CMMC Level 2 requires defense contractors handling Controlled Unclassified Information (CUI) to implement 110 security requirements aligned with NIST SP 800-171 Rev 2 across 14 security domains. Certification is assessed by accredited C3PAOs every 3 years.
On July 13, 2026, the Department of War announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which was originally scheduled for November 10, 2026. All Phase I self-assessment requirements remain firmly in place. The Department will begin a comprehensive review of CMMC aimed at aligning with the Secretary of War Pete Hegseth’s Acquisition Transformation System (ATS) directives prioritizing speed to capability, lowering barriers for small, medium, and non-traditional businesses, and replacing bureaucratic compliance with scalable, resilient cybersecurity measures.
Read it on the DoD CIO CMMC pageA memorandum states the Department's policy. A class deviation tells a contracting officer what to put in, and take out of, a contract. Effective September 3, 2026, DARS class deviation 2026-O0025, Revision 3 supersedes Revision 2 of July 16, 2026 and directs contracting officers to:
Collaborate with requiring activities to remove or revise the Cybersecurity Maturity Model Certification (CMMC) requirements in new and existing solicitations and contracts in accordance with the Department of War Chief Information Officer’s memorandum, Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements, dated July 13, 2026.
The class deviation sets out what that memorandum does:
Security Requirements
NIST SP 800-171 R2
Security Domains
ACCESS TO INTEGRITY
Minimum Passing Score
80% THRESHOLD
Certification Validity
ANNUAL AFFIRMATION
The Cybersecurity Maturity Model Certification (CMMC) is a DoW framework ensuring that defense contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It was developed by the Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD(A&S)) and the DoW Chief Information Officer (CIO).
The Defense Industrial Base (DIB) consists of over 220,000 companies that process, store, or transmit CUI and FCI in support of the warfighter. CMMC provides a consistent pre-award assessment methodology to determine whether contractors have implemented the cybersecurity protections necessary to safeguard DoW information.
CMMC requirements apply to all DoW solicitations and contracts awarded after November 10, 2025, and the Phase 1 self-assessment requirement remains in effect. The rule published a phased schedule running to November 2028, but the Department suspended Phase 2 on July 13, 2026 and opened a review of CMMC, so every date beyond Phase 1 is the published one rather than a current commitment. The CMMC final rule is codified in 32 CFR Part 170.
FAR 52.204-21 · Annual self-assessment · Protects FCI
NIST SP 800-171 R2 · C3PAO assessment every 3 years · Protects CUI
NIST SP 800-171 R2 + 800-172 · DIBCAC assessment every 3 years · Protects CUI (APT)
System Security Plan (SSP)
Documents how all 110 security requirements are met
Plan of Action & Milestones (POA&M)
Addresses gaps with 180-day closeout deadline
Annual Affirmation
Yearly affirmation of continued compliance in SPRS
CMMC Level 2 maps directly to the 14 security requirement families defined in NIST SP 800-171 Rev 2. Each domain covers a critical area of cybersecurity practice.
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices (including other information systems).
Limit information system access to the types of transactions and functions that authorized users are permitted to execute.
Verify and control/limit connections to and use of external information systems.
Control information posted or processed on publicly accessible information systems.
Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
Control the flow of CUI in accordance with approved authorizations.
Separate the duties of individuals to reduce the risk of malevolent activity without collusion.
Employ the principle of least privilege, including for specific security functions and privileged accounts.
Use non-privileged accounts or roles when accessing nonsecurity functions.
Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.
Limit unsuccessful logon attempts.
Provide privacy and security notices consistent with applicable CUI rules.
Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.
Terminate (automatically) a user session after a defined condition.
Monitor and control remote access sessions.
Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.
Route remote access via managed access control points.
Authorize remote execution of privileged commands and remote access to security-relevant information.
Authorize wireless access prior to allowing such connections.
Protect wireless access using authentication and encryption.
Control connection of mobile devices.
Encrypt CUI on mobile devices and mobile computing platforms.
Verify and control/limit connections to and use of external systems.
Limit use of portable storage devices on external systems.
Control CUI posted or processed on publicly accessible systems.
Restrict access to systems and system components to only those information resources that are owned, provisioned, or issued by the organization.
Employ secure information transfer solutions to control information flows between security domains on connected systems.
Inform managers, systems administrators, and users of organizational systems of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
Train personnel to carry out their assigned information security-related duties and responsibilities.
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors.
Include practical exercises in awareness training for all users, tailored by roles, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Uniquely trace the actions of individual system users, so they can be held accountable for their actions.
Review and update logged events.
Alert in the event of an audit logging process failure.
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
Provide audit record reduction and report generation to support on-demand analysis and reporting.
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
Protect audit information and audit logging tools from unauthorized access, modification, and deletion.
Limit management of audit logging functionality to a subset of privileged users.
Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
Establish and enforce security configuration settings for information technology products employed in organizational systems.
Track, review, approve or disapprove, and log changes to organizational systems.
Analyze the security impact of changes prior to implementation.
Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.
Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.
Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.
Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.
Control and monitor user-installed software.
Establish and maintain an authoritative source and repository to provide a trusted source and accountability for approved and implemented system components.
Employ automated mechanisms to detect misconfigured or unauthorized system components; after detection, remove the components or place the components in a quarantine or remediation network.
Employ automated discovery and management tools to maintain an up-to-date, complete, accurate, and readily available inventory of system components.
Identify information system users, processes acting on behalf of users, or devices.
Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to organizational information systems.
Identify system users, processes acting on behalf of users, and devices.
Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.
Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
Prevent reuse of identifiers for a defined period.
Disable identifiers after a defined period of inactivity.
Enforce a minimum password complexity and change of characters when new passwords are created.
Prohibit password reuse for a specified number of generations.
Allow temporary password use for system logons with an immediate change to a permanent password.
Store and transmit only cryptographically protected passwords.
Obscure feedback of authentication information.
Identify and authenticate systems and system components, where possible, before establishing a network connection using bidirectional authentication that is cryptographically based and replay resistant.
Employ automated or manual/procedural mechanisms to prohibit system components from connecting to organizational systems unless the components are known, authenticated, in a properly configured state, or in a trust profile.
Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
Test the organizational incident response capability.
Establish and maintain a security operations center capability that operates 24/7, with allowance for remote/on-call staff.
Establish and maintain a cyber incident response team that can be deployed by the organization within 24 hours.
Perform maintenance on organizational systems.
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
Sanitize equipment removed for off-site maintenance of any CUI.
Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
Supervise the maintenance activities of maintenance personnel without required access authorization.
Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
Limit access to CUI on system media to authorized users.
Sanitize or destroy system media containing CUI before disposal or release for reuse.
Mark media with necessary CUI markings and distribution limitations.
Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
Control the use of removable media on system components.
Prohibit the use of portable storage devices when such devices have no identifiable owner.
Protect the confidentiality of backup CUI at storage locations.
Screen individuals prior to authorizing access to organizational systems containing CUI.
Protect organizational systems containing CUI during and after personnel actions such as terminations and transfers.
Protect organizational systems when adverse information develops or is obtained about individuals with access to CUI.
Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
Escort visitors and monitor visitor activity; maintain audit logs of physical access; and control and manage physical access devices.
Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.
Protect and monitor the physical facility and support infrastructure for organizational systems.
Escort visitors and monitor visitor activity.
Maintain audit logs of physical access.
Control and manage physical access devices.
Enforce safeguarding measures for CUI at alternate work sites.
Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
Remediate vulnerabilities in accordance with risk assessments.
Employ threat intelligence, at a minimum from open or commercial sources, and any DoW-provided sources, as part of a risk assessment to guide and inform the development of organizational systems, security architectures, selection of security solutions, monitoring, threat hunting, and response and recovery activities.
Conduct cyber threat hunting activities on an on-going aperiodic basis or when indications warrant, to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls.
Employ advanced automation and analytics capabilities in support of analysts to predict and identify risks to organizations, systems, and system components.
Document or reference in the system security plan the security solution selected, the rationale for the security solution, and the risk determination.
Assess the effectiveness of security solutions at least annually or upon receipt of relevant cyber threat information, or in response to a relevant cyber incident.
Assess, respond to, and monitor supply chain risks associated with organizational systems and system components.
Develop a plan for managing supply chain risks associated with organizational systems and system components; update the plan at least annually.
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
Monitor security controls on an ongoing basis to determine the continued effectiveness of the controls.
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
Conduct penetration testing at least annually or when significant security changes are made to the system, leveraging automated scanning tools and ad hoc tests using subject matter experts.
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
Monitor, control, and protect organizational communications (i.e., information transmitted or received by organizational information systems) at the external boundaries and key internal boundaries of the information systems.
Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.
Separate user functionality from system management functionality.
Prevent unauthorized and unintended information transfer via shared system resources.
Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.
Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).
Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.
Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.
Establish and manage cryptographic keys for cryptography employed in organizational systems.
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.
Control and monitor the use of mobile code.
Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.
Protect the authenticity of communications sessions.
Protect the confidentiality of CUI at rest.
Employ physical isolation techniques or logical isolation techniques or both in organizational systems and system components.
Identify, report, and correct information and information system flaws in a timely manner.
Provide protection from malicious code at appropriate locations within organizational information systems.
Update malicious code protection mechanisms when new releases are available.
Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
Identify, report, and correct system flaws in a timely manner.
Provide protection from malicious code at designated locations within organizational systems.
Monitor system security alerts and advisories and take action in response.
Update malicious code protection mechanisms when new releases are available.
Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.
Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
Identify unauthorized use of organizational systems.
Verify the integrity of security critical and essential software using root of trust mechanisms or cryptographic signatures.
Include specialized assets such as IoT, IIoT, OT, GFE, Restricted Information Systems and test equipment in the scope of the specified enhanced security requirements or are segregated in purpose-specific networks.
Use threat indicator information and effective mitigations obtained from, at a minimum, open or commercial sources, and any DoW-provided sources, to guide and inform intrusion detection and threat hunting.
Nov 10, 2025
Solicitations require Level 1 or Level 2 self-assessment
Nov 10, 2026
Solicitations require Level 2 C3PAO certification assessment
Nov 10, 2027
Solicitations require Level 3 DIBCAC certification assessment
Nov 10, 2028
All solicitations and contracts include applicable CMMC requirements
Third-party assessment is suspended. The cybersecurity clauses already in a contract are not, and neither is the False Claims Act. Since 2022 the Justice Department has announced 18 False Claims Act matters whose subject is a contractor's cybersecurity obligations, most of them turning on the same NIST SP 800-171 controls a CMMC Level 2 assessment scores. A self-assessment is still a representation to the Government, and these are what happened when one was wrong.
Resolved Matters
SINCE 2022
Recovered, At Least
HEADLINE FIGURES
Department of War
PRIMARY AGENCY
Self-Assessment Still Required
PHASE 1 IN EFFECT
The Justice Department announced today that Honeywell Aerospace Inc. has agreed to pay $2,042,518 to resolve allegations that it is liable under the False Claims Act for failing to comply with cybersecurity requirements in a contract with the U.S. Department of Defense. Honeywell Aerospace, a corporation headquartered in Phoenix, Arizona, provides aerospace products and solutions to government and commercial customers. Prior to June 29, when Honeywell Aerospace became a standalone public company, it was a business segment of Honeywell International Inc., of Charlotte, North Carolina.
Defense contractor LOGZONE Inc. of Huntsville, Alabama has agreed to pay $507,144 to resolve its liability under the False Claims Act for knowingly failing to comply with cybersecurity requirements in contracts with the Department of the Navy.
Swiss Automation Inc. has agreed to pay $421,234 to resolve alleged False Claims Act violations relating to its failure to provide adequate cybersecurity for certain drawings of parts that the company machined and supplied to Department of Defense (DoD) prime contractors. Swiss Automation is an Illinois precision machining business that supplies alloy and metal parts to commercial and government customers in many industries, including DoD prime contractors and subcontractors.
Georgia Tech Research Corporation (GTRC) has agreed to pay the United States $875,000 to resolve allegations that it violated the False Claims Act and federal common law by failing to meet cybersecurity requirements in connection with certain Air Force and Defense Advanced Research Projects Agency (DARPA) contracts. GTRC contracts with government agencies, including the U.S. Department of Defense (DoD), for research performed at its affiliate, the Georgia Institute of Technology (Georgia Tech).
Defense contractor Aero Turbine Inc., of Stockton, California, and private equity company Gallant Capital Partners LLC, of Los Angeles, have agreed to pay $1.75 million to resolve their liability under the False Claims Act for knowingly failing to comply with cybersecurity requirements in an Aero Turbine contract with the Department of the Air Force. In connection with the settlement, the United States acknowledged that Aero Turbine and Gallant took significant steps entitling them to credit for cooperating with the government.
Illumina Inc. has agreed to pay $9.8 million to resolve allegations that it violated the False Claims Act when it sold to federal agencies certain genomic sequencing systems with cybersecurity vulnerabilities. Illumina is a Delaware corporation, headquartered in California, that manufactured and sold genomic sequencing systems throughout the United States.
Hill ASC Inc., doing business as Hill Associates, of Rockville, Maryland, agreed to pay at least $14.75 million to resolve allegations that it violated the False Claims Act in connection with a General Services Administration (GSA) contract for information technology services.
Raytheon Company (Raytheon), RTX Corporation, and Nightwing Group, LLC, and Nightwing Intelligence Solutions, LLC (collectively, Nightwing), have agreed to pay $8.4 million to resolve allegations that Raytheon violated the False Claims Act by failing to comply with cybersecurity requirements in contracts or subcontracts involving the Department of Defense (DoD).
MORSECORP Inc. (MORSE), of Cambridge, Massachusetts, has agreed to pay $4.6 million to resolve allegations that MORSE violated the False Claims Act by failing to comply with cybersecurity requirements in its contracts with the Departments of the Army and Air Force.
Health Net Federal Services Inc. (HNFS) of Rancho Cordova, California and its corporate parent, St. Louis-based Centene Corporation, have agreed to pay $11,253,400 to resolve claims that HNFS falsely certified compliance with cybersecurity requirements in a contract with the U.S. Department of Defense (DoD) to administer the Defense Health Agency’s (DHA) TRICARE health benefits program for servicemembers and their families. In 2016, Centene acquired all of the issued and outstanding shares of Health Net Inc., HNFS’s corporate parent, and assumed the liabilities of HNFS.
The Pennsylvania State University (Penn State), located in University Park, Pennsylvania, has agreed to pay $1,250,000 to resolve allegations that it violated the False Claims Act by failing to comply with cybersecurity requirements in fifteen contracts or subcontracts involving the Department of Defense (DoD) or National Aeronautics and Space Administration (NASA).
ASRC Federal Data Solutions LLC (AFDS), headquartered in Reston, Virginia, has agreed to resolve False Claims Act allegations in connection with a government contract related to its storage of unsecured personally identifiable information of Medicare beneficiaries. Under the resolution, AFDS will pay $306,722. It will also waive any rights to reimbursement for remediating a data breach involving the information, including at least $877,578 in costs it incurred notifying beneficiaries and providing credit monitoring. AFDS promptly notified the Centers for Medicare and Medicaid Services (CMS) of the data breach, worked with CMS to address the impact of the breach, cooperated with the Justice Department’s investigation and took other remedial measures.
Guidehouse Inc., headquartered in McLean, Virginia, has paid $7,600,000 and Nan McKay and Associates (Nan McKay), headquartered in El Cajon, California, has paid $3,700,000 to resolve allegations that they violated the False Claims Act by failing to meet cybersecurity requirements in contracts intended to ensure a secure environment for low-income New Yorkers to apply online for federal rental assistance during the COVID-19 pandemic.
Insight Global LLC, headquartered in Atlanta has agreed to pay $2.7 million to resolve allegations that it violated the False Claims Act by failing to implement adequate cybersecurity measures to protect health information obtained during COVID-19 contact tracing.
Verizon Business Network Services LLC, of Ashburn, Virginia, has agreed to pay $4,091,317 to resolve False Claims Act allegations that it failed to completely satisfy certain cybersecurity controls in connection with an information technology service provided to federal agencies. In connection with the settlement, the United States acknowledged that Verizon took a number of significant steps entitling it to credit for cooperating with the government.
Jelly Bean Communications Design LLC (Jelly Bean) and Jeremy Spinks have agreed to pay $293,771 to resolve False Claims Act allegations that they failed to secure personal information on a federally funded Florida children’s health insurance website, which Jelly Bean created, hosted, and maintained.
Aerojet Rocketdyne Inc., headquartered in El Segundo, California, has agreed to pay $9 million to resolve allegations that it violated the False Claims Act by misrepresenting its compliance with cybersecurity requirements in certain federal government contracts, the Justice Department announced today. Aerojet provides propulsion and power systems for launch vehicles, missiles and satellites and other space vehicles to the Department of Defense, NASA and other federal agencies.
Comprehensive Health Services LLC (CHS), located in Cape Canaveral, Florida, has agreed to pay $930,000 to resolve allegations that it violated the False Claims Act by falsely representing to the State Department and the Air Force that it complied with contract requirements relating to the provision of medical services at State Department and Air Force facilities in Iraq and Afghanistan.
Every matter, figure and quoted summary above is the Justice Department's own, taken from its published press releases. Figures are the ones DOJ printed in its headlines, so the total is a floor rather than a sum of what was paid. Allegations resolved by settlement are not determinations of liability.
CMMC Level 2 scoring is based on the DoW Assessment Methodology, which assesses NIST SP 800-171A objectives. The maximum score is 110 points, with a minimum passing score of 88 (80%). Security requirements are valued at 1, 3, or 5 points, and the overall score range is -203 to 110.
Partial credit is allowed for two specific requirements: Multi-Factor Authentication (MFA) and FIPS-validated cryptography. Organizations that achieve a passing score with allowable POA&M items receive a Conditional CMMC Status. A Final CMMC Status is achieved when all requirements are met or the POA&M is closed out within 180 days.
Multi-Factor Authentication (MFA)
FIPS-Validated Cryptography
Platforms that help defense contractors implement, automate, and maintain the controls required for CMMC Level 1 and Level 2 certification.
Continuous compliance automation with a dedicated CMMC program covering NIST SP 800-171 controls, evidence collection, and audit readiness.
Private content network that protects CUI across email, file sharing, and managed file transfer with CMMC Level 2 aligned controls.
Automated GRC platform mapping controls to NIST 800-171 and CMMC with continuous monitoring, policy templates, and auditor collaboration.
Compliance automation that accelerates CMMC readiness with control mapping, evidence collection, and expert-led implementation support.
Managed security platform delivering the MDR, EDR, and SIEM capabilities needed to satisfy CMMC Level 2 assessment requirements.
Continuous compliance platform that streamlines CMMC readiness with automated control monitoring, evidence, and audit workflows.
End-to-end encrypted email and file sharing designed to meet CMMC Level 2 and NIST SP 800-171 requirements for CUI.
Secure file sharing and content collaboration platform with CMMC-aligned controls for storing and transmitting CUI.
Purpose-built CMMC and NIST SP 800-171 compliance platform for tracking controls, SSPs, POA&Ms, and assessment evidence.
