Key points
- RPOs provide advisory and implementation services through Registered Practitioners.
- RPOs do not conduct certified CMMC assessments or issue certifications.
- A practitioner who helped implement CMMC for a company cannot later assess that company.
What an RPO is
A Registered Practitioner Organization (RPO) is an organization registered with The Cyber AB, the accreditation body for the CMMC ecosystem. In The Cyber AB's words, an RPO "delivers a non-certified advisory service through the employment of RPs." RPOs are consulting organizations or managed service providers.
The people inside an RPO are Registered Practitioners (RPs) and Registered Practitioners Advanced (RPAs), individuals who have completed Cyber AB training on the CMMC model and how organizations prepare for assessment.
What an RPO does
As The Cyber AB puts it, CMMC needs to be implemented before it can be assessed. That implementation work is what RPOs are for:
- Scoping the environment where Federal Contract Information or Controlled Unclassified Information is processed, stored, or transmitted.
- Identifying gaps against the requirements for your level and recommending how to close them.
- Helping implement the technical and administrative controls behind each requirement.
- Developing documentation, including the system security plan, policies, procedures, and plans of action.
- Reviewing your evidence before a self-assessment or certification assessment.
What an RPO does not do
- Conduct certified assessments. RPOs do not conduct certified CMMC assessments. At Level 2, certification assessments are performed by Certified Third-Party Assessment Organizations (C3PAOs). At Level 3, they are performed by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC).
- Issue certification. Working with an RPO does not give your organization a CMMC status. Your status comes from the assessment your contract requires.
- Assess its own clients. The Cyber AB states that individuals holding both practitioner and assessor designations cannot assess a company if they previously assisted with implementation for that same company.
Under the July 13, 2026 suspension of CMMC Phase II, new requirements may only call for Level 1 (Self) or Level 2 (Self) assessments. Preparation work by an RPO applies to self-assessments now, and to certification assessments if they return after the Department's review.
How the roles fit together
- The Cyber AB
- The accreditation body for the CMMC ecosystem. Registers RPOs and RPs, and authorizes C3PAOs.
- RPO and RPs
- Advise and implement. Help you prepare for assessment.
- C3PAO
- Conducts CMMC Level 2 certification assessments.
- DCMA DIBCAC
- Conducts CMMC Level 3 assessments for the government.
- Your organization
- Implements the requirements, performs self-assessments where allowed, and affirms compliance in SPRS.
HARDAC works with Cyber AB Registered Practitioners to prepare defense contractors for the level their contracts require, and we do not assess the organizations we advise. Learn about our CMMC readiness services.