and any public corrective action. Pull the firm LinkedIn and look at the assessor team individual profiles. Search the firm name plus "Cyber AB" plus "suspension" or "revoke" to surface any disciplinary history. Ask the firm directly for three reference contractors, and call them. Then run the twelve diligence questions listed above through every candidate and compare the written answers side by side.

What we will not publish. A list of "top C3PAOs" without testing each one. A claim that one C3PAO is faster than another based on hearsay. Any framing that treats C3PAO selection as a procurement-only decision, because it is not. The C3PAO becomes part of your supply chain for three years per certification cycle.

The total of 18 to 24 months is why Petronella Technology Group recommends starting readiness work now rather than waiting for the CMMC Reform Task Force to report. The suspension removed a phase-in schedule, not the length of the work: gap analysis, remediation, evidence buildout, and mock assessment take the same time whenever you start them, and evidence has to accumulate over months rather than be produced on demand. Contractors who use this window to measure and remediate are ready for whatever the review produces, and their NIST SP 800-171 posture is already what primes and contracting officers ask about today.

This sequencing also makes the RPO and C3PAO separation impossible to ignore. The C3PAO cannot do remediation, so a separate RPO (or in-house compliance team plus consultancy) has to own months 1 through 12. There is no "single vendor" path. Assessor independence and conflict-of-interest management are conditions of C3PAO authorization under the CMMC program rule (32 CFR 170) and the Cyber AB Code of Professional Conduct, so a combined-role arrangement is not something to plan a program around. Ask any candidate C3PAO to state its conflict-of-interest position in writing.

Petronella Technology Group is a Cyber AB RPO #1449. We are not a C3PAO. We are not authorized to certify, and we will never represent that we are. What we do is the work on the contractor side of the line: gap analysis, remediation, evidence buildout, mock assessment, advisor coordination during the formal assessment, and post-assessment POAM closure. The assessment result belongs to the C3PAO and to the Cyber AB review that follows it. We do not control that determination and we do not predict it. Selection of the C3PAO is a client decision; we structure the diligence so the decision is informed.

Engagement archetype

• Months 1-2: Gap analysis and SSP authoring. We document current state against all 110 NIST 800-171 controls, produce or update the System Security Plan, build the initial Plan of Action and Milestones, and scope the assessment boundary. This phase is RPO work in our hands.
• Months 3-9: Remediation execution. We coordinate technical implementation, policy authoring, vendor changes, training, and evidence collection. We do not subcontract this to the eventual C3PAO. That separation is by design.
• Months 10-12: Mock assessment. Petronella runs a dry-run assessment that mirrors the methodology our clients can expect from a C3PAO. Findings produce a final round of pre-assessment hardening.
• Months 13-15: C3PAO selection coordination. We do not certify. We help our clients identify three to five C3PAO candidates whose methodology and stack alignment matches the client environment. We take notes during diligence calls. We do not steer business to any particular C3PAO and we receive no commission from any C3PAO.
• Months 16-22: Assessment advisor. Where the C3PAO permits, Petronella attends the formal assessment in advisor or observer capacity. We do not interfere with assessor judgment. We help the client interpret evidence requests and surface relevant documentation in real time.
• Post-assessment: POAM remediation. If the assessment produces findings inside the allowed POAM band, Petronella owns the closure work. If the assessment produces findings outside POAM tolerance, we own the remediation work and the evidence rebuild that prepare the contractor for re-assessment. Whether a re-assessment succeeds is the C3PAO determination, not ours.

What we deliberately do not do: certify, recommend "the best" C3PAO, accept C3PAO referral commission, or push a client toward a specific assessor. The independence is in the client favor. It is also a Cyber AB requirement.

• Cyber AB Registered Provider Organization (RPO) #1449. Verified at cyberab.org/Member/RPO-1449-Petronella-Cybersecurity-And-Digital-Forensics. The Cyber AB authorization is what makes us eligible to do the prep work the C3PAO will later assess.
• CMMC-RP Certified team. Craig Petronella, Blake Rea, Justin Summers, and Jonathan Wood all hold CMMC-RP certification. Craig also holds CCNA, CWNE, and Digital Forensics Examiner (DFE) #604180.
• BBB A+ accredited since 2003. Twenty-plus years of clean accreditation in a small business with skin in the game.
• Founded 2002. Twenty-four years serving DoD subcontractors and other regulated SMBs across the Mid-Atlantic and beyond.
• Raleigh, NC. Headquartered at 5540 Centerview Drive, Suite 200, Raleigh, NC 27606.
• (919) 348-4912. Direct line. Penny, our AI assistant, books a free 15-minute call with Craig or Blake when you call during off hours. Real humans for the second call.

What you will not see on this page: a "100% pass rate" claim, a list of "satisfied clients" we cannot name, fictional case studies, fabricated testimonials, or a promise of a specific timeline that depends on a C3PAO we do not control. The Cyber AB ecosystem is honest by design, and we operate the same way. We are independent, we recommend C3PAOs based on fit, and we tell our clients what we do not know.

What we will not do: certify, accept C3PAO referral commission, or push a client toward one specific assessor. The integrity of the engagement is the engagement.