Construction program management platform with a CMMC-ready environment for protecting project data and CUI across the supply chain.
Data discovery and classification platform that identifies CUI across enterprise data sources to support CMMC scoping and control.
Listed for reference only · Inclusion is not an endorsement. Validate each platform against your own CMMC scope and assessor guidance.
118 accredited Certified Third-Party Assessment Organizations (C3PAOs) across the United States are authorized to conduct CMMC Level 2 certification assessments.
Cyber AB C3PAO Catalogcyberab.org · Official sourceShowing 118 of 118 C3PAOs
| Company | Location | Contact | Links | Show full details |
|---|---|---|---|---|
123 EFFICIENT CMMC Los Angeles, CA 90022 123 Efficient CMMC, LLC is an Authorized C3PAO by Cyber AB, helping organizations move through the CMMC certification assessment process with speed, clarity, and confidence. 123 CMMC works with organizations and their existing readiness teams, including internal teams, MSPs, MSSPs, consultants, enclave providers, software partners, GovCon advisors, and other trusted advisors. Our goal is to provide a clear C3PAO assessment path without disrupting the trusted teams already supporting them. Our team includes credentialed CMMC, cybersecurity, audit, and compliance professionals with certifications and experience including CISSP, LCCA, CCA, CCP, CISA, CIA, CCSA, PMP, CSX Cyber, SOC, ISO, NIST, and other security and compliance frameworks. | Los Angeles, CA 90022 4555 E 3rd St, Ste 7-117 | info@1cmmc.com +1 626-872-3604 | ||
112CYBER Clearwater, FL 33762 112Cyber meets you where you are, assessing your current environment to determine your needs. Get the comprehensive guidance, education, and tools you need to expedite the cyber compliance process. We provide a full suite of advisory services, and automation software solutions to serve virtually all organizations from small contractors to government agencies to large international corporations. | Clearwater, FL 33762 13577 Feather Sound Dr, Suite 420 | CMMC@112cyber.com +1 727-914-9305 | ||
A-LIGN Tampa, FL 33602 A-LIGN is a proud to serve as a trusted federal assessor with years of government-specific assessment experience, backed by an end-to-end compliance solution designed to assist organizations through the complex federal reporting and authorization process. As one of the fastest growing FedRAMP 3PAOs, with a 100% authorization success rate and over 300 federal assessments completed, A-LIGN routinely and timely delivers the quality reports and certifications government agencies expect of their providers. A-LIGN has a deep domain of federal compliance regulation knowledge including FedRAMP, FISMA, CMMC, NIST SP 800-171, NIST SP 800-53, in addition to multiple commercial compliance frameworks including SOC, ISO, PCI and HITRUST. Get to Know Us Better: CMMC Assessments | Tampa, FL 33602 400 N. Ashley Drive, Suite 1325 | CMMC.Info@a-lign.com +1 888-702-5446 | ||
ACE OF CLOUD INC. Herndon, VA 20171 Ace of Cloud (AOC) is a cybersecurity compliance and cloud security firm specializing in CMMC, FedRAMP, FISMA, and NIST-based security frameworks. Headquartered in Herndon, VA, we provide cutting-edge security solutions to federal agencies, defense contractors, and commercial enterprises. As a C3PAO candidate, AOC is committed to helping organizations achieve and maintain CMMC compliance through expert risk assessments, gap analysis, security architecture, and continuous monitoring strategies. Our team of seasoned cybersecurity professionals brings extensive experience in secure cloud environments, external information system compliance, and security automation to streamline compliance processes. With a mission-driven approach, AOC ensures that clients meet evolving cybersecurity requirements while securing national defense supply chains and critical infrastructure. | Herndon, VA 20171 13873 Park Center Rd., Suite 374 | info@aceofcloud.com +1 813-379-0824 | ||
ANTHONY TIMBERS LLC Fredericksburg, VA 22401 Anthony Timbers LLC is a premier FedRAMP 3PAO, Cybersecurity Consulting Firm, and Managed Security Service Provider (MSSP) specializing in providing CMMC-compliant and certified services to contractors within the Defense Industrial Base (DIB). We are ISO 17020 accredited by A2LA, a proud member of the Cybersecurity Inspection Body Program, and accredited for NIST 800-171, PCI DSS, NIST CSF, as well as network and web application penetration testing under our ISO certification. As a trusted leader in the cybersecurity space, we have conducted over 50 CMMC gap assessments, offering organizations the expertise and guidance necessary to achieve and maintain compliance with the Cybersecurity Maturity Model Certification (CMMC). Our comprehensive services ensure that businesses meet the highest standards for protecting controlled unclassified information (CUI) and federal contract information (FCI). We deliver MSSP services specifically tailored to clients requiring CMMC compliance, leveraging top-of-industry tools to ensure robust cybersecurity and regulatory adherence. Operating using only FedRAMP-authorized tools and environments for infrastructure, we provide secure monitoring, incident response, ongoing vulnerability scanning and patching, Data Loss Prevention (DLP) implementation, and full-scale compliance support designed to protect and streamline operations for defense contractors and other organizations handling CUI. Whether it's preparing for CMMC assessments, performing detailed gap analyses, or ensuring compliance with other critical frameworks, Anthony Timbers LLC provides end-to-end solutions to secure your assets and support your growth in the defense sector. | Fredericksburg, VA 22401 1320 Central Park Blvd, Ste 200 | cmmc@anthonytimbers.com +1 804-596-0596 | ||
APRIO, LLP Atlanta, GA 30319 Aprio: Elite Cybersecurity Compliance Experts for CMMC and FedRAMP Aprio is a leading advisory and assurance firm specializing in federal cybersecurity compliance, with a sharp focus on CMMC and FedRAMP readiness and assessment services. As both an authorized CMMC Third Party Assessment Organization (C3PAO) and a FedRAMP-accredited 3PAO, Aprio delivers deep, actionable expertise to help organizations achieve and maintain compliance with confidence. With over 20 years of experience supporting Department of Defense (DoD) cybersecurity initiatives, Aprio has been a trusted partner in implementing and assessing security controls aligned with NIST SP 800-53 and NIST SP 800-171. We speak DoD. Our team understands not only the technical requirements but also the spirit and intent behind the controls—especially how NIST SP 800-171 was tailored from its NIST SP 800-53 origins to suit non-federal entities. Why Aprio Stands Apart CMMC Thought Leadership Aprio team members have been a trusted voice in CMMC since its inception in 2020, actively participating in stakeholder communities offering interpretations, implementation strategies, and assessment considerations from day one. We bring our deep-rooted experience to every client engagement – assessment or advisory – to offer clarity and confidence in navigating the evolving CMMC landscape. Real-World Control Expertise Our assessors have implemented the very controls they evaluate. This depth of knowledge allows us to provide practical, efficient, and insightful assessments that go beyond surface-level reviews. Senior-Heavy Team for Streamlined Engagements, No Checklist Junkies Here Aprio’s engagements are led by seasoned professionals who know how to ask the right questions from the start. We minimize disruption to your team and avoid repeated data requests, accelerating your path to compliance. Bridging FedRAMP Expertise into CMMC Excellence With deep experience in FedRAMP’s rigorous security frameworks, Aprio brings a nuanced understanding of federal risk management to every CMMC assessment. Our familiarity with cloud authorization processes and NIST controls ensures a more strategic, compliance-ready approach for defense contractors. Accelerate CMMC with Securitybricks Powered by Aprio For our advisory clients, Aprio’s wholly owned subsidiary, Securitybricks offers automation with a human touch. To further streamline CMMC readiness, Securitybricks powered by Aprio offers cutting-edge CMMC Accelerators built on Microsoft O365, Azure, and ServiceNow. These include: CMMC 2.0 Accelerator - Featuring NIST SP 800-171 content, control objectives, and automated questionnaires to simplify internal readiness. Contract Flow-down Accelerator - Tools to manage vendor compliance, track responses, and ensure downstream alignment with CMMC requirements. These accelerators save time, reduce resource strain, and provide a scalable path to CMMC compliance. Account for Anything with Aprio. Explore our Risk Management and Information | Atlanta, GA 30319 2002 Summit Blvd., Suite 102 | 3pao@aprio.com +1 415-321-1831 | ||
ARIENTO INC. Franklin, TN 37064 Ariento has been working closely with the CMMC stakeholders to establish CMMC since the beginning. We hosted one of the first educational conferences (Up On Cyber) with the DoD, National Archives ISOO, and Cyber AB (formerly CMMC AB). Members of our board sat on committees with the creators of CMMC (JH APL and CM SEI) and we have five (5) of the original provisional assessors on staff (full time W2, not contractors), whom have helped more than 300 DIB companies with their CMMC journey. Ariento has more than 50 years of experience in US Federal Government cybersecurity and compliance. We divide our government compliance business into two arms so that companies of all sizes can leverage our expertise. For mid to large contractors, our team of assessors provides best-in-class readiness and advisory services as well as assessments. You can schedule time to speak with our assessor team here. For SMB contractors, we operate managed services that address the NIST SP 800-171/CMMC Level 2 security controls you are required to implement in a cost effective way. For more information, click here to speak with our Managed Services Sales Team. Ariento is a leading B2B cybersecurity, information technology (IT), and regulatory compliance service provider comprised of a veteran team boasting decades of experience in assessments, audits and operational cybersecurity, IT and regulatory compliance at the highest levels of the United States military, federal government, and Fortune 500. With physical CMMC office locations in California, Tennessee and the National Capital Region (NCR), we have and will continue to serve Defense contractors across the United States and abroad. | Franklin, TN 37064 377 Riverside Drive, STE 106 | CMMC@ariento.com +1 848-274-3680 | ||
ATX DEFENSE Austin, TX 78701 WHY ATX DEFENSE? atxdefense.com/c3pao for more info WE UNDERSTAND CYBERSECURITY Founded by Army combat veterans, our team of experts brings national security experience from service in the military, NSA, and CIA. We combine this with decades of management consulting experience to give us a unique “dual-fluency” in the government and commercial sectors. WE'RE OPERATORS, TOO We're not your average "compliance people." With our background in the DoD and in management consulting, we know how important it is to effectively run an assessment with minimal impact on your business operations. We offer fixed-price, all-inclusive assessments (including travel) to shift the administrative burden away from you. WE'RE ALSO AN MSP We believe that CMMC shouldn't be an expensive nightmare. We pioneered the first affordable CMMC managed solution for small businesses. We’re not just offering a product but building a community committed to keeping small businesses in the Defense Industrial Base. For more information, check out atxdefense.com SCHEDULE YOUR ASSESSMENT! To schedule an initial discovery/scoping call with one of our CMMC Certified Assessors (CCAs), reach out through the "Contact Us" button here or via email to cmmc@atxdefense.com. We appreciate your interest and look forward to working with you. INTERESTED IN BECOMING A C3PAO? If you’re working toward C3PAO authorization, the cost and risk of standing up assessment infrastructure shouldn’t stop you. So we’re offering CMMC Space for free to candidate C3PAOs during your authorization phase. Check out https://atxdefense.com/c3pao-authorization/ | Austin, TX 78701 1401 Lavaca St, Unit #7123 | cmmc@atxdefense.com +1 424-249-9959 | ||
AUDITWERX, LLC Tampa, FL 33607 | Tampa, FL 33607 4010 W Boy Scout Blvd, Suite 475 | info@auditwerx.com +1 866-446-4038 | ||
AUGUST SCHELL Rockville, MD 20852 August Schell has helped secure the Defense Industrial Base since 1992. Today we are an authorized CMMC Third-Party Assessment Organization (C3PAO) and a Registered Practitioner Organization (RPO) one of a small number of firms that hold both authorizations. Defense contractors can work with a single trusted name, whether they need to get ready for CMMC or get formally assessed. What we do, across three connected practices Risk & Compliance Official CMMC Level 2 certification assessments (C3PAO), Level 2 and Level 3 mock assessments and readiness evaluations, gap analysis, System Security Plan, POA&M and policy development, and ongoing compliance sustainment (RPO). Level 3 readiness evaluations are structured against NIST SP 800-172 and the 24 enhanced requirements beyond Level 2 — preparing organizations for DCMA-led formal certification. All assessments conducted under ISO/IEC 17020 impartiality controls, including complex environments with multiple CAGE codes, GCC High enclaves, and external service provider dependencies. Managed IT (MSP) Secure CMMC Level 2-aligned CUI enclaves, virtual CIO advisory, continuous monitoring and audit readiness, email security, and asset and mobile device management. Managed Security (MSSP) Virtual CISO and security program management, vulnerability management, and incident response. The CMMC Level 2 third-party assessment requirement is phasing into Department of Defense contracts now. Contractors who prepare early protect their eligibility. August Schell helps you get there and stay there. Based in Rockville, Maryland SEWP V Category C | CAGE: 1W5J9 cmmc@augustschell.com | Rockville, MD 20852 1700 Rockville Pike, STE 405 | cmmc@augustschell.com +1 301-838-9470 | ||
AXIOTROP, LLC Narragansett, RI 02882 | Narragansett, RI 02882 16 Wheatfield Cove Road | joe.devine@axiotrop.com +1 401-480-2082 | ||
ADODO AI Stafford, VA 22554 | Stafford, VA 22554 61 Estate Row, 101 | barbara@adodo.ai +1 202-209-9922 | ||
BARR ADVISORY, P.A. Fairway, KS 66205 BARR Advisory is a security and compliance solutions provider specializing in cybersecurity and compliance for organizations with high-value data that serve regulated industries such as healthcare, financial services, and government. Serving some of the fastest growing cloud-based organizations around the globe, BARR simplifies compliance across multiple regulatory and customer requirements. BARR Advisory services include: Advisory & Managed Services GRC & Engineering Assessments Attestation & Certification BARR services span all major security, privacy, and regulatory frameworks: SOC (SOC 1, SOC 2, SOC 3, and SOC for Cybersecurity) ISO Certification (27001, 27017, 27018, 27701, 42001, 9001, 22301) Healthcare (HITRUST, HIPAA) Government (FedRAMP, GovRAMP, CMMC, DFARS, NIST) Privacy & Data Protection (GDPR, CCPA, GLBA, PCI DSS, CSA STAR, Microsoft DPR) | Fairway, KS 66205 5647 Suwanee Rd. | engage@barradvisory.com +1 888-532-2004 | ||
BLUE MANTLE, LLC (DBA BLUE MANTLE TECHNOLOGY) Sterling, VA 20164 Blue Mantle Technology (BMT) has a diverse clientele ranging from the federal government, including the Department of Defense (DoD) and various civilian agencies, to commercial organizations, which vary in both size and complexity. BMT specializes in delivering high quality information security solutions along with the Subject Matter Experts (SMEs) necessary to address even the most complicated information security needs. BMT's vast experience in the DoD sphere has provided us with a unique appreciation for the vital role a proper and thorough implementation of robust cybersecurity planning and practices play in the commercial world – especially in the world of government contracting with FAR, DFARs, NIST 800-171 and CMMC requirements. Our services are born out of securing some of the most targeted information systems in the world. BMT scales and tailors the demanding standards of the DoD and applies them to the needs of the commercial realm. Additionally, BMT is intimately familiar with the challenges and obligations present in the commercial cybersecurity domain, including, for example, the myriad compliance frameworks companies are bound by. These obligations can place heavy burdens on businesses who may lack the expertise to understand and implement the required controls. Let BMT and our team of experts relieve this weight. We have the knowledge and experience to secure your business, ensure compliance, and do so without “breaking the bank.” All of us, who have operated in the defense industrial base, understand the vital need to protect our countries intellectual property, our nation’s greatest assets, and contribute to our national defense. So, we understand the absolute need for CMMC. However, this does not minimize the difficulty it presents in its proper implementation and the burden it places on the business owner, especially the small business. BMT has the experience and expertise to lighten the load and help you and your team navigate the CMMC wilderness. | Sterling, VA 20164 22580 Glenn Drive, Suite 8 | jgoyette@bluemantletech.com +1 703-944-4776 | ||
BOMBERJACKET NETWORKS Andover, MN 55304 How We Can Help: - CMMC Assessment Readiness Services - GAP Analysis - Scoping Guidance - SSP Building - Security Assessments - Risk Assessments - Evidence Gathering - Incident Response Reporting & Testing - Assessment Role Playing - Assessment OSC Point of Contact - Quarterly Reviews & Documentation Updating - Continuous Monitoring & Alerting - Scheduled Log Auditing | Andover, MN 55304 3260 163rd LN NW, na | mbramm@bomberjacket.net +1 763-639-0170 | ||
BOOZ ALLEN HAMILTON, INC. McLean, VA 22102 Why Booz Allen? As the largest provider of cybersecurity services to the DoD and capabilities to DoD, Booz Allen has been working closely with the Federal Government to establish and refine the new CMMC framework since the beginning. As a trusted advisor to the DoD, Booz Allen consultants work inside the Under Secretary of Defense for Acquisition and Sustainment (USD (A&S)), the epicenter of CMMC inside the Pentagon, helping guide its roll out. Additionally, Booz Allen’s architects are working on building CMMC eMASS which will be used to store CMMC assessment reports and company certificates for the entire DIB. Booz Allen is both a Registered Provider Organization (RPO), providing advisory services to clients in their preparation to obtain their CMMC and an authorized CMMC Third-Party Assessor Organization (C3PAO), assessing clients and awarding them their certificates. Booz Allen is a trusted partner in the success of CMMC across the DIB, building the infrastructure to support it, and guiding clients to the right solutions for their unique CMMC journey. | McLean, VA 22102 8283 Greensboro Dr | rose_cortney@bah.com +1 310-297-5558 | ||
BOSTON GOVERNMENT SERVICES, LLC Oak Ridge, TN 37830 Boston Government Solutions (BGS) stands ready to help organizations achieve their CMMC and cybersecurity program goals. BGS has been providing NIST-compliant assessments since 2007 and completed more than one hundred System Security Plan reviews against NIST SP 800-171, NIST SP 800-53, and NIST SP 800-82. BGS is a CMMC Third-Party Assessment Organization (C3PAO) and Registered Provider Organization (RPO). BGS considers the various business and mission strategies across the Enterprise and delivers solutions to enhance and enable those strategies. BGS directly impacts operational performance by delivering effective and sustainable solutions to meet evolving and emerging needs. BGS enables all sizes of businesses, government contractors and agencies to deliver information in a timely, targeted, prioritized, and actionable manner. BGS is headquartered in Oak Ridge, Tennessee. https://www.bgs-llc.com https://www.bgs-llc.com/cmmc-certification/ | Oak Ridge, TN 37830 105 Mitchell Road, Suite 101 | cmmc@bgs-llc.com +1 866-300-7306 | ||
BUSINESS TRANSFORMATION INSTITUTE, INC. Columbia, MD 21044 BTI has over 20 years’ experience in conducting maturity model/standard-based assessments and in providing training around those maturity models/standards. BTI’s assessors and instructors are experts in their fields and also practitioners who work with the federal government, the US Intelligence Community, and commercial companies. BTI assessors and instructors work as part of the Cybersecurity teas with our customers--at the cutting edge of Cybersecurity--where policy is first established and technologies and strategies are developed. BTI has a cadre of instructors providing training in CMMC, DevOps, DevSecOps, Agile development, CMMI, Lean Six Sigma, and ISO 9001:xxxx. All BTI’s assessors and trainers have experience working in classified environments, with many years of work in identifying, classifying and handling materials. This experience translates directly to a deep understanding of FCI and CUI requirements. Correctly handling sensitive materials is fundamental to doing work, but by itself is not the reason why you are doing the work. Whether you are new to these practices or highly experienced, let our experts help your organization understand, assess, and improve your implementation of CMMC to let you focus on succeeding in your mission. Please visit our website for all of your CMMC assessment, training and consulting needs: www.biztransform.net | Columbia, MD 21044 5950 Symphony Wood Road, Suite 602 | information@biztransform.net +1 240-977-7925 | ||
GUERNSEY Oklahoma City, OK 73112 What Guernsey can do for your business: Guernsey is uniquely qualified to provide consulting and recommendations to clients on implementing CMMC processes. Guernsey can assist with the implementation and operation of CMMC processes. Guernsey can help get your business prepared for a CMMC assessment. Guernsey gets you comfortable reporting compliance documents requested by a prime contractor (allowing you to report your status with a level of confidence). CMMC Readiness Guide Considerations for preparation, assessment, and continued compliance Download the Guide | Oklahoma City, OK 73112 5555 N Grand Blvd | solutions@guernsey.us +1 405-416-8100 | ||
CG SILVERS CONSULTING, LLC Atlanta, GA 30306 Does your organization need a certification assessment to ensure there are no disruptions to your business? CG Silvers Consulting, authorized C3PAO, can help with your certification, including mock assessments, to prepare you for the certification assessment itself. CGSC approaches CMMC assessments like all other engagements: as a team sport. We promise communication, partnership, and a deep understanding of your organization's business needs. | Atlanta, GA 30306 1246 Virginia CT NE | info@cgsilvers.com +1 404-547-2666 | ||
CHECK AZIMUTH Dallas, TX 75231 Check Azimuth is a SDVOSB that provides CMMC Certification, Preparation, and Implementation Services to the DIB and Critical Infrastructure Sector. Check Azimuth's lineage stems from the SOF / SMU / CT / IC community, having spent decades protecting our Nation's competitive advantage at the tactical edge of warfare and now in the digital battlefield. Our Lead CCAs and Security Engineering personnel provide the level of professionalism and CMMC-focused expertise that the DIB and DoD demand and Our Nation needs. Reach out for help wherever you are in your CMMC and Cyber-Resiliency Journey. Check your Azimuth... Move Forward... Continue Mission. Book a Call with Check Azimuth | Dallas, TX 75231 5473 Blair Rd, Ste 100 #219398 | dkim@checkazimuth.com +1 817-505-9121 | ||
CHERRY BEKAERT Tysons, VA 22182 Cherry Bekaert has been focused on serving the Government Contracting Industry for decades. Since established in 1947, Cherry Bekaert has experienced uninterrupted growth and now ranks as one of the Top 25 CPA and Consulting firms in the nation. We offer the highest caliber of personal attention, responsiveness, and accessibility our clients expect and deserve — coupled with the worldwide resources to meet their needs. Today, the Firm comprises a broad network of over 1,300 professionals offering a wide range of quality services to thousands of clients. Our significant growth over the last several years is directly related to our strong commitment to our people and our clients. Cherry Bekaert’s Risk & Accounting Advisory Services practice consists of knowledgeable professionals with expertise in cybersecurity and information assurance. The team comprises information security professionals with sound information and cybersecurity governance experience coupled with deep technical knowledge necessitated to properly identify, mitigate and respond to cyber threats and risks. The team has over 20 years of information security experience ranging from security governance and risk management to technical security assessments including vulnerability management and ethical hacking. Relevant certifications in our Risk & Accounting advisory practice include: Certified Internal Auditor (CIA) Certified Information Systems Auditor (CISA) Certified Public Accountant (CPA) Certification in Risk Management Assurance (CRMA) Certified in Risk & Information System Controls (CRISC) Certification in Control Self-Assessment (CCSA) Certified Credits & Incentives Professional (CCIP) Certified Information Technology Professional (CITP) Certified Valuation Analyst (CVA) Certified TG-3 Auditor (CTGA) Certified in Financial Forensics (CFF) Certified Fraud Examiner (CFE) Certified Ethical Hacker (CEH) Certified Information System Security Professional (CISSP) Certified Information Security Manager (CISM) Certified Common Security Framework Practitioner (CCSFP) | Tysons, VA 22182 1850 Towers Crescent Plaza,, Ste 200 | sursillo@cbh.com +1 401-250-5605 | ||
CISEVE, INC Burlington, MA 01803 CISEVE CISEVE is among the first organizations to achieve accreditation as a Certified Third-Party Assessment Organization (C3PAO) under the U.S. Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) Program by showing that we fully comply with the ISO 17021 stnadards, Focused exclusively on cybersecurity assessment services, CISEVE conducts authorized CMMC Level 2 certification assessments and independent mock assessments designed to evaluate organizational readiness. Our highly experienced, credentialed professionals deliver rigorous, objective, and consistent evaluations aligned with CMMC requirements, DFARS, and NIST SP 800-171. Through a disciplined, evidence-based approach, we help organizations within the Defense Industrial Base understand their cybersecurity posture, address compliance requirements, and prepare confidently for certification. EXPERTISE CISEVE brings decades of collective experience in cybersecurity assessments, federal compliance, and risk evaluation. Our team includes professionals who were among the first Certified CMMC Assessors (CCAs) and Provisional Assessors, providing deep knowledge of CMMC requirements and assessment methodologies. CISEVE approaches every engagement with integrity, precision, impartiality, and consistency. We provide organizations with a clear understanding of their assessment results and compliance obligations while supporting the broader mission of protecting Controlled Unclassified Information (CUI) throughout the defense supply chain. | Burlington, MA 01803 2 Burlington Woods Dr Ste 100 | michael.dempsey@ciseve.com +1 888-424-7383 | ||
CMMC TEAM Grand Rapids, MI 49546 We are committed to the mission of securing CMMC compliance for our customers. Services include advisory or assessments. The CMMC Team is an Authorized C3PAO that prides itself on being objective, reasonable, and willing to go the extra mile for our clients. Contact us for more information: Info@theCMMCteam.com or via phone at (844) 411-CMMC | Grand Rapids, MI 49546 625 Kenmoor Ave SE, Ste 350 | info@thecmmcteam.com +1 844-411-2662 | ||
COHNREZNICK ADVISORY LLC Tysons, VA 22182 CohnReznick is a national advisory, assurance, and tax firm that has a dedicated Cybersecurity, Technology Risk and Privacy (CTRP) Advisory Practice comprised of experts in the evaluation, design, and implementation of cybersecurity and technology risk strategies that allow companies to derive reduced costs and increased value from their IT organization and information security posture. CohnReznick provides independent assessments against the CMMC framework using our holistic cybersecurity risk and government contracting solutions. Our team is well versed with CMMC and has many CCA's, CCP's, and RP's on staff ready to help organizations comply with CMMC requirements. In addition to CMMC expertise and skills, CohnReznick's CTRP practice has significant experience in the following areas: - Security strategy, architecture and integration services - Cybersecurity governance and program design - vCISO - Privacy governance and program design - Enhanced insider threat security mitigation - Compliance/standards-based cyber assessment - Data privacy maturity assessment - Cloud security assessments and strategy - Internet of Things (IOT) risks and security assessments - Blockchain risk and controls assessments - Managed Detection and Response (MDR) services - Security / CISO as a service - Incident Response as a Service - Privacy as a service - System architecture, design, and network performance - Vulnerability assessment and management - Penetration tests - Specialized Technology risk assessments - IT compliance management (CMMC, HIPAA, SOX, FINRA, PCI, GLBA, etc.) - IT security audit (Windows, Unix, AS/400) - IT infrastructure assessments - IT policy and procedure development - Disaster recovery / business continuity | Tysons, VA 22182 8000 Towers Crescent Drive, Ste 1000 | bhavesh.vadhani@cohnreznick.com +1 703-847-4418 | ||
CONTROLCASE LLC Fairfax, VA 22033 ControlCase Info ControlCase is the leading global provider of AI and technology-enabled certification, cybersecurity, and IT compliance services. ControlCase is committed to empowering organizations to develop and deploy strategic information security and compliance programs that are simplified, cost-effective, and comprehensive in both on-premise and cloud environments. ControlCase offers certifications and a broad spectrum of cybersecurity services that meet the needs of companies required to comply with PCI, SOC 2, CMMC, FedRAMP, StateRAMP, GDPR, NIST, NIS2, HIPAA, HITRUST, MARS-E, SWIFT, FFIEC, many areas of ISO, and dozens of other standards. Learn More | Fairfax, VA 22033 3975 Fair Ridge Drive, Ste T25S-D | ewinkler@controlcase.com +1 703-483-6383 | ||
REDSPIN Nashville, TN 37215 Redspin is the leading provider of CMMC and cybersecurity services. Recognized as the first Authorized C3PAO, and as catalysts of the CMMC ecosystem, our experienced CMMC assessment team helps clients gain the advantage of securing and maintaining federal contracts and earn peace of mind knowing their cyber hygiene meets CMMC standards. Our CMMC assessment, training, and consulting services help clients achieve and maintain CMMC certification, control security risk, develop strategies, programs, and processes, and overall avoid a breach headline. Our professional CMMC team understands you are under significant pressure to complete your assessment in order to win and maintain federal contracts, and our collaborative approach makes the CMMC process as seamless as possible. | Nashville, TN 37215 40 Burton Hills Blvd., STE 410 | jeremy.mares@redspin.com +1 888-907-3335 | ||
CYBERNINES LLC Madison, WI 53704 CyberNINES is an authorized C3PAO, providing Compliance Without Complexity® delivering expert assessments, remediation, and full journey consulting to businesses nationwide. CyberNINES is focused on those supporting the U.S. Department of War. The company provides CMMC Level 2 Assessments, advisory services, readiness preparation, and practical expertise designed to help organizations strengthen cybersecurity programs and navigate complex federal compliance requirements. | Madison, WI 53704 2200 Pennsylvania Ave | inquiry@cybernines.com +1 608-512-1010 | ||
CYBERRX, INC. Silver Spring, MD 20910 CMMC Assessments with No Drama, No Fuss, No Surprises At CyberRx, we make CMMC assessments straightforward, efficient, and stress-free. Our experienced, collaborative team delivers CMMC Level 2 assessments and mock assessments with clarity and efficiency—without the chaos, complexity, or unexpected roadblocks. We work with enterprises of all sizes, with a focus on organizations that own, operate, or support U.S. critical infrastructure, including the Defense Industrial Base. Here's what you can expect working with CyberRx. No Drama – Clarity over confusion, facts over speculation—we bring expertise, not guesswork No Fuss – A structured, straightforward approach that keeps the process simple No Surprises – Transparency at every step so you know exactly what to expect Whether you're an Organization Seeking Certification (OSC) or an Organization Seeking Assessment (OSA), we’re here to make your compliance journey smoother. Let’s connect. Reach out today to discuss your CMMC goals! https://cyber-rx.com | Silver Spring, MD 20910 8403 Colesville Road, Suite 1100 | info@cyber-rx.com +1 301-755-0479 | ||
CYBERSEC INVESTMENTS Melbourne, FL 32901 Cybersec Investments is an Accredited Cybersecurity Maturity Model Certification (CMMC) 3rd Party Assessment Organization (C3PAO) and Service-Disabled Veteran-Owned Small Business (SDVOSB) located in Melbourne, Florida. We are the only Authorized C3PAO on the entire eastern Florida coast. We have over 30 years of Department of Defense (DoD) cybersecurity experience. We specialize in assisting organizations in the defense industrial base (DIB) meet CMMC, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 and Defense Federal Acquisition Regulation Supplement (DFARS) compliance. | Melbourne, FL 32901 1900 S Harbor City Blvd., Suite 340 | info@cybersecinvestments.com +1 800-960-8802 | ||
CYNTELL Bethesda, MD 20817 CyNtell (CyNtelligent Solutions, LLC) is an Authorized C3PAO by Cyber AB, based in Bethesda, Maryland, helping organizations across the Defense Industrial Base move through the CMMC certification assessment process with clarity and confidence. Since 2016, CyNtell has built extensive experience in the cybersecurity and compliance world, supporting organizations with practical, real-world guidance as regulatory frameworks and cyber threats have evolved. To preserve assessor independence, our C3PAO assessment services are delivered separately from our advisory offerings. Organizations preparing for certification can work with our advisory team for CMMC readiness support, vCISO services, managed security, and cybersecurity training while our C3PAO team conducts objective, independent third-party assessments. Whether you're preparing for certification or ready for a formal CMMC assessment, CyNtell offers a clear, credible path forward. | Bethesda, MD 20817 6701 Democracy Blvd, Suite 300 | info@cyntell.com +1 833-296-8355 | ||
DATASOFTNOW, INC. Melville, NY 11747 What Makes DataSoftNow the Best Choice for Your CMMC Journey? Proven Track Record of Success DataSoftNow’s approach is built on years of refinement, utilizing the same policies, procedures, and workflows that enabled us to successfully achieve CMMC Level 2 certification for our own organization. Having personally navigated the complexities of the certification process, we bring invaluable firsthand experience to every client we serve. Our proven approach ensures that your organization is not only prepared for the CMMC assessment but also positioned for ongoing cybersecurity strength. By leveraging our practical experience, your organization gains access to reliable, time-tested strategies that streamline compliance, minimize disruptions, and enhance your long-term cybersecurity posture. Customized Solutions for Every Organization Whether you're a small business just starting your compliance journey or a large enterprise seeking to refine your cybersecurity practices, DataSoftNow delivers tailored solutions designed to fit your unique needs. We understand that one size does not fit all—our approach is personalized to help you achieve the highest level of cybersecurity maturity that aligns with your specific goals. Comprehensive, End-to-End Support With DataSoftNow, you get more than just an assessment—we’re your full-service partner throughout the entire process. From initial consultation and gap analysis to final certification and ongoing compliance support, we ensure every step of your CMMC journey is expertly managed. We’re here to guide, support, and empower your organization, helping you secure a stronger, more resilient future. Expert Assessors with Deep Industry Knowledge Our assessors are Cyber AB-approved, highly certified, and bring a wealth of experience in federal cybersecurity frameworks. We are deeply familiar with the nuances of the CMMC model and the specific needs of different industries. When you work with DataSoftNow, you’re benefiting from a team that not only meets but exceeds the high standards set by the Cyber AB marketplace. Future-Proof Your Organization’s Cybersecurity Achieving CMMC certification is just the beginning. At DataSoftNow, we focus on long-term success. Our team helps you establish a culture of continuous improvement, ensuring your cybersecurity practices remain cutting-edge and ready to adapt to future challenges. Stay ahead of emerging threats and keep your systems secure with our ongoing support and monitoring services. OUR SERVICES CMMC Assessments & Certification We provide thorough, independent assessments aligned with the CMMC framework, ensuring your organization is fully prepared for certification. We evaluate your cybersecurity policies, processes, and systems, identify any gaps, and offer actionable solutions to ensure compliance. CMMC Level 2 Certification Preparation Our CMMC Level 2 preparation services are specifically designed to help your organization establish a compliant cybersecurity posture. We assist in identifying and closing gaps in your controls, procedures, and policies, ensuring readiness for assessment and certification. Gap Analysis & Remediation Services DataSoftNow performs a comprehensive gap analysis to identify discrepancies between your current cybersecurity practices and CMMC requirements. We offer clear recommendations and remediation services to address any vulnerabilities before your formal assessment. Ongoing Compliance Support & Monitoring Achieving CMMC certification is just the first step. DataSoftNow provides continuous monitoring and post-certification support to help you stay compliant, adapt to evolving threats, and keep pace with new standards and regulations. Incident Response & Recovery Planning DataSoftNow offers incident response and recovery planning services, preparing your organization for potential cybersecurity incidents. We help you design and implement a robust response plan to minimize disruption and swiftly recover from any security breaches. Risk Assessment & Vulnerability Testing We conduct thorough risk assessments and vulnerability testing to identify weaknesses in your system. Our team provides actionable insights and a roadmap for mitigating risks and bolstering your cybersecurity infrastructure. Take the Next Step Toward Certification with DataSoftNow Are you ready to enhance your cybersecurity practices, safeguard sensitive data, and position your organization for success with federal contractors? Partner with DataSoftNow and let us help you navigate the Cyber AB Marketplace with confidence. Why choose DataSoftNow? Because we don’t just meet compliance standards—we help you exceed them. Contact us today to start your CMMC journey with the most trusted C3PAO in the Cyber AB Marketplace! EMAIL: cmmc@datasoftnow.com CALL: 347-658-5001 WEB: https://www.datasoftnow.com/cmmc Tom Nohs | Melville, NY 11747 145 Pinelawn Rd., Ste: LL135S | tnohs@datasoftnow.com +1 347-658-5001 | ||
DEMASE TECHNICAL SERVICES, LLC Powell, TN 37849 DeMase Technical Services is a trusted partner for advanced CMMC and cybersecurity services. We specialize in delivering top-tier CMMC compliance and cybersecurity solutions. At DeMase, we offer comprehensive CMMC services. Whatever you need for your CMMC journey, we can help. Need assistance getting CMMC-compliant? We will provide assessors that know what it takes to be compliant to help you get ready. Ready to be assessed? We provide an expert, experienced assessment team who understand operational needs as well as compliance requirements to perform your assessment. Certified and need help staying compliant? We provide compliance as a service to keep you compliant. Our seasoned CMMC assessment team empowers clients to secure and retain federal contracts while ensuring their cybersecurity posture meets rigorous CMMC standards—delivering confidence and peace of mind. | Powell, TN 37849 5300 W Emory Road | bmase@demase-tech.com +1 865-898-7677 | ||
DTC Albuquerque, NM 87109 Schedule your free 30-minute initial consultation at: https://www.dtcnm.com/consultation/ AT DTC, OUR WORD IS OUR BOND. DTC, LLC is a veteran owned, engineering and information system security company supporting clients in the areas of systems engineering, computational modeling and simulation, cybersecurity, cyberspace operations, vulnerability assessments, and penetration testing. DTC provides superior service, tailored to meet the needs of our customer and demonstrated with excellence that exceeds all expectations. We foster a foundation of trust through honesty, dedication, competence and integrity so you are delivered a top quality product, every time… | Albuquerque, NM 87109 7600 American Heritage Dr NE | shawn.dickman@dtcnm.com +1 505-850-6508 | ||
DIGITAL BEACHHEAD Colorado Springs, CO 80917 Digital Beachheadis a Certified Service Disabled Veteran Owned Small Business providing vCISO services to a range of clients around the world. | Colorado Springs, CO 80917 4980 Iron Horse Trl | mike@digitalbeachhead.com +1 866-879-1226 | ||
DUNLOP SECURITY GROUP Charlotte, NC 28217 Dunlop Security Group (DSG) is a family-owned and operated C3PAO helping DoD contractors achieve and maintain CMMC Level 2 compliance with confidence. We combine deep technical expertise with a practical, security-first approach to guide organizations from initial readiness through final certification. Our services include: Official CMMC Level 2 Assessments Certified, independent assessments conducted in accordance with CMMC requirements, delivering clear results and a smooth path to certification. Mock Assessments and Readiness Reviews Identify gaps before your official audit with detailed evaluations aligned to CMMC and NIST SP 800-171, along with actionable remediation guidance. Compliance Support Hands-on support to implement, document, and mature your security controls so you are fully prepared for assessment. | Charlotte, NC 28217 6241 South Blvd, #240088 | info@dunlopsecuritygroup.com +1 980-362-3161 | ||
ECFIRST Waukee, IA 50263 Established in 1999, ecfirst delivers, end-to-end, flexible, and tailored, compliance and cybersecurity services across the U.S. and five continents. ecfirst is humbled to be devoted to the CMMC ecosystem as a LPP, LTP, RPO and C3PAO Candidate firm. Both of ecfirst's CMMC CCP and CCA training programs are approved! To view our upcoming CCP and CCA class schedule, please visit www.ecfirst.biz. The ecfirst CCP and CCA programs are delivered virtually, as well on a public schedule, and can be delivered on-site. Cyber services have been successfully delivered by ecfirst to 1,000s of clients and are focused in the areas of HITRUST, NIST, HIPAA, GDPR, CCPA, CMMC, ISO 27001, PCI DSS, and more. The industries served by ecfirst include healthcare, government, IT, financial services, legal, and education. From Managed Compliance Services Program (MCSP) to On-Demand Consulting (ODC), ecfirst delivers its services with complete devotion to client requirements. Thought leadership and knowledge transfer are at the core of ecfirst created certification credentials, including the Certified HIPAA Professional (CHP), Certified Security Compliance Specialist (CSCS) and the Certified Cyber Security Architect (CCSA) programs. ecfirst is a HITRUST Authorized External Assessor and a HIMSS Approved Education Partner. ecfirst has successfully achieved the HITRUST i1 and r2 Certifications. ecfirst is a 100% minority owned organization. ecfirst is proud to have presented frequently at FBI InfraGard conference events. More information is at www.ecfirst.com. | Waukee, IA 50263 295 NE Venture Drive | casey.mcloughlin@ecfirst.com +1 949-528-5224 | ||
EDWARDS PERFORMANCE SOLUTIONS Columbia, MD 21044 Edwards Performance Solutions is an authorized C3PAO, dedicated to providing trusted cybersecurity assessments for organizations seeking CMMC certification. We use our extensive knowledge of the CMMC ecosystem (ATP, APP, RPO, and authorized C3PAO) to ensure you are compliant with the latest standards. Edwards was among the first to be authorized to conduct formal assessments, solidifying our leadership and expertise in the field. Our experienced cybersecurity team brings a wealth of knowledge in interpreting and applying the CMMC framework, ensuring that each assessment is thorough, transparent, and aligned with industry best practices. By combining real-world expertise with our comprehensive approach, we help organizations confidently navigate the certification process. Learn more about our C3PAO services here: https://edwps.com/cmmc. | Columbia, MD 21044 10980 Grantchester Way, Suite 300 | info@edwps.com +1 443-561-1334 | ||
EIDE BAILLY LLP Denver, CO 80237 For over 100 years, Eide Bailly has built a reputation of trust and excellence in delivering attestation and advisory services. Today, we extend that same dedication to the Federal government as a trusted third-party assessor. Our team of certified professionals is committed to helping organizations navigate complex federal security frameworks, including FISMA, CMMC, NIST 800-171, and NIST 800-53. Whether you're just getting started with these standards or already experienced, we make your compliance journey seamless, efficient, and accurate from the start. We understand the pressures you face to secure federal contracts. With a collaborative and transparent approach, we streamline the CMMC process, so you can focus on your mission with confidence, knowing your compliance is in expert hands. | Denver, CO 80237 7001 E Belleview Ave, #700 | aerickson@eidebailly.com +1 208-383-4731 | ||
EMAGINE IT North Bethesda, MD 20852 OUR MISSION At Emagine IT (EIT), our mission is to deliver where it matters most—on the front lines of national security, public health, and financial resilience. We empower government and industry leaders to navigate complexity with confidence by aligning cutting-edge technology with purpose. Through secure, scalable solutions in infrastructure, cybersecurity, AI automation, and digital transformation, we help agencies modernize faster and respond smarter. Backed by elite talent and driven by accountability, we take full ownership of the mission— because success isn’t a pledge— it’s a responsibility we own. OUR CORE CAPABILITIES EIT delivers technical excellence and customer focused innovation in enterprise architecture, infrastructure, cybersecurity, AI-driven automation, and compliance for government and private-sector clients. For more than 20 years, EIT has fostered a culture of collaboration, ensuring measurable impact in govtech, federal contracting, and digital transformation. | North Bethesda, MD 20852 909 Rose Avenue, Suite 900 | C3PAO@eit2.com +1 202-587-5607 | ||
EMERALD TECHNICAL SOLUTIONS Havre de Grace, MD 21078 Overview At Emerald Technical Solutions, we recognize the dedication and resilience of businesses that partner with the U.S. Government particularly those in the defense and technology sectors who strive to contribute to our nation's security and prosperity. These businesses, like ours, play a critical role in keeping our nation strong for generations to come. However, the unfortunate reality is that adversaries specifically target small businesses and government contractors in an effort to steal, corrupt, or destroy sensitive data, such as intellectual property, federal contract information, and other critical resources. These cyber threats threaten our national security, and small businesses are especially vulnerable. We understand that implementing effective security, creating policies, and establishing technical solutions is a complex, resource-intensive process. For many small businesses, it’s overwhelming. That's why Emerald is committed to supporting our clients with robust compliance frameworks, including CMMC. As an C3PAO, ISO 27001 and ISO 9001 certified company, we bring extensive experience in cybersecurity, cloud technologies, and business processes to guide you toward compliance and protection. Our team is comprised of certified cyber experts Certified CMMC Professionals (CCPs), and Certified CMMC Assessors (CCAs) all working diligently to secure your business and ensure you meet the highest security standards. How Emerald Can Help CMMC Consulting and Implementation: We work closely with businesses to analyze their operations, information flows, and systems. Our team provides tailored solutions that not only bring you into full compliance with CMMC but also ensure your readiness for audits and contract renewals. We specialize in network management, cybersecurity monitoring, process consulting, workflow development, and IT services all designed to keep you ahead of evolving cybersecurity threats. MSFT Enclaves: We offer cloud-based (Azure) enclave GCC solution that accelerate your CMMC implementation. CMMC Compliance Program Management: Compliance isn’t just a one-time event it’s an ongoing commitment. Our management system helps ensure that your CMMC compliance is sustainable year after year. With full visibility into your policies, procedures, and operational functions, we help you maintain security and confidently attest that your business safeguards CUI. Partnering with Emerald means equipping your business with the expertise and tools to protect your sensitive information from cyber threats, allowing you to focus on delivering exceptional service to our nation. Together, we’ll strengthen national security, ensuring that your business thrives in a secure, compliant environment. Contact Emerald today and take the first step toward securing your contracts, business and contributing to the defense of our country. | Havre de Grace, MD 21078 203 Market Street, STE 301 | cmmc@emeraldsolutions.tech +1 443-730-5684 | ||
EVOLVED CYBER, LLC Ellicott City, MD 21043 | Ellicott City, MD 21043 5033 Brampton Parkway | bhubbard@evolvedcyber.com +1 410-375-7180 | ||
FD CYBER DEFENSE Alpharetta, GA 30009 About FD Cyber Defense FD Cyber Defense offers our clients some of the most experienced consultants in the industry. Most of our consultants served in information security roles within the US Armed Forces, and all are trained on the intricate details of NIST-based cybersecurity. Our consultants have experience working with companies that include non-profit organizations, start-up companies, colleges and universities, the largest global Fortune 500 corporations, and every sized company in between. Our consultants hold multiple industry certifications including: Certified Information Systems Security Professional (CISSP) Certified Secure Software Lifecycle Professional (CSSLP) Certified Information Security Manager (CISM) Certified Information Systems Auditor (CISA) ISO 27001 Lead Auditor and Lead Implementor Lead CMMC Certified Assessor (Lead CCA) Payment Card Industry (PCI) Qualified Security Assessor (QSA) | Alpharetta, GA 30009 2710 Old Milton Pkwy, Suite 250 | bryan.bell@fdcyberdefense.com +1 404-573-4200 | ||
FITS Arlington, VA 22202 FITS is both a CMMC C3PAO and RPO and has deep federal and commercial experience with advisory and assessment services for over 25 years. First Information Technology Services (FITS), established in 2000, is a minority-owned and veteran-owned consulting firm specializing in cybersecurity. Operating from its headquarters in Arlington, Virginia, and with a secondary office in Bellevue, Washington, FITS has a proven track record of serving both public and private sector clients. Our expertise is particularly evident in managing complex cybersecurity compliance programs for prominent federal entities, including the Department of Homeland Security and the U.S. Coast Guard. This deep experience in the public sector has effectively translated into the commercial market, where FITS has played a crucial role in assisting major cloud service providers like Microsoft, Google, and GitHub in securing Federal Risk and Authorization Management Program (FedRAMP) and Department of Defense (DoD) Security Requirements Guide (SRG) Authorizations. Our success stems from a team with robust operational backgrounds and a commitment to quality delivery. Our personnel have deep technical expertise and broad industry experience, resulting in highly certified and qualified individuals. Our work is supported by the maturation of our program management process and our attention to quality. FITS's approach to program management has earned multiple certifications: CMMI Level 3, ISO 9001:2015, ISO 27001:2022, and ISO 17020:2012. These certifications demonstrate our effective process improvement practices, our ability to meet customer and regulatory requirements consistently, and our robust Quality Management System for assessment/audit support services. | Arlington, VA 22202 2461 South Clark Street, STE 830 | sales@firstinfotech.com +1 703-872-0507 | ||
FORTREUM, LLC Lansdowne, VA 20176 Fortreum is an authorized CMMC Registered Practitioner Organization (RPO) and Third-Party Assessment Organization (C3PAO) with highly certified team ready to support all your CMMC compliance assessment or advisory needs. With over 40 years of combined cybersecurity experience, Fortreum delivers expert guidance and services in regulatory compliance, assessments, program management, security package preparation, and certification readiness for government and commercial organizations. As a leading U.S Public Sector assessment and advisory firm, Fortreum has the expertise and proven knowledge to help clients with the right blend of technical and analytical experience to support their cybersecurity and cloud needs. Fortreum possesses extensive expertise in federal compliance regulations, including CMMC, NIST SP 800-171, ITAR, EAR, DFARS regulations, FedRAMP, FISMA, CJIS, and NIST SP 800-53, as well as commercial frameworks such as SOC, ISO, PCI, and HITRUST. Fortreum’s team of experts ensure your organization understands the requirements. Our straightforward approach can provide your organization with a cost-effective framework and roadmap to manage your cybersecurity program. CMMC RPO Advisory Services include: Controlled Unclassified Information (CUI) Boundary Analysis CMMC and NIST SP 800-171 Readiness Gap Analysis CMMC Documentation Package Development Security and Compliance Program Management and vISSO Support CMMC Assessment Preparation Vulnerability Management Cyber Foundations CMMC C3PAO Assessment Services include: Controlled Unclassified Information (CUI) Boundary Analysis CMMC and NIST SP 800-171 Workshops CMMC Gap Assessments CMMC C3PAO Assessment. By seamlessly integrating CMMC with deep expertise cultivated through work with the U.S. government and public sector, Fortreum establishes strong, comprehensive security and compliance foundations tailored to your organization’s unique needs. Our team of experts brings firsthand experience navigating complex regulatory landscapes, ensuring your cybersecurity posture aligns with industry best practices and federal requirements. With Fortreum as your partner, you gain the confidence to protect critical assets, maintain regulatory readiness, and drive long-term business success in an increasingly complex digital landscape. | Lansdowne, VA 20176 19301 Winmeade Dr Suite 250 | info@fortreum.com +1 571-831-3759 | ||
FORVIS MAZARS Charlotte, NC 28209 Forvis Mazars, a top 10 global network* is the largest new entrant into the global rankings in decades. As a two-firm network, Forvis Mazars is unique in the market and provides the agility, capacity and coverage to support clients wherever in the world they operate. This move brings increased choice in the market, serving the public interest. | Charlotte, NC 28209 4350 Congress Street, Suite 900 | tom.tollerton@forvis.com (704) 367-7061 | ||
GMS REGISTRAR LTD Cleveland, OH 44143 | Cleveland, OH 44143 89 Alpha Park | akottha@gmsaudit.com +1 440-460-1760 | ||
GRAY ANALYTICS INC. Huntsville, AL 35802 In a world filled with complex threats, Gray Analytics brings clarity to the critical mission of cybersecurity. As a cybersecurity risk management company, we provide best-practice services across a broad spectrum of cyber scenarios, from Hypersonics Engineering to Enterprise Cybersecurity, for both government and commercial customers. We start by helping you define your biggest threats, with proven follow-through for managing and defending critical ecosystems. And for government contractors we offer CMMC 2.0 Audit and Advisory support that is second to none. Cybersecurity can seem like one big gray area. At Gray Analytics, we’ve got that covered. | Huntsville, AL 35802 885 Haysland Rd SW,, Suite 302 | Sales@grayanalytics.com +1 256-384-4729 | ||
GSC Knoxville, MD 21758 Guardianshield Cybersecurity (GSC) Authorized C3PAO | Veteran-Founded | NIST 800-171 Experts GSC is a premier cybersecurity firm and Authorized C3PAO specialized in preparing the Defense Industrial Base (DIB) for assessment. We move organizations from "Unsure" to "Audit-Ready" through rigorous, defensible, and standards-driven validation. Our Core Capabilities 1. NIST 800-171 Gap Analysis Comprehensive evaluation of your current cybersecurity posture against all 110 controls. We deliver an accurate SPRS score and a prioritized roadmap to address compliance deficiencies. 2. Remediation & Advisory Expert support for SSP development, policy generation, and POAM closure to achieve a sustainable, audit-ready state. (Note: Advisory services are distinct from Certification to maintain independence). 3. Mock Level 2 Assessments A rigorous simulation of the formal C3PAO assessment process including objective evidence review and personnel interviews to validate readiness and mitigate audit risk. 4. Formal CMMC Level 2 Assessments Authorized certification assessments conducted in strict accordance with the CMMC Assessment Process (CAP), culminating in final scoring and eMASS submission. Why GSC? We integrate federally validated professionals into your delivery teams. Our model ensures strict adherence to NIST SP 800-171 and 800-53, producing deliverables that withstand regulatory scrutiny. Contracting Data Certified MD MBE (#24-506) and MD VSBE (#VB24-052267). We offer a low-overhead, fixed-cost operational model designed for Prime Contractor agility. | Knoxville, MD 21758 Deer Path | info@guardianshieldcyber.com +1 757-819-8120 | ||
H2L SOLUTIONS, INC. Huntsville, AL 35805 H2L Solutions, Inc. is your reliable and mission-driven partner for achieving Cybersecurity Maturity Model Certification (CMMC) compliance. As an Authorized Third-Party Assessor Organization (C3PAO) and active Defense Industrial Base (DIB) contractor, we understand the unique challenges you face because we’ve faced them too. Our team brings firsthand experience, technical expertise, and a practical approach to help your organization navigate CMMC requirements with confidence and clarity. WHY CHOOSE H2L SOLUTIONS? Proven Results and Expertise H2L Solutions has a strong track record of guiding clients through successful CMMC assessments. Our assessors and compliance experts make the process clear, efficient, and effective every time. Defense Contractor Perspective As a long-standing DIB contractor, we bring a real-world understanding of DoD cybersecurity requirements. Our team provides practical, actionable guidance that goes beyond checklists helping you meet compliance in a way that supports your operations. Dedicated Assessment Teams With multiple certified assessors and dedicated assessment teams available year-round, H2L ensures timely, flexible scheduling with no uncertainty or unnecessary delays. Affordable, High-Value Services H2L Solutions delivers cost-effective compliance services without sacrificing quality. We’re committed to making cybersecurity and certification achievable for organizations of all sizes. We Value Partnerships At H2L Solutions, our mission is to protect those who protect us. We bring the same integrity, expertise, and precision to your CMMC journey that we bring to supporting the defense community every day. H2L Solutions, Inc. – Secure Today. Ready for Tomorrow. H2L Solutions, Inc. is dedicated to helping your organization confidently navigate the complexities of CMMC certification and compliance. Whether you need support with implementation, remediation, or assessment readiness, our experienced cybersecurity professionals are here to guide you every step of the way. Please note: In accordance with Cyber AB ethical guidelines, H2L Solutions, Inc. cannot perform certified CMMC assessments for any organization that has received our CMMC advisory or consulting services within the past three years. CONTACT US Jonathan Hard | President and CEO jonathan.hard@h2lsolutions.com Robyn Carter | robyn.carter@h2lsolutions.com Cassie Scott | cassie.scott@h2lsolutions.com | Huntsville, AL 35805 2227 Drake Ave, Building 5 | info@h2lsolutions.com +1 256-679-9427 | ||
HIVE SYSTEMS DEFENSE SOLUTIONS Richmond, VA 23219 Why Partner with Us? Choosing Hive Systems Defense Solutions means partnering with a team committed to delivering exceptional cybersecurity services. Our approach is collaborative and tailored to your organization's unique needs, ensuring a seamless path to compliance. With our deep industry expertise and dedication to excellence, we empower defense contractors to navigate the complexities of CMMC requirements confidently. Our Expertise Hive Systems Defense Solutions is led by President Katie Dodson, a cybersecurity expert with over a decade of experience across both public and private sectors, including notable roles with the Department of the Air Force and the Defense Cyber Crime Center (DC3) under the DoD. Katie's extensive background in cybersecurity risk assessments, compliance frameworks, and threat intelligence analysis provides our clients with unparalleled insights into protecting sensitive government data. Her credentials include a Master of Science in Cybersecurity from the University of Maryland Global Campus and certifications such as Certified Information System Security Professional (CISSP), Certified Information Security Auditor (CISA), and Lead Certified CMMC Assessor (CCA). Our Services At Hive Systems Defense Solutions, we offer a comprehensive suite of services tailored to meet your CMMC compliance needs: CMMC Readiness Assessments: Our team of Certified CMMC Assessors (CCAs) and Certified CMMC Professionals (CCPs) conducts thorough evaluations of your current cybersecurity controls, identifying gaps and providing actionable remediation plans to align with CMMC requirements. Remediation Planning and Implementation: We develop and help implement customized strategies to address identified deficiencies in your CMMC readiness, ensuring your organization meets the necessary requirements to pass your CMMC assessment. Mock Assessments: To prepare your team for the official evaluation, we offer mock assessments that simulate the CMMC certification process, providing valuable experience and identifying areas for improvement before (or as a part of) the formal assessment. Official CMMC Certification Assessments: As an authorized Certified Third-Party Assessment Organization (C3PAO), we conduct formal CMMC Level 2 certification assessments, enabling your organization to secure and maintain DoD contracts. Actionable Free CMMC Resources We believe in empowering defense contractors with the tools needed to understand and navigate CMMC compliance. That’s why we offer free resources on our website to help you stay ahead: CMMC Compliance Guides: Easy-to-follow guides explaining the CMMC framework, security controls, and requirements. Self-Assessment Tool: Our free tool that takes you step-by-step through the CMMC Level 2 assessment objectives, and calculates your score using the official DoD Scoring Methodology to evaluate your current cybersecurity posture, identify necessary improvements, and provide you with your calculated SPRS score. Webinars and Training Videos: On-demand educational content featuring cybersecurity experts breaking down CMMC requirements and best practices. System Security Plan Templates: Ready-to-use templates to help you document a robust and CMMC-compliant System Security Plan, including a NIST 800-171 Revision 3 version to help you plan for future CMMC enhancements. Ready to Accelerate Your Journey to CMMC Certification? Secure your company's future by ensuring compliance with DoD cybersecurity standards. Contact Hive Systems Defense Solutions today to learn how we can assist you in achieving and maintaining CMMC certification. | Richmond, VA 23219 26 N 8th St, Suite A | katie.dodson@hivesystems.com +1 804-234-4310 | ||
IBSS CORP Silver Spring, MD 20910 Our C3PAO status validates the maturity of our assessment practices and authorizes IBSS to perform the following: Official CMMC Assessments: Conduct independent, third-party assessments necessary for DIB companies seeking CMMC certification at various maturity levels. Impartial Validation: Provide objective and reliable verification of a contractor’s implementation of CMMC practices and processes. Quality Assurance: Operate under a strict quality management system that aligns with DoD and Cyber AB standards for assessment quality, consistency, and integrity. | Silver Spring, MD 20910 1110 Bonifant, St #315 | c3pao@ibsscorp.com +1 301-942-9014 | ||
IGNYTE PLATFORM INC. DBA IGNYTE FEDERAL Centerville, OH 45459 | Centerville, OH 45459 5818 Wilmington Pike, #220 | max@ignyteplatform.com +1 937-789-4216 | ||
INIT CYBER, LLC Canton, GA 30115 | Canton, GA 30115 104 Widgeon Court | info@initcyber.com +1 678-631-8376 | ||
INSIGHT ASSURANCE Tampa, FL 33602 Simplify your path to compliance. We provide independent high-quality audit services to organizations looking to build trust while increasing security and reducing risk. | Tampa, FL 33602 400 N. Tampa St., 15th Floor - Suite 129 | info@insightassurance.com +1 877-607-7727 | ||
INTEGRATED QUALITY CORPORATION Chantilly, VA 20153 Company Overview Established in 2015, Integrated Quality Corporation (IQC) is a trusted authority in cybersecurity compliance, quality assurance, and organizational performance. As an Authorized CMMC Third-Party Assessment Organization (C3PAO), IQC is authorized to conduct official CMMC Level 2 assessments, supporting defense contractors across the Defense Industrial Base (DIB) in achieving and maintaining compliance with DoD cybersecurity requirements. Our leadership includes a CMMI Lead Appraiser, Quality Expert, Performance Advocate, and Technical and Security SME with deep expertise in federal cybersecurity standards, compliance frameworks (CMMC, NIST SP 800-171, ISO 27001:2022, DFARS 7012/7019/7020), and operational risk management. This multidisciplinary background ensures that every CMMC engagement is executed with precision, integrity, and mission-aligned understanding. CMMC Level 2 Assessment Services As a C3PAO authorized by the CyberAB and DoD, IQC delivers full-lifecycle CMMC Level 2 assessment services that ensure defense contractors are prepared to safeguard Controlled Unclassified Information (CUI) and meet the cybersecurity requirements for DoD contracts. Our services include: CMMC Level 2 Certification Assessments Formal, objective evaluations of contractor environments based on the CMMC Assessment Guide (L2) Conducted by certified CMMC Provisional Assessors and in coordination with the CyberAB ecosystem Includes artifact validation, objective evidence collection, and detailed scoring against the 110 practices from NIST SP 800-171 Pre-Assessment Readiness Services Non-certification services to help organizations prepare for formal assessments Includes gap assessments, document and control reviews, evidence coaching, and readiness scoring Aligned with ethical boundaries for C3PAOs—strict separation of consulting and certification services Remediation Support & Clarification Reviews Post-assessment clarification and closeout support to help organizations resolve open findings (POA&M support not provided directly, but guidance on acceptable resolutions) Ensures efficient completion of the certification process without compromising independence or objectivity Secure Assessment Operations All assessments are conducted through secure, compliant environments ensuring protection of sensitive client data Transparent engagement approach, collaborative assessment scheduling, and audit-trail-based evidence handling Why IQC? IQC brings a unique advantage to CMMC assessments by combining technical cybersecurity depth with proven quality assurance and process maturity expertise. Our team not only understands how to measure compliance—we understand how high-performing organizations operate, secure, and evolve. With IQC, defense contractors gain more than a certification partner—they gain a trusted assessor who values clarity, integrity, and the mission of protecting national defense through secure and compliant supply chains. | Chantilly, VA 20153 PO Box: 221012 | mark@iq-corp.com +1 571-265-7115 | ||
IPOWER LLC Reston, VA 20195 As a Authorized CMMC Third-Party Assessment Organization (C3PAO) and under Deborah Hunt's leadership, iPower is ready to lead your official CMMC Level 2 assessment! Our Certified CMMC Assessment team will review tangible artifacts, conduct interviews, and observe tests to evaluate compliance with applicable CMMC requirements. Following completion of the assessment, iPower will provide an assessment report noting any findings and deficiencies. They'll perform a quality review and report results in accordance with the CMMC Assessment process and DoD guidelines. As an organization that has achieved CMMC L2 ourselves, iPower not only understands how to assess but also how to implementation comes in many varieties. Choose iPower for your CMMC assessment needs! Visit our website to learn more: www.ipowerllc.com | Reston, VA 20195 P.O. Box 8624 | dhunt@ipowerllc.com +1 703-338-7436 | ||
IS PARTNERS LLC Dresher, PA 19025 IS Partners, LLC is an audit and compliance advisory firm headquartered in Pennsylvania that provides assurance, risk management, and regulatory compliance services to organizations in highly regulated industries. The firm focuses on helping clients meet information security, data protection, and internal control requirements by delivering both readiness assessments and formal audit engagements. Its practice spans SOC 1, SOC 2, and SOC 3 examinations, internal audit outsourcing, and compliance programs aligned to frameworks such as PCI DSS, HIPAA, HITRUST, ISO 27001, NIST, GLBA, and CMMC. The firm positions itself as a partner that goes beyond issuing reports, emphasizing efficiency, minimal disruption, and actionable findings that help organizations strengthen their control environments. IS Partners works with healthcare providers, insurers, banks, fintech firms, software and SaaS companies, government contractors, manufacturers, telecommunications providers, and energy companies, among others. With more than two decades of experience, IS Partners highlights its in-house team of professionals who combine technical IT expertise with traditional audit and accounting backgrounds. Its engagements often include advisory components, assisting clients with policy development, control remediation, and long-term risk management strategies. The firm’s model blends traditional assurance with consulting, positioning it as a trusted advisor to organizations that need both regulatory compliance and operational improvements in their security and control environments. | Dresher, PA 19025 1668 Susquehanna Road | iterry@ispartnersllc.com +1 215-675-1400 | ||
KIMMELL CYBERSECURITY Akron, OH 44307 | Akron, OH 44307 637 Vernon Odom Bvd. | bkimmell@kimmell.com +1 330-762-5143 | ||
KIERI SOLUTIONS LLC Woodbine, MD 21797 WHY CHOOSE KIERI SOLUTIONS? We are a small, lean team of experts. We move faster and give better answers because we have knowledgeable people at every step of the process. We sponsor and contribute to cmmcaudit.org which is a source of free information and training about CMMC. We understand that networks need to be functional and secure. We reward risk-based approaches and strong process to manage chaotic enterprise networks. We believe in fixed-price quotes to reduce your risk. We will happily provide an early estimate of what your assessment will cost so that you can plan. EMAIL: INFO@KIERI.COM CALL: +1 (301) 253-5150 WEB: WWW.KIERI.COM ASSESSMENT SERVICES CMMC LEVEL 2 ASSESSMENT CMMC LEVEL 2 ASSESSMENTS SPOTS ARE AVAILABLE. CONTACT US TO RESERVE YOUR SPOT (DOWN PAYMENT REQUIRED). PRE-ASSESSMENT (MOCK ASSESSMENT) IDENTIFY EXACTLY WHAT NEEDS TO BE CORRECTED. VERIFY YOUR EVIDENCE IS ADEQUATE AND SUFFICIENT. RE-USABLE ASSESSMENT PLAN, SAME CRITERIA AS A FORMAL ASSESSMENT. CYBERSECURITY CONSULTING CMMC PREP PROJECT Our CMMC expert will train you on compliance processes and complete your compliance documentation (scoping, system security plan, risk assessment, Plan of Action, policies, procedures, etc) which typically increases your compliance score by over 100 points. Then we will perform an Gap Analysis and Plan of Action so that you know what is left (normally just technical changes). CMMC CONSULTING Our CMMC, NIST SP 800-171, and DFARS specialists can assist your company with: System Security Plan creation Policies and Procedures Identifying correct CMMC scope Self-assessments and Plan of Action creation Virtual CISO and Separation of Duties KIERI COMPLIANCE DOCUMENTATION TEMPLATES We are one of only a few C3PAOs that passed our CMMC assessment with a functional enterprise network that includes laptops, email, and BYOD. We did NOT present a pristine and unused enclave because that isn’t functional. We wanted to prove that real companies could pass CMMC. Our CMMC compliance documentation package is ideal for enclaves and companies with up to 1000 users. Plain language policies, procedures, and simple workflows to run your business securely AND generate evidence of compliance. Battle tested: Based on the policies, procedures, and workflows we used to pass CMMC Level 2. Over 30 pre-written documents with examples pre-written that can be used by most enclaves and smaller businesses. Easy to customize (Word / Excel). More information and a one-hour demo video about the Kieri Compliance Documentation can be found at: https://www.kieri.com/kcd EMAIL: INFO@KIERI.COM CALL: +1 (301) 253-5150 WEB: WWW.KIERI.COM | Woodbine, MD 21797 6955 Annapolis Rock Road | info@kieri.com +1 301-253-5150 | ||
KLC CONSULTING, INC Framingham, MA 01701 WHY CHOOSE KLC CONSULTING We understand the natural apprehension people feel going into their high-stakes CMMC assessment. You worry you'll get the invasive "gotcha!" type of auditor. At KLC Consulting, our friendly, interactive assessment style alleviates that concern. Our assessment philosophy is to be the objective C3PAO that validates your demonstrated security practices without digging deeper in search of flaws, ensuring an assessment delivered with a clear understanding and the human touch. WE'RE NOW SCHEDULING CMMC ASSESSMENTS The CMMC ecosystem faces an acute supply-demand imbalance: For every 1,000 organizations seeking certification, there's only about 1 authorized C3PAO to assess them! Given this scarcity, scheduling your CMMC Certification Assessment as soon as possible is of the utmost importance. Please use our Calendar link to schedule a Zoom call at your convenience. You can also reach us at cmmc@klcconsulting.net or call 617-314-9721 x158. CMMC ASSESSMENT SERVICES CMMC LEVEL 2 MOCK (READINESS) ASSESSMENT Are you in doubt about your CMMC Level 2 Assessment? Don't be. Our CMMC Mock Assessment illuminates the path to compliance by providing a realistic simulation of an official CMMC Level 2 Certification Assessment like the full-contact scrimmage teams play to prepare for an in-season game. This lower-priced practice-run assessment brings the full intensity and scrutiny of an Official Level 2 assessment, identifying and explaining deficiencies from an independent C3PAO perspective. It's designed to empower your team's self-remediation efforts and build confidence for success in your official Level 2 assessment. Ask about your discount for a Mock-Official CMMC Level 2 Assessment Bundle and Low-Cost Limited Mock Assessment options to prepare for your POA&M Closeout Assessment. CMMC LEVEL 2 ASSESSMENT A CMMC Assessment is a formal compliance evaluation by an independent C3PAO that verifies an organization's implementation of CMMC practices. It's the Department of Defense's way of ensuring Controlled Unclassified Information (CUI) is protected. You've put in the hard work to prepare, and KLC Consulting respects that commitment. Our interactive collaborative approach helps you clearly understand each part of the process, including how we determine your compliance score and status. We'll also thoroughly explain provisions designed to benefit you, such as the 10-day window for correcting minor, non-systemic deficiencies after your assessment. POA&M CLOSEOUT ASSESSMENT Attaining Conditional Status (an assessment score between 88 and 109) in your CMMC Level 2 Certification Assessment means you've implemented many, but not all, required practices. CMMC allows up to 180 days to remediate and validate identified deficiencies through a POA&M Closeout Assessment. KLC Consulting provides fast, inexpensive closeout assessments scaled directly to the number of non-compliant practices that need reassessment. INDUSTRY-SPECIFIC CMMC ASSESSMENTS DEFENSE PRIME CONTRACTORS & SYSTEM INTEGRATORS Assessing organizations with complex, multi-divisional structures and expansive Controlled Unclassified Information (CUI) scopes across diverse hybrid infrastructures demands highly specialized C3PAO expertise. KLC Consulting possesses extensive direct experience with these intricate environments, including those heavily reliant on Secure Software Development Life Cycles (SSDLCs). Our depth of knowledge far exceeds foundational C3PAO requirements and the capabilities of most C3PAOs in the marketplace today, ensuring a precise assessment for even the most advanced operational contexts. IT MANAGED SERVICE PROVIDERS (MSPS) We appreciate that IT Managed Service Providers play a critical role in the defense supply chain, managing complex environments and CUI for multiple clients. KLC Consulting possesses direct experience assessing MSP operations, recognizing the nuances of shared infrastructure, multi-tenant architectures, and CUI flow-down within your unique service delivery model. DEFENSE SOFTWARE DEVELOPERS Assessing organizations that develop software for Department of Defense (DoD) applications requires rare, specialized knowledge. KLC Consulting possesses deep expertise in evaluating Secure Software Development Life Cycles (SSDLCs) and DevSecOps environments. We understand precisely how Controlled Unclassified Information (CUI) should be handled and protected within codebases, design specifications, and continuous integration/delivery pipelines. We provide the thorough technical capability to accurately assess your unique development processes and intellectual property. MANUFACTURERS Manufacturers operate with distinct technological landscapes, frequently utilizing on-premises IT systems, hybrid environments, and legacy components. Assessing CMMC compliance within these operational technologies (OT) and interconnected physical environments presents unique challenges. KLC Consulting possesses hands-on experience assessing manufacturing IT infrastructures giving us the insight needed to assess your specific operational complexities. ARCHITECTS, ENGINEERS, AND PROFESSIONAL SERVICES FIRMS Architects, engineers, and other professional services firms often handle Controlled Unclassified Information (CUI) within cloud-based environments. KLC Consulting excels at assessing these cloud-centric operations. A significant benefit for organizations with no physical CUI stored, processed, or transmitted at their facilities is the ability to conduct assessments entirely remotely reducing assessment time and price. LET’S TALK Is your organization preparing for CMMC certification? So are 77,000 other OSCs! - Don't delay, schedule a meeting today. You can also reach us at cmmc@klcconsulting.net or call 617-314-9721 x158. We look forward to talking with you. | Framingham, MA 01701 945 Concord St | cmmc@klcconsulting.net +1 617-314-9721 | ||
KNC STRATEGIC SERVICES Carlsbad, CA 92011 KNC is an Authorized CMMC Third Party Assessment Organization (C3PAO) through the Cyber AB. We are one of the very few West Coast based Authorized C3PAO’s. We provide CMMC consulting services, and assessments, just not to the same client of course. Our team is led by our CEO and President, Kelly C. Kendall, CCA/CCP. Kelly is an advisor on the Advisory Council for the C3PAO Stakeholders Forum, and very involved in the community of C3PAOs. Why Chose KNC? • We are CMMC/NIST 800-171 Experts • Extensive Experience Supporting DIB • Full support from start to finish • We have solutions for your problems • We directly support Veterans KNC formed a 501(C)(3) nonprofit called US Veterans Advancing Through Learning, Opportunities and Resources (US VALOR). US VALOR has a Cybersecurity Apprenticeship Program for transitioning active duty US Military and new veterans. KNC give 10% of it's annual profits to US VALOR and other veteran and military family support organizations. | Carlsbad, CA 92011 701 Palomar Airport Rd, Suite 300 | kelly.kendall@kncss.com +1 833-562-7700 | ||
KOMPLEYE Reston, VA 20190 Kompleye is a recognized cybersecurity and compliance audit organization that offers comprehensive solutions for different industries. We have in-depth knowledge and extensive experience with Cybersecurity Maturity Models including, CMMC, Federal Information Security Management Act (FISMA), FedRAMP, StateRAMP, the National Institute of Standards & Technology (NIST)/Risk Management Framework (RMF), ISMAP, ISO 27001-2013, NIST 800-171, HITRUST-CSF, CSA Star Attestation, as well as attestation examinations of the AICPA SOC 2 Trust Services Criteria (TSC). | Reston, VA 20190 1900 Reston Metro Plaza, Suite 600 | pat@kompleye.com +1 703-814-0119 | ||
KRATOS TECHNOLOGY & TRAINING SOLUTIONS Herndon, VA 20171 As a CMMC Third Party Assessment Organization (C3PAO), Kratos teams are ready to conduct the CMMC assessments that are a prerequisite to CMMC 2.0 certification. CMMC 2.0 streamlines the process, reduces costs, and improves flexibility. Kratos’ assessment process consists of up to four phases and, depending on complexity, most assessments will be completed in four to six weeks. Much of the progress Organizations Seeking Certification (OSC) and Defense Industrial Base (DIB) members have taken will still apply and ease CMMC certification. CMMC 2.0 still addresses security concerns related to Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) and divides certification levels based on what type of information an organization handles. CMMC 2.0 does not alter the Level 1 controls, but only requires a self-attestation for Level 1 certification. Certified C3PAOs are still able to assess or offer advisory services. Kratos has years of robust compliance and certification experience with government and commercial standards requirements. Along with CMMC 2.0, these include the Federal Risk and Authorization Management Program (FedRAMP), Payment Card Industry (PCI), Federal Information Security Management Act (FISMA) and the National Institute of Standards & Technology (NIST)/Risk Management Framework (RMF). Kratos is viewed as a trusted compliance and governance partner by the Department of Defense (DoD), Federal Civilian Agencies, Intelligence Community (IC), and commercial organizations. Kratos cybersecurity services include Compliance, Governance, Risk Management & Strategy and Cyber: Operations, Defense, & Engineering services. Visit: www.kratosdefense.com/cyber Contact: CyberSales@kratosdefense.com | Herndon, VA 20171 13530 Dulles Technology Drive, Suite 600 | cmmc@kratosdefense.com +1 703-488-2500 | ||
KTL SOLUTIONS INC Frederick, MD 21704 KTL Solutions is a Microsoft Solutions Partner, CyberAB Registered Provider Organization, and Certified Third-Party Assessor Organization (C3PAO) based in Frederick, MD. We help Defense Industrial Base contractors achieve CMMC Level 2 certification through Registered Practitioner-led readiness, gap assessments, and the design of a CMMC Secure Enclave in Microsoft 365 GCC High and Azure Government. As both an RPO and a C3PAO, KTL performs full CMMC Level 2 pre-assessments that mirror the official process, as well as the official CMMC Level 2 certification assessment when clients are ready. Learn more about our CMMC Services. With 25+ years on the Microsoft stack, including M365, Dynamics 365, Azure, Power Platform, and the Defender suite, KTL is a single accountable partner across compliance, secure environment build-out, business applications, and managed services. | Frederick, MD 21704 7101 Guildford Drive, Suite 101 | sales@ktlsolutions.com +1 301-360-0001 | ||
LIFE CYCLE ENGINEERING INC. Charleston, SC 29405 LCE has supported defense and commercial communities since 1976, delivering mission-critical solutions across engineering, logistics, and cybersecurity. As an authorized C3PAO, we work with organizations across the Defense Industrial Base to prepare for and achieve CMMC compliance without the confusion and overcomplication that often surrounds it. Our team brings experience from RMF, NIST SP 800-53, FedRAMP, and ISO-based environments, where we specialize in making security operational. CMMC is simply another framework applied to environments we already understand. We provide gap assessments, readiness reviews, and independent Level 2 assessments, helping organizations focus their time and resources where it actually matters. Our approach is straightforward: define the scope correctly, align the environment, and verify that controls are implemented consistently. We eliminate unnecessary complexity to provide a clear path to CMMC readiness. | Charleston, SC 29405 4360 Corporate Dr. | spalmer@lce.com +1 843-744-7110 | ||
LINFORD & COMPANY LLP Denver, CO 80202 | Denver, CO 80202 1550 Wewatta St, Floor 2 | mark@linfordco.com +1 801-643-5372 | ||
LUNARLINE, INC. Ashburn, VA 20147 As one of the longest-authorized 3PAOs, Lunarline offers fully customizable solutions, combining innovative flexibility with a mature corporate infrastructure. This enables Lunarline to support large, complex security programs while providing low-risk, high-quality services to our clients. Our objective is to lay the foundation for lasting security programs that advance security without undermining business operations. | Ashburn, VA 20147 44715 Brimfield Dr, Suite 210 | contact@lunarline.com +1 202-961-1790 | ||
MAD SECURITY Huntsville, AL 35805 | Huntsville, AL 35805 5021 Bradford Drive NW, Suite 207 | jconway@madsecinc.com +1 888-623-7324 | ||
MANAGEIT SECURITY Arlington, VA 22201 ManageIT Security is an authorized C3PAO providing CMMC Level 2 certification assessments. Led by President Rosalyn Foltz (LCCA, CCA) and supported by a team of experienced CMMC assessors, MITS conducts assessments across a range of industries and organization sizes — from small businesses to complex multi-site contractors. We pride ourselves on clear communication and an assessment process that respects our clients' time and resources. Learn more at www.manageitsecurity.com. | Arlington, VA 22201 2300 Wilson Blvd., Suite 700 | foltzr@manageitsecurity.com +1 571-882-2388 | ||
MCKONLY & ASBURY, LLP Camp Hill, PA 17011 McKonly & Asbury is authorized as a CMMC C3PAO for Level 2 certification assessments. We were one of the first 34 C3PAOs listed in the Cyber AB Marketplace on January 2, 2025. The firm has over 15 years of experience in NIST 800-53 and NIST 800-171 as well as over 20 years of experience conducting SOC 1 and SOC 2 audits for service organizations. We are also a third-party assessor for HITRUST. Headquartered in Camp Hill, Pennsylvania, with additional offices in Lancaster, Bloomsburg, and Philadelphia, McKonly & Asbury has been named a Best Place to Work in Pennsylvania for 20 years and ranked among the Best Accounting Firms to Work for in the United States for nine consecutive years, including #1 in 2024. McKonly & Asbury also earned the distinction of #1 Best Place to Work for Young Accountants in 2024 and has been recognized as a Best Accounting Firm for Women for three years. | Camp Hill, PA 17011 415 Fallowfield Rd, 2nd Floor | dhammarberg@macpas.com +1 717-761-7910 | ||
MEERKAT CYBER, LLC McLean, VA 22102 | McLean, VA 22102 1750 Tysons Blvd., Ste. 1500 | chris@meerkatcyber.com +1 866-390-2662 | ||
MNS GROUP Belcamp, MD 21017 Why Choose MNS Group? We’re obsessed with security, compliance, and CMMC. As an ISO 27001, and ISO 9001 credentialed company, MNS Group has over 20 years of experience in cybersecurity, technology, and business processes. Our team stands ready as your strategic partner, bringing the certifications, expertise, efficiency, and professionalism necessary to navigate the complexities of the CMMC assessment. Our unwavering commitment to compliance and CMMC allows you to make a real impact in defending our nation and securing your business. Trusted Command in Cybersecurity Our team operates with the precision and discipline honed through years of experience with the cybersecurity standards and frameworks. Armed with industry-leading cybersecurity certifications, we stand ready to provide a strategic and informed assessment that strengthens your operational defense. Tactical Efficiency Through Industry Insight We deploy CMMC professionals already versed in the terrain of your industry. By placing specialists familiar with your vertical on the front lines, we reduce the learning curve and complete your assessment with efficiency. Mission-Aligned Precision Our team is laser-focused on executing the tasks at hand. We work with the same sense of urgency and discipline that you apply to your own operations, ensuring your CMMC assessment is completed promptly so you can stay on your mission. A Respectful and Collaborative Engagement You’ve done your duty to protect sensitive data, and we salute your commitment. Now, let us do ours. With a team approach, we will provide an assessment treating your staff as fellow mission partners throughout the process. Our team is discreet and trustworthy to ensures that your business information is kept confidential. Here’s how MNS Group C3APOs can help businesses that need a CMMC Assessment: CMMC Assessments: Our team of CCAs will validate your ability to safeguard the data you are entrusted with. By undergoing a thorough assessment, you demonstrate your commitment to protecting sensitive information, reinforcing your credibility as a reliable government contractor. CMMC Mock Assessments: A Mock Assessment is identical to a Certifying Assessment and will uncover, in detail, any controls that are not met, providing a preview of your compliance score. During the Mock Assessment, your team will have a chance to practice answering assessor questions and gain competence. NO CONSULTING IS OFFERED BY MNS GROUP DURING A MOCK ASSESSMENT. After completion of the Mock Assessment, you will have the opportunity to remediate any findings. Pre-Plan your Compliance Strategy NOW There are cost and time savings when you choose to preplan by contracting for your Mock and certifying CMMC Assessments: Reduced Assessment Fee: your organization receives a saving as well as a locked-in fee that does not increase, no matter what happens in the market. An Assessment in YOUR timeframe: Access MNS Group as your C3PAO when you need an assessment- without having to compete with other companies and wait in a queue for a date that may not be in the time you need it! Multiply Efficiencies: Our Assessors, familiar with your environment from the Mock Assessment or previous Certifying Assessment. Your team who participated in the Mock or Certifying Assessment already understands what is expected of them. These factors contribute to a faster review so you can get back to work! Contact us today to get scheduled so you can win contracts! | Belcamp, MD 21017 4690 Millennium Drive, Suite 400 | laura@mnsgroup.com +1 410-838-1088 | ||
MONARCH ISC Portland, ME 04101 Monarch ISC, the 7th organization to become an Authorized CMMC Third-Party Assessment Organization (C3PAO), is also an Authorized Training Provider (ATP) for official CCA and CCP courses, and a trusted advisor (RPO) for readiness consulting. Monarch ISC continues to demonstrate our leadership and commitment to the CMMC ecosystem. Our work is guided by a clear focus on security, compliance, and strategy — the foundation of every assessment, training, and advisory service we deliver. Based in Portland, Maine, Monarch ISC’s team includes both Lead Certified CMMC Assessors (Lead CCAs) and Certified CMMC Assessors (CCAs), ensuring every assessment is conducted with rigor, clarity, and integrity. Every client’s path to certification looks different. We focus on understanding those needs and guiding each client through a process that is clear, practical, and effective. Call us today for a free consultation. | Portland, ME 04101 22 Free St, Suite 300 | info@monarchisc.com +1 207-808-0472 | ||
NSF Ann Arbor, MI 48105 NSF is comprised of information security experts and talented lead auditors who help companies maximize their cybersecurity efforts. NSF is an early adopter of CMMC and has supported and conducted NIST 800-171 assessments. NSF also provides information security services across key industries, including defense, manufacturing, water, food and health sciences. We offer certification assessments to globally recognized standards, including ISO/IEC 27001, ISO/IEC 20000-1, NIST 800-171, CSA Star and the Cybersecurity Maturity Model Certification (CMMC). NSF provides a professional and purpose-driven approach to assessment services, helping organizations safeguard physical and digital data, manage current and future cyber risks and meet rigorous compliance requirements. Learn more about NSF-ISR's CMMC service | Ann Arbor, MI 48105 789 N. Dixboro Road | hglass@nsf.org +1 734-769-5179 | ||
ON CALL COMPLIANCE SOLUTIONS Tallahassee, FL 32301 | Tallahassee, FL 32301 2321 Hansen Ct. | mike@on-callsupport.com +1 850-224-1008 | ||
OSC EDGE Atlanta, GA 30341 Securing the Defense Industrial Base: Why OSC Edge Is Your Trusted CMMC C3PAO Partner As cyber threats to national security grow in complexity, the Department of Defense (DoD) has implemented the Cybersecurity Maturity Model Certification (CMMC) to strengthen the cyber posture of the Defense Industrial Base (DIB). Organizations seeking to do business with the DoD must undergo a formal cybersecurity assessment conducted by a Certified Third-Party Assessment Organization (C3PAO). OSC Edge, a certified C3PAO, achieved a perfect score on our DIBCAC C3PAO and CMMC Level 2 certification review, meeting the rigorous standard required for all C3PAOs. We stand ready to provide objective, professional assessments to help you demonstrate and maintain your compliance. Why Choose OSC Edge? Proven Experience: OSC Edge has decades of experience delivering cybersecurity, compliance, and IT services to federal and defense customers. Qualified Team: Our assessors are highly trained professionals with deep knowledge of NIST 800-171 and CMMC Level 1, Level 2 and Level 3 requirements. Impartial & Transparent: As a C3PAO, OSC Edge adheres to strict standards of independence and integrity in the assessment process. Supportive Readiness: We provide guidance on what to expect during your assessment and review your readiness, including a walk-through of required materials and an optional mock assessment to identify areas needing correction. Perfect Score: OSC Edge earned a 100% on our C3PAO and CMMC L2 certifications, setting the bar for assessment excellence “Achieving a perfect score on our CMMC C3PAO certification is more than a milestone, it’s a reflection of the trust we build with our clients. We don’t just assess cybersecurity readiness; we set the standard for what excellence looks like,” says Tiffany Bailey, CEO of OSC Edge. Past Performance OSC Edge delivers mission-critical technology and services to some of the most complex government organizations in the world. Our work spans across 27 U.S. states — including ARCENT Headquarters at Shaw AFB, SC — and multiple OCONUS locations such as Afghanistan, Iraq, Kuwait, Jordan, Qatar, Bahrain, Egypt, Israel, UAE, Saudi Arabia, and Japan. Representative engagements include: ARCENT Headquarters, U.S. Army – Enterprise IT, network, and cybersecurity support for critical mission systems. U.S. Central Command Operations (OCONUS) – Providing secure IT infrastructure, data center management, and cloud migration in active operational theaters. Department of Defense (various agencies) – Delivery of Commercial Solutions for Classified (CSfC), cybersecurity services, and enterprise architecture solutions. U.S. Intelligence Community – Supporting classified environments with enterprise IT and cybersecurity solutions. Our track record demonstrates: Global Reach – Operations across multiple continents in active and high-security environments. Certified Excellence – CMMI-SVC/3, ISO 9001:2015, ISO/IEC 20000, ISO/IEC 27001 certifications. Proven Capability – Hundreds of certified professionals delivering enterprise architecture, facilities and data center management, cloud migration, and cybersecurity services. Across all engagements, OSC Edge has consistently: Met or exceeded performance requirements Delivered on time and within budget Maintained strict compliance with federal security standards This record of performance underscores our ability to conduct CMMC Level 2 assessments with the independence, precision, and professionalism required of a certified C3PAO. Our Highlights: Over 100 DoD Risk Management Framework Assessments Experienced Assessors of NIST Controls CMMC Certified Assessors Deep Understanding of CMMC 2.0 and NIST Standards DIB Contractor, We work where you work Network Architect and Configuration Experience Cloud Architect and Configuration Experience System Security Plan Composition, Crafting and Production Years of Network Consulting Experience The CMMC Assessment Lifecycle: Initial Inquiry & Readiness Discussions Scope Definition & Document Review Formal Assessment & Interviews Findings Final Report Submission to Cyber AB and the Department of Defense What to Expect Working with OSC Edge: Clear communication from start to finish Timely assessment schedules and feedback Confidence in compliance with DoD requirements A trusted, mission-driven partner focused on security and national readiness Closing Thoughts Achieving CMMC compliance is more than a checkbox, it’s a strategic imperative. As cyber threats evolve, the defense community must rise to meet them with diligence and discipline. OSC Edge leads the way, helping organizations like yours transition from uncertainty to compliance with confidence. We stand ready to support your organization throughout the CMMC assessment process. As a certified C3PAO with a flawless score, our team brings unmatched experience, technical expertise, and a clear understanding of the certification requirements. We maintain our independence as assessors while providing the clarity and insight you need to navigate the process confidently. We help bring clarity to the process so you can approach your assessment with confidence. With OSC Edge, you meet requirements with precision and uphold the highest standards. | Atlanta, GA 30341 1954 Airport Road, STE 144 | c3pao@oscedge.com +1 877-672-1025 | ||
PARAGON CYBER SOLUTIONS LLC Tampa, FL 33602 Paragon Cyber Solutions is a certified 8(a), Woman-Owned Small Business (WOSB), and Service Disabled Veteran Owned Small Business (SDVOSB) specializing in cybersecurity, information technology, and workforce development for federal agencies. With over 20 years of cybersecurity expertise, we provide tailored security solutions that protect mission-critical systems and ensure compliance with federal regulations. As an authorized C3PAO experienced as a government contractor, we bring a deep understanding of the CMMC framework, compliance challenges, and federal security mandates. Our team of highly credentialed specialists - holding CISSP, CISM, CEH, CHFI, CompTIA, SCRUM, and ITIL certifications - ensures a streamlined, expert-led assessment process that helps organizations achieve CMMC certification efficiently and confidently. | Tampa, FL 33602 400 N. Ashley Drive, Suite 2050 | grcteam@paragoncybersolutions.com +1 813-603-7233 | ||
PEAK INFOSEC LLC Tampa, FL 33607 ABOUT PEAK INFOSEC Peak InfoSec has been heavily involved in NIST SP 800-171 compliance efforts since its founding. When CMMC was started by the Department of Defense, our founder, Matthew Titcombe, jumped into the early fray. As a result, he led Peak InfoSec by: Serving on the CMMC Standards Committee and helping to draft the first version of the CMMC Assessment Guides Being certified as CMMC Provisional Assessor #17 Getting Peak InfoSec authorized as one of the 1st 15 C3PAOs Drafting CMMC Certified Practitioner and Assessor materials for Licensed Partner Providers OUR SERVICES CMMC CONFORMITY ASSESSMENTS As an Authorized C3PAO, Peak InfoSec can conduct a formal CMMC Conformity Assessment of your organization. Peak InfoSec can also provide a Pre-Assesssment of your organization. This provides your organization with a "dry-run" version of a Conformity Assessment. Please note, like a normal Conformity Assessment, we can provide no advice or recommendation can be provided during this engagement. Peak InfoSec works with your firm to minimize the certification event costs by maximizing virtual assessment components and minimizing physical reviews. CMMC/NIST SP 800-171 CONSULTING If your organization is not sure if it is ready for an actual CMMC Conformity Assessment, Peak InfoSec can support your organization in getting ready. We can help your organization: Conduct Mock Assessment: Peak InfoSec can conduct a mock Conformity Assessment as if we were assessing your organization. We may be able to re-use this event in your formal Conformity Assessment. Conduct a Gap Analysis: In this effort, we conduct a formal assessment and provide your organization recommendations based on our experiences fulfilling NIST SP 800-171 requirements, your portfolio, and our technical expertise. Support your Remediation Efforts: Peak InfoSec can support your organization in a wide range of remediation efforts. These can run the gamut of providing virtual CISO services to just validating your organization's remediation efforts Providing Conformity Assessment Support Services: Peak InfoSec can also be present during your formal Conformity Assessment. This helps with "translations" of your environment to language the other C3PAO would understand. More information can be found at https://peakinfosec.com/cmmc/cmmc-assessment-process/ COVERED REGIONS Peak InfoSec can provide C3PAO Conformity Assessments & CMMC/NIST SP 800-171 Consulting: Anywhere CONTACT INFO Office: 1 (352) 575-9737 Email: cmmc@peakinfosec.us Website: https:/peakinfosec.com | Tampa, FL 33607 3001 N. Rocky Point Dr. E, Suite 200 | cmmc@peakinfosec.us +1 352-575-9737 | ||
PENACITY, LLC Hanover, MD 21076 Penacity, LLC is a Service Disabled Veteran Owned Business that provides state of the art security services to companies and the federal government. Founded on the principle that through security testing of humans and machines, we can enable customers to maintain the highest security posture while protecting the most sensitive information. Penacity conducts assessments for HIPAA, PCI/DSS, ISO, FEDRAMP, NIST and CMMC ensuring customers are mission ready to meet stringent regulatory requirements. Penacity personnel have over 30 years experience in conducting government and commercial assessments. Customer success is our core principle as we work with all organizations to ensure they are fully compliant, resilient and mission ready. CORE COMPETENCIES SOC-as-a-Service CISO-as-a-Service CMMC Assessor Assessment Preparation NIST 800-171 CMMCv2 PCI/DSS HIPAA ISO Penetration Testing Vulnerability Assessment Vulnerability Management Incident Response Forensic Analysis Managed Security Services | Hanover, MD 21076 7030 Dorsey Rd, Suite 102 | info@penacity.us +1 443-837-9550 | ||
PEREZDIAZ, LLC Bedford, TX 76021 Perezdiaz, LLC CMMC Third-Party Assessment Organization (C3PAO) Perezdiaz, LLC is an independent cybersecurity assessment organization specializing in third-party evaluation of Controlled Unclassified Information (CUI) protection programs across the Defense Industrial Base (DIB). The firm is structured to deliver objective, evidence-based CMMC assessments aligned with the CMMC Assessment Process (CAP), 32 CFR Part 170, and Cyber AB requirements. The organization is led by experienced assessment professionals with deep backgrounds in government, defense, and regulated commercial environments. Perezdiaz, LLC operates with a strict commitment to assessor independence, assessment integrity, and conflict-of-interest discipline. CMMC ASSESSMENT FOCUS Perezdiaz, LLC performs independent CMMC Level 2 assessments for Organizations Seeking Assessment (OSAs), including environments with: Hybrid and cloud-based enclaves On-premises manufacturing and operational technology (OT) systems Controlled facilities and mixed-use environments Distributed workforces and alternate worksites Assessment activities emphasize traceability, evidence sufficiency, and control intent rather than documentation-only compliance. ASSESSMENT METHODOLOGY & RIGOR The firm applies a disciplined, regulator-first assessment methodology that includes: Full alignment to NIST SP 800-171 assessment objectives Evidence validation across technical, administrative, and physical controls Risk-based evaluation consistent with DoD and Cyber AB guidance Clear determination of POA&M eligibility, including identification of non-POA&M-eligible requirements CAP-aligned reporting and defensible certification recommendations Assessments are conducted to withstand DoD review, quality audits, and downstream contractual scrutiny. INDEPENDENCE & CONFLICT-OF-INTEREST CONTROLS Perezdiaz, LLC maintains strict separation between third-party assessment activities and any advisory or readiness services performed by affiliated entities. The organization enforces: Compliance with Cyber AB Code of Professional Conduct Formal conflict-of-interest screening prior to assessment engagement Assessor role separation to preserve objectivity No remediation, implementation, or consulting influence during assessments This structure protects the integrity of the certification process and ensures impartial outcomes for OSAs. ASSESSMENT TEAM QUALIFICATIONS (IN-HOUSE) Perezdiaz, LLC maintains qualified assessment personnel with the following credentials held in-house or equivalent, as applicable to role and engagement scope: Lead Certified CMMC Assessor (CCA) Certified CMMC Assessor (CCA) Certified CMMC Professional (CCP) Certified Information Systems Auditor (CISA) Certified in Risk and Information Systems Control (CRISC) Certificate of Cloud Security Knowledge (CCSK) ITIL Foundation Lean Six Sigma (Green Belt or equivalent) Assessment team members possess prior experience supporting high-consequence cybersecurity assessments, including DIBCAC High Assessments and enterprise-scale CUI programs. GOVERNANCE, QUALITY, AND OVERSIGHT Perezdiaz, LLC incorporates internal governance and quality assurance practices to support consistent assessment outcomes, including: Assessment peer review and quality checks Assessor calibration and ongoing training Controlled evidence handling and documentation standards Continuous alignment with evolving DoD and Cyber AB guidance These practices ensure assessments remain repeatable, defensible, and compliant with current regulatory expectations. DEFENSE & GOVERNMENT EXPERIENCE The organization’s leadership and assessment staff bring prior experience supporting U.S. Department of Defense and federal mission environments, including national-level mission assurance, secure communications, continuity operations, and inter-agency coordination. This background informs a practical understanding of operational risk, mission impact, and regulatory accountability. ORGANIZATIONAL ASSESSMENT PHILOSOPHY Perezdiaz, LLC approaches CMMC assessments with a singular objective: to provide the DoD with accurate, independent, and defensible certification decisions. Assessments are conducted fairly, consistently, and without bias, enabling contracting authorities to rely on certification outcomes with confidence. | Bedford, TX 76021 Woodmont Ct | george@perezdiaz.com +1 303-746-5162 | ||
PKF O'CONNOR DAVIES Harrison, NY 10528 The pace of business and the places it’s being done are constantly changing. At PKF O’Connor Davies our ability to serve clients how, when and where they need us has always set us apart. We’re a relationship-centered accounting and advisory firm with unparalleled regional connections backed by global expertise. Our focus on value has driven our growth, propelling PKF O’Connor Davies into the top 25 on Accounting Today’s 2025 “Top 100 Firms” list and gaining us acclaim as one of the nation’s fastest growing firms. But the reality is we define ourselves less by the accolades we receive and more by the growth we help our clients achieve. Our Cybersecurity and Privacy Advisory practice is comprised of lifelong cybersecurity and IT professionals dedicated to serving the defense industrial base. With more professionals, in more places every day, our teams are on the ground, at the ready and in the know. As the world changes, PKF O’Connor Davies clients will always Know Greater Value®. | Harrison, NY 10528 500 Mamaroneck Ave | ndelena@pkfod.com +1 781-937-5191 | ||
PRESCIENT SECURITY, LLC Nashville, TN 37203 Prescient Security provides expert consulting and self-assessment services for Department of Defense Industrial Base clients, helping them achieve the required CMMC certification for DoD contracts starting in fiscal year 2025. Why choose us for CMMC? Expertise & Bridge to Advanced Frameworks Alignment with NIST Standards: Audits and assessments aligned with NIST standards, serving as a bridge to advanced frameworks like CMMC or FedRAMP. Interlinking Standards: Meeting NIST standards often correlates with ISO or SOC 2, aligning seamlessly with our comprehensive offerings. Our Approach & Customized Offerings Simplified NIST Standards: We simplify NIST standards, covering information security standards, including encryption and AI-based controls. Methodologies in Line with NIST Guidelines: Employing defined methodologies aligned with NIST guidelines for audits and assessments. Assessment and Readiness Services: Conducting NIST assessments and providing readiness services to guide clients through the compliance process. Consulting and Advisory Services: Focused on meeting NIST standards with broad applicability to various compliance requirements. Flexible Offerings: Providing a range of services, from gap assessments to comprehensive audits, catering to diverse client needs, budgets, and timelines. | Nashville, TN 37203 1900 Church Street, Suite 300 | FedRAMP@prescientsecurity.com +1 646-209-7319 | ||
PROVINCIA GOVERNMENT SOLUTIONS Brentwood, TN 37027 Provincia Government Solutions (PGS) is a Minority Owned Small Business with the Small Business Administration HUBZone Certification. We have been providing independent information security assessment services to government contractors since 2002. With over 30 years of combined government experience, our team makes the difference when navigating complex audit and compliance requirements. Through years of active participation and contribution to the security community, we have built a process to comprehensively identify security issues facing organizations and translating security data into actionable intelligence enabling informed decision making. Our Core Competencies include: CMMC Federal Information Security Act (FISMA) NIST 800-53, NIST 800-37, NIST 800-171 / DFARS HIPAA NIST Cyber Security Framework Security Control Assessments (SCA) Minimum Acceptable Risk Standard for Exchanges (MARS-E) TRICARE FedRAMP Consulting and Cloud Security Technical Testing Services (Penetration and Application) Risk Vulnerability Assessments (RVA) | Brentwood, TN 37027 214 Overlook Circle, Suite 200-905 | sbennett@provincia.io +1 615-767-7902 | ||
RAMPARTS LLC Clarksville, MD 21029 RAMPARTS is a team of cybersecurity professionals with decades of US Government and private industry experience and certifications. Authorized CMMC C3PAO. Ramparts is your strategic partner in your CMMC C3PAO Certifying Assessment. We bring certifications, expertise, and professionalism to guide you through a complex process with confidence. Decades of Experience in Cybersecurity: Ramparts brings the discipline of deep, hands-on experience with today’s cybersecurity standards and frameworks. Backed by DIB experience and certifications we deliver an assessment that strengthens your operational defense and certifies your CMMC compliance. Efficiency Through Industry Insight: We assign professionals who already know your industry. Pairing you with specialists who understand your business minimizes the learning curve and moves your assessment forward efficiently and effectively. Mission-Aligned Focus: We execute with the same urgency and discipline you bring to your own operations, completing your assessment promptly so you can stay focused on the mission. Collaborative Engagement: You’ve done the hard work of protecting CUI/FCI data. Now let us do ours. We treat your staff as fellow mission partners at every step, working alongside your team rather than over it. | Clarksville, MD 21029 6305 Enchanted Key Gate | colin@rampartsllc.com +1 410-660-3121 | ||
REEF SYSTEMS SECURITY Cary, NC 27511 Reef Systems Security is an Authorized CMMC Third-Party Assessment Organization (C3PAO) honored to assist Organizations Seeking Certification (OSCs) in their quest to continue supporting the federal government as members of the Defense Industrial Base (DIB). Assessment Services: As an authorized C3PAO, we can provide certification assessments for OSCs that are ready for a CMMC Level 2 assessment. Our assessments are fair and accurate. Contact us for details! cmmc@reefsys-sec.com https://www.reefsys-sec.com Consulting Services: Reef Systems Security offers consulting services. As a small business, we understand the importance of meeting requirements using sustainable, efficient and cost-effective solutions. Our experience with government requirements to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) enables us to help companies identify gaps and create a roadmap to achieve full compliance. We can assist with CMMC Level 1 and Level 2 self-assessments. For organizations that also have commercial requirements (e.g. ISO 27001:2022, ISO 9001:2015 etc.), our personnel is qualified to conduct Internal Audits and help address non-conformances by implementing corrective and preventive actions. Contact us for details! cmmc@reefsys-sec.com https://www.reefsys-sec.com Note: We are unable to conduct certification CMMC assessments for OSCs that use our consulting services. | Cary, NC 27511 1230 SE Maynard Rd, Suite 202 | cmmc@reefsys-sec.com +1 919-924-5245 | ||
REFERENTIA SYSTEMS INCORPORATED Honolulu, HI 96819 | Honolulu, HI 96819 155 Kapalulu Place, Suite 200 | nkanemoto@referentia.com +1 808-840-8500 | ||
REGOLA CYBER Bel Air, MD 21014 Regola Cyber is an authorized CMMC Third-Party Assessment Organization (C3PAO) that provides CMMC Level 2 certification and mock assessments for organizations across the Defense Industrial Base. Our team, led by Nathan Regola, Ph.D., J.D., CCA, CCP, PI, brings strong federal systems architecture experience with rigorous assessment methodology to evaluate compliance across all 110 CMMC Level 2 practices. Regola Cyber was founded in 2016 and has been involved in the CMMC ecosystem since the beginning. We were one of the first organizations accepted into the C3PAO pipeline. Our assessors are technically degreed professionals and have extensive experience in federal government contracting supporting NIST 800-171, DFARS 252.204-7012, and NIST 800-53 across a range of technologies such as Linux, Mac and Windows. We conduct formal assessments using a clear evidence request process, interviews with staff, and technical checks that meet Cyber AB and DoW standards. We also offer mock assessments to help organizations prepare. Alongside our assessment services, Regola Cyber launched PerimeterAlpha, a managed CMMC service designed to set up and maintain assessment-grade CUI boundaries. PerimeterAlpha includes clear CUI scoping, secure configurations, logging systems, documentation, and organized evidence for assessors. To remain independent, we do not certify information systems where we have provided implementation or consulting services within the required separation period. Regola Cyber is based in the National Capital Region, local to Baltimore, Northern Virginia (NOVA), and Washington D.C. We support Organizations Seeking Certification (OSCs) in Maryland, D.C., Virginia, Pennsylvania, New Jersey, and nationwide. We work both on-site and virtually, always following C3PAO ethical and independence standards. | Bel Air, MD 21014 907 Southern Drive | hello@regolacyber.com +1 703-214-1423 | ||
REI SYSTEMS, INC. Sterling, VA 20166 REI Systems has been formally authorized by the Cyber AB as a Certified Third-Party Assessment Organization (C3PAO) to conduct CMMC Level 2 assessments and issue certification for organizations in the Defense Industrial Base (DIB). Based in Sterling, VA, REI brings more than 35 years of experience delivering innovative, reliable, and secure technology solutions across the federal government. REI’s C3PAO authorization follows a rigorous assessment by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), along with the organizational background checks, quality assurance validation, and impartiality requirements established by the Department of Defense (now Department of War) and the Cyber AB. This milestone reflects REI’s ongoing investment in cybersecurity maturity and its commitment to helping organizations strengthen their cyber resilience. Our assessment team includes CAP-trained Lead Assessors, Certified CMMC professionals, and staff who meet the Cyber AB’s qualifications for conducting independent, evidence-driven CMMC evaluations. REI applies transparent, defensible, and repeatable assessment practices aligned to the CMMC Assessment Process (CAP) to support DIB organizations seeking certification and compliance with CUI protection requirements. | Sterling, VA 20166 45335 Vintage Park Plaza | cmmc@reisystems.com +1 703-480-9100 | ||
RESILIENT IT Springfield, VA 22150 As an Authorized C3PAO, Resilient IT provides CMMC Level 2 Assessments to its non-consulting clients, as well as GAP Assessments. One of our primary areas of focus is External Service Providers, specifically MSPs, working to get them assessed and certified. | Springfield, VA 22150 7420 Alban Station Blvd, B216 | cmmc@resilientit.us +1 571-408-8810 | ||
RSI SECURITY Southlake, TX 76092 We work with some of the world's leading companies, institutions, and governments to ensure the safety of their data and their compliance with applicable regulations. We also are a security and compliance software ISV and stay at the forefront of innovative tools to save assessment time, streamline compliance, and provide additional safeguard assurance. With a unique blend of software-based automation and managed services, RSI Security assists organizations within highly-regulated industries in managing IT governance, risk management, and compliance (GRC). We customize and tailor our services to a client’s exact needs. This, combined with being predictive, preventative, and nimble is what sets us apart from any other organization in our industry. Our team members come from a wide range of backgrounds and specialties. All consultants come from a computer science, engineering, or information systems discipline, and many consultants have obtained master's and doctorate degrees. Our team members include published authors, open-source developers, industry researchers, and thought leaders. | Southlake, TX 76092 2600 E Southlake Blvd 312 | sales@rsisecurity.com +1 858-999-3030 | ||
RSM US LLP McLean, VA 22182 RSM US LLP, is the fifth largest audit, tax and consulting firm in the United States and the First Choice Advisor in the middle market with over 50,000 team members globally. Additionally, RSM is a global leader of cybersecurity and privacy services to the middle market organizations that span the entire defense industrial base across a myriad of industries, including aerospace and defense, manufacturing, consumer products, technology and more. As a professional services firm with the following designations, CMMC Certified Third Party Assessor Organization (C3PAO), Federal Risk and Authorization Management Program (FedRAMP) Third-Party Assessment Organization (3PAO), ISO 27001 consulting advisor, Payment Card Industry (PCI) Qualified Security Assessor (QSA) and HITRUST/HIPAA provider, RSM’s cybersecurity services are designed to elevate security programs within complex environments, enabling organizations to deliver on their brand promises. We are the largest authorized C3PAO within the ecosystem and maintain the depth and breadth of skillsets to support the entire cybersecurity governance, risk, compliance and transformation agenda through both consulting and assessment-related services. In short, we are more than just assessors and routinely help our clients remediate their compliance deficiencies and assist organizations seeking certification (OSC’s) with surveillance and certification initiatives. Our government contracting cybersecurity team members bring unique skill sets and experiences to solve difficult problems, in the pursuit of protecting our nation’s critical security infrastructure and military forces. Specifically, our team members possess several industry-leading certifications, such as the Certified Ethical Hacker (CEH), Certified Information Systems Security Professional (CISSP), Certified Hacking Forensic Investigator (CHFI), Certified Information Systems Auditor (CISA), Certified information privacy professional (CIPP), Certified data privacy solutions engineer (CDPSE), PCI Data Security Standard (DSS) QSA, Project Management Professional (PMP) and more. Our core cybersecurity and privacy services include: Cybersecurity Compliance Services Cybersecurity Maturity Model Certification (CMMC) advisory and examination services (C3PAO) Criminal Justice Information Services (CJIS) Data privacy advisory services FedRAMP advisory and authorization services (3PAO) Federal Information Security Act (FISMA) HIPAA/HITRUST ISO 27001 consulting services National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53, NIST SP 800-37, NIST SP 800-171 / Defense Federal Acquisition Regulation Supplement (DFARS) PCI assessment and remediation services Digital Risk & Strategy eGRC tech enablement Governance, Risk and Strategy (GRS) vCISO and staff support Cyber Testing & Response Business continuity planning (BCP) Cyber incident and data response Cyber threat intelligence Managed vulnerability services Research and innovation (R&I) Risk vulnerability assessments (RVA) Technical testing services (penetration and application) Cyber Transformation Cloud design and implementation Identity and access management enablement Managed security service provider (MSSP) Secure architecture implementation | McLean, VA 22182 1861 International Drive | charles.barleyjr@rsmus.com +1 703-336-6440 | ||
DATABRACKETS Cary, NC 27519 databrackets is your one-stop shop for cybersecurity services and compliance requirements. Our mission is to assist organizations in developing and implementing practices to secure data and comply with regulations. With several years of experience in IT and industry verticals, databrackets is the perfect partner for your cybersecurity, audit and compliance needs. We have over a decade of experience in supporting organizations to comply with regulations like HIPAA/HITECH, ISO 27001, GDPR, SOC 2, NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53, CCPA, PIPEDA, PDPA and CMMC, to name a few. We also offer staff training as part of compliance requirements and ensure that companies receive a vulnerability scan of their network. After an assessment, we provide a detailed action plan and the required policy benchmarks. Visit our website https://databrackets.com and learn about our Cybersecurity services and Compliance assessments. To learn more about our CMMC services visit https://databrackets.com/services/cmmc/. Schedule a free consultation with a certified security expert and explore customized solutions for your organization. | Cary, NC 27519 150 Cornerstone Drive, Suite 202 | srini@databrackets.com +1 866-276-8309 | ||
SCHELLMAN & COMPANY, LLC Tampa, FL 33607 Schellman brings unmatched federal assessment experience to the CMMC certification ecosystem. As the #1 FedRAMP 3PAO, we have completed more than 150 federal cloud authorizations and maintain DoD IL6 clearance for assessing the most sensitive classified environments. Defense contractors benefit from Schellman’s unique position as the only leading C3PAO assessing CMMC alongside FedRAMP, ISO 27001, SOC 2, PCI DSS, and HITRUST. Our cross-framework expertise allows organizations to streamline compliance efforts across their entire framework portfolio. Our assessment-only model (no consulting, no remediation services, and no upselling) ensures fully independent, objective certification aligned with CMMC requirements. Backed by over 20 years of pure assessment experience, Schellman provides defense contractors with the trusted, audit-focused expertise needed to achieve and maintain CMMC compliance. | Tampa, FL 33607 4010 W Boy Scout Blvd, Suite 600 | m.womack@schellman.com +1 866-254-0000 | ||
SCHNEIDER DOWNS & CO., INC. Pittsburgh, PA 15215 As an authorized C3PAO, Schneider Downs can help by conducting an official CMMC assessment for your organization, helpbecome CMMC certified by conducting readiness consulting engagements to identify gaps within your controls and help remediate those gaps prior to your CMMC assessment, conduct mock CMMC assessments or help with policy creation. Schneider Downs has several CMMC Certified Professionals (CCP) and CMMC Certified Assessors (CCA) who are trained in using the CMMC Assessment Process (CAP). Organizations Seeking Certification (OSCs) should note that a single firm cannot perform both consulting and assessment service for a single client per the CyberAB standards. For more information contact us at contactsd@schneiderdowns.com. | Pittsburgh, PA 15215 One PPG Place, Suite 1700 | ewright@schneiderdowns.com +1 412-697-5328 | ||
SECURE OPERATING SOLUTIONS LLC Richmond, TX 77406 | Richmond, TX 77406 1515 Pecan Branch Dr | info@secureoperatingsolutions.com +1 832-614-2382 | ||
SECURESOFT TECHNOLOGIES LLC Greenbelt, MD 20770 Founded in 2004, SecureSoft Technologies LLC (SST) is a U.S.-based cybersecurity assessment and advisory firm specializing in independent CMMC Level 2 assessments and cybersecurity risk evaluations for organizations operating within the Defense Industrial Base (DIB) and other regulated environments. SST is a HUBZone-certified small business and an Authorized CMMC Third-Party Assessment Organization (C3PAO). The company conducts assessments in accordance with 32 CFR Part 170, Cyber AB requirements, and applicable Department of Defense (DoD) guidance, supporting Organizations Seeking Certification (OSCs) through objective, evidence-based evaluations. SST’s assessment expertise is grounded in federal and industry-recognized frameworks, including CMMC 2.0, NIST SP 800-171, NIST SP 800-53, and the NIST Risk Management Framework (SP 800-37). Our approach emphasizes consistency, assessment integrity, and strict separation between assessment activities and advisory or implementation services. SST assessors and supporting personnel maintain advanced industry certifications such as CISSP, CCSP, CNDA, and CCIE, and bring prior experience supporting mission-critical cybersecurity programs across the Department of Defense (DoD), Defense Logistics Agency (DLA), U.S. Air Force (USAF), Defense Information Systems Agency (DISA), and DHS Customs and Border Protection (CBP). SecureSoft Technologies is committed to upholding the principles of independence, impartiality, and quality assurance, ensuring assessment results are accurate, defensible, and aligned with Cyber AB and DoD oversight expectations. Assessments are conducted using documented methodologies designed to support consistency, objectivity, and secure handling of Controlled Unclassified Information (CUI) throughout the assessment lifecycle. | Greenbelt, MD 20770 7221 hanover parkway, Suite D | cmmc@secsofttech.com +1 240-770-2097 | ||
SECURESTRUX, LLC Lancaster, PA 17603 SecureStrux is committed to building long-term partnerships with organizations navigating CMMC and federal cybersecurity requirements. We guide clients through every phase of the compliance journey, delivering practical support through gap assessments, hands-on remediation, evidence and documentation development, security program alignment, and realistic mock assessments designed to prepare teams for successful certification outcomes. As an Authorized C3PAO, we use sound judgement and experience to provide you with a fair and objective CMMC Level 2 Assessment for your organization. Please Contact us for more information: bd@securestrux.com All of our CMMC team members are highly experienced, certified CMMC Register Practitioners areCCAs), US Citizens, and hold DoD clearances. As a cybersecurity firm with deep roots in the Department of Defense (DoD) cybersecurity community, we provide specialized services in the areas of compliance, vulnerability management, cybersecurity strategies, and engineering solutions. Since 2013, we’ve partnered with hundreds of organizations within and outside the DoD to understand and proactively manage their cyber risk. Other services we provide, include, preparing organization for Cyber Operational Readiness Assessments (CORAs), building SIPR Networks, helping clients obtain RMF ATOs and ATCs within the DoD, pentesting, secure on-prem and cloud engineering, and preparing and auditing organizations for CMMC compliance. Learn More: Our CMMC Services Follow Us: linkedin: SecureStrux linkedin: PowerStrux 4x Inc. 5000 Fastest Growing Companies | 2x Certified Great Place to Work | Authorized CMMC C3PAO Company | ISO 9001 & 27001 Certified | American Business Award for Tech Innovation | Fortress Cybersecurity Award | 2x Gold Hire Vets Medallion Award & Employer Support of the Guard and Reserve Award (ESGR) Patriot Awardee | Lancaster, PA 17603 8 West King St, Suite 824 | cmmcassist@securestrux.com +1 717-262-2672 | ||
SENTAR, INC. Huntsville, AL 35806 Sentar, Inc. – Your Trusted Partner for CMMC Certification and Compliance Sentar, Inc. is the reliable and affordable choice for organizations seeking an experienced Authorized CMMC Third-Party Assessor Organization (C3PAO). As a Defense Industrial Base (DIB) contractor ourselves, we’ve successfully navigated the same compliance challenges you face and recognize there are multiple ways to meet compliance. With a 100% certification success rate on all Cybersecurity Maturity Model Certification (CMMC) Level 2 certifications and Joint Surveillance Voluntary (JSV) assessments conducted to date, Sentar has earned a reputation for delivering stress-free, professional, and flexible services that clients consistently praise. Why Choose Sentar? Proven Success: Sentar boasts a proven track record in assisting clients to achieve in CMMC certifications, ensuring peace of mind throughout the assessment process. Multiple Teams and Year-Round Availability: With multiple assessment teams and spare Lead Certified CMMC Assessors (CCAs), Sentar ensures your assessment will be conducted on time—no delays, no uncertainty. You can count on us. Defense Contractor Expertise: As a DIB contractor, we’ve lived the compliance journey firsthand. This unique perspective allows us to provide practical, real-world guidance tailored to your needs. Affordable Services: Sentar is committed to providing cost-effective solutions without compromising quality, making us an accessible choice for organizations of all sizes. Early Certification Opportunities: Whether you’re preparing for the official CMMC rule implementation or seeking an early Level 2 certification under the DoD DIBCAC/CYBER AB JSV program, Sentar is ready to assist. Contact Us Reach out to Harold Hamilton at Harold.Hamilton@Sentar.com or Clay Coleman at Clay.Coleman@Sentar.com for more details, or visit https://www.sentar.com/contact/ A Leader in Cybersecurity and Compliance As a proud supporter of the Cyber AB, Sentar became a Registered Provider Organization (RPO) in 2020 and stands out as one of the few C3PAOs that is also a FedRAMP Third-Party Assessor Organization (3PAO). This unique combination is a critical differentiator for organizations utilizing cloud applications not listed on the FedRAMP Marketplace. Sentar’s expertise is further validated by its prior certification under ISO/IEC 17020:2013 as a Cybersecurity Inspection Body, accredited by the American Association for Laboratory Accreditation (A2LA). This achievement demonstrates Sentar’s readiness to meet the upcoming Cyber AB ISO 17020 certification requirements for C3PAOs, making us a reliable multi-year assessment partner for organizations seeking long-term compliance. Comprehensive Support for Compliance and Remediation Since 2015, Sentar has helped over 250 DoD contractors achieve compliance with DFARS 252.204-7012 requirements. Our advisory services have enabled dozens of clients to successfully pass CMMC JSV assessments, as well as DIBCAC Medium and High Confidence assessments under DFARS 252.204-7020. Sentar’s deliverables—including System Security Plans (SSPs), Plans of Action and Milestones (POAMs), policies, procedures, and more—are tailored to ensure your organization’s success. A Trusted Partner for CMMC Certification Sentar is committed to helping your organization navigate the complexities of CMMC certification and compliance. Whether you need assistance with implementation, remediation, or assessment preparation, our experienced team is ready to guide you every step of the way. Note: Sentar cannot conduct certified CMMC assessments for organizations that have engaged our advisory services within the past three years, in accordance with ethical guidelines. | Huntsville, AL 35806 675 Discovery Dr NW, Suite 205 | info@sentar.com +1 256-430-0860 | ||
SENTINEL BLUE Warrenton, VA 20186 Sentinel Blue is a leading cybersecurity and compliance service provider, laser-focused on the U.S. defense industry. We're on a mission to bring enterprise-grade cybersecurity to small and medium sized businesses. When it comes to cybersecurity and compliance for defense contractors, we're a trusted advisor with a track record of success. Sentinel Blue was founded out of direct experience in defense contracting: we've been in the shoes of business leadership in the defense industry. We know the challenges you're up against. You won't find a better partner on your journey. Sentinel Blue brings a powerhouse of world-class capabilities to companies in the defense industrial base (DIB): Sentinel Shield: Our premier service offering. Sentinel Shield is a comprehensive cybersecurity and IT services offering for small and medium-sized defense contractors, intended to specifically meet their cybersecurity requirements. It was designed for defense contractors, by a team that comes from defense industry. We stand out clearly amongst our peers as one of the few providers who started in defense and continue to work for defense. CMMC Consulting and Certification: Sentinel Blue is an authorized Certified 3rd Party Assessment Organization (C3PAO) and has a staff of experts who are deeply knowledgeable on CMMC, NIST 800-171, and defense cybersecurity requirements. Whether you're just starting on the journey or ready for an assessment, we'll get you on your way. Microsoft Government Licensing and Migration: Sentinel Blue is a Microsoft AOS-G partner, which makes us one of the few organizations able to sell Microsoft 365 GCC High and Azure Government services. And we're among the even fewer who use Microsoft 365 GCC High and Azure Government in our own business. That uniquely suits us to ensure you make the correct licensing choices and your services are properly configured. Managed Security Operations Center: Sentinel Blue offers a fully managed security operations center (SOC) that can protect your environment and detect anomalies and malicious activity. Built on Microsoft's Sentinel, your data stays in your tenant; but our expert team reviews your data, processes threat intelligence and takes response on your behalf. It's built in the Microsoft Government cloud, staffed only by U.S. persons, so your data stays compliant. | Warrenton, VA 20186 332 W Lee Hwy, Ste 236 | cmmc@sentinelblue.com +1 571-485-9030 | ||
SERA BRYNN Plano, TX 75252 Sera Brynn is a CMMC, FedRAMP, and GovRAMP assessment organization. Only a handful of companies worldwide have earned all three certifications. For 15 years, we've been assessing defense contractors and cloud service providers against complex federal cybersecurity requirements. We're assessors who really enjoy seeing our clients achieve certification. Our company was founded by veterans of the U.S. military and intelligence communities. We bring that same mission-focused dedication to every engagement, paired with an approach that's refreshingly human. We believe rigorous doesn't have to mean painful, and thorough doesn't have to mean adversarial. We specialize in CMMC Level 2 assessments for organizations in the Defense Industrial Base, from manufacturers with a few employees to enterprises with thousands. If you're handling CUI and need to get certified, we're here for your assessment. WHY SERA BRYNN We're the assessors defense contractors prefer to work with. Most organizations have heard horror stories about assessors who are difficult, uncommunicative, or seem more interested in finding and celebrating faults than conducting a fair assessment. That's not us. We take our role seriously (your certification depends on it) but we also treat you like a valuable client, not an adversary. Triple-certified expertise. We hold FedRAMP 3PAO, CMMC C3PAO, and GovRAMP Assessor certifications. Only a handful of companies can say that. 15 years of experience. We've been advising on 800-171 & DFARS 7012 since 2015, long before CMMC existed. We know the standards inside and out. Founded by those who served. Our team includes veterans and family members of U.S. intelligence and military special operations. We understand what's at stake. Clear communication. We explain what we're doing, why we're doing it, and what to expect. No guessing games. We want you to succeed. We're not here to trip you up. We're here to conduct a fair, thorough assessment. SERVICES CMMC Level 2 Certification Assessment An L2 Assessment performed by an Authorized C3PAO. We assess the 110 requirements & 320 objectives in NIST 800-171 using a tailored methodology. Our assessors explain what's being reviewed, how evidence is evaluated, and how decisions are made. CMMC Level 2 Mock Assessment A non-certification assessment that mirrors the structure and expectations of a Certification Assessment. You'll receive clear results on what meets requirements and what still needs attention. POA&M Closeout Assessment Organizations that receive Conditional Status have up to 180 days to address identified gaps. Our POA&M Closeout Assessments are responsive and efficient so you can achieve Final status quickly. ASSESSMENT AVAILABILITY Demand for CMMC Level 2 assessments continues to grow and scheduling early matters. Sera Brynn maintains a large, experienced assessor team to support steady availability and predictable timelines. If you're planning for certification, now is the right time to reserve your assessment window. WHO WE WORK WITH We serve defense contractors all across the Defense Industrial Base, from aerospace manufacturers to IT service providers to small machine shops. If you handle Controlled Unclassified Information and need CMMC Level 2 certification, we are here to perform your assessment. Company size doesn't matter to us. We can assess organizations as small as 3 people and as large as 50,000. What matters is that you're ready for certification and want an assessor who will treat you right. READY TO GET STARTED? Contact us to discuss your assessment or reserve your assessment window. Sera Brynn Dallas & Chesapeake | Serving clients nationwide cmmc@serabrynn.com serabrynn.com The gold standard in CMMC Assessments - fast, friendly, and fair. | Plano, TX 75252 4324 Mapleshade, Suite 330 | cmmc@serabrynn.com +1 877-701-8000 | ||
SHELLPROOF Greenvale, NY 11548 Choosing a compliance partner is a major investment. Defense contractors choose Shellproof because we don't just hand you a checklist we deliver a clear, predictable path to certification without disrupting your business. 1. WE BRIDGE THE GAP TO ADVANCED FRAMEWORKS We don't look at CMMC in a vacuum. Our readiness assessments are built natively around NIST SP 800-171, creating a seamless, logical bridge to advanced compliance frameworks like CMMC Level 2 and FedRAMP. Furthermore, we understand how these controls interlink with ISO 27001 and SOC 2. We map your security controls intelligently so you can meet multiple compliance goals without duplicating work or paying twice. 2. WE DEMYSTIFY AND SIMPLIFY NIST STANDARDS NIST and CMMC documentation can be dense and overwhelming. We translate complex regulatory requirements into plain, actionable language. Whether you are dealing with traditional encryption protocols or implementing modern, AI-based security controls, we break down exactly what is required so your IT team can execute with confidence. 3. PROVEN, AUDIT-ALIGNED METHODOLOGIES We don't guess what auditors want; we use the exact same defined methodologies, assessment guides, and scoping rules that official C3PAO auditors use. By conducting rigorous mock assessments using true-to-life audit criteria, we ensure your team experiences zero surprises and zero costly delays during your formal evaluation. 4. FLEXIBLE OFFERINGS TO FIT YOUR BUSINESS Every defense contractor has a unique footprint, budget, and timeline. We don't force you into a rigid, one-size-fits-all consulting package. Shellproof provides highly flexible service tiers—ranging from quick, budget-conscious gap assessments to comprehensive, end-to-end readiness advisory—tailored entirely to your operational realities. The Bottom Line: Shellproof transforms compliance from a stressful business bottleneck into a competitive differentiator. We ensure your security posture is robust, your team is confident, and your organization is fully equipped to win and protect critical DoD contracts. | Greenvale, NY 11548 14 Plaza Road Greenvale NY 11548 | info@shellproof.co +1 212-887-1603 | ||
SMITHERS QUALITY ASSESSMENTS Fairlawn, OH 44333 | Fairlawn, OH 44333 3637 Ridgewood Road | robert.mcvay@smithers.com +1 330-801-9213 | ||
AAPIT KONIAG CYBER, INC. Atlanta, GA 30318 SoundWay is a technology & management consulting firm specializing in CMMC support and certification services. SoundWay has a track record of excellence helping companies across the United States from Maryland to California. SoundWay also offers additional consultative and training services to dramatically reduce corporate exposure to cyber risk. (Please note the use of these additional services will preclude SoundWay from acting in a C3PAO capacity. | Atlanta, GA 30318 1055 Howell Mill Rd NW, 9082 | c.schoenberg@soundwayconsulting.us +1 571-210-0624 | ||
SPECIALIZED SECURITY SERVICES, INC. Plano, TX 75093 Specialized Security Services, Inc. (S3 Security) is a woman-owned, Dallas-based cybersecurity firm with over 25 years of experience helping highly regulated organizations safeguard data, meet compliance requirements, and reduce cyber risk. As both a CMMC Registered Practitioner Organization (RPO) and a Certified Third Party Assessment Organization (C3PAO), we provide comprehensive guidance and assessments for Department of Defense (DoD) contractors across the Defense Industrial Base (DIB). S3 Security is trusted by clients nationwide for our seasoned assessors, strategic advisory capabilities, and commitment to clarity and transparency throughout the CMMC journey. Why Choose S3 Security for CMMC? Proven Experience in High-Stakes Environments •Over two decades of work with defense, healthcare, financial, retail, and energy sectors—industries where security and compliance are mission-critical. • Certified in multiple frameworks including NIST, ISO, HIPAA, SOC, and PCI, enabling us to bridge CMMC with broader enterprise risk and compliance needs. End-to-End Support from Readiness to Certification • Readiness assessments tailored to your environment, timeline, and business objectives • CMMC Level 1 and Level 2 assessments conducted by certified professionals with firsthand knowledge of DoD contracting challenges • Actionable, business-aligned recommendations Advisory-Led, Client-Focused Approach • Clear, step-by-step guidance to help you understand and implement CMMC requirements with confidence • Dedicated project managers and executive-level support ensure alignment across your teams • Prioritization of long-term security and operational resilience—not just one-time certification With S3 Security, you gain more than a vendor—you gain a long-term partner invested in your compliance, your business, and your success. | Plano, TX 75093 4975 Preston Park Boulevard, Ste 500 | businessoperations@s3security.com +1 972-378-5554 | ||
STEELTOAD North Bethesda, MD 20852 CMMC AUTHORIZED C3PAO TEAM@STEELTOAD.COM CALL For CMMC Services 1-833-333-8623 https://www.steeltoad.com Our CMMC Instructors are CMMC Lead Assessors. CMMC LTP and CMMC C3PAO - Authorized AND Approved! SteelToad participates in the buy Maryland Cybersecurity Tax Credit (BMC) | Maryland Department of Commerce. A Qualified Maryland Company may claim a tax credit for 50% of the net purchase price of cybersecurity technologies and services bought from a Qualified Maryland Cybersecurity Seller. Buy Cyber Maryland SteelToad is supporting organizations to improve security: https://www.steeltoad.com LOCK IT DOWN - Our CMMC Services help to protect your information: CMMC Executive Training and Briefs CMMC public/private training services C3PAO Authorized and Approved Certification Assessments CMMC Gap & Mock Assessment, Scoping Calls and Readiness Reviews Supplier Performance Risk System (SPRS) Support for self-assessments Our team of CMMC Instructors and CMMC Lead Assessors perform training and cyber assessments for large publicly traded companies, manufacturing companies, 8As, Women Owned, HUBZone and Veteran owned organizations. For 25 years our team has provided cybersecurity, risk management, and compliance consulting services to the government and commercial companies. We are certified partners with certified staff in FedRAMP, CMMC, CMMI Institute and ISO quality management standards. 1-833-333-TOAD/1-833-333-8623 Or Team@Steeltoad.Com Our CMMC Training and Assessment services support the (DIB) through public/private training offerings, CMMC pre-assessments, CMMC (Level 1-2) gap assessments and certified CMMC assessments. Why SteelToad? Our CMMC instructors and assessors have over 50 years of cyber work experience in the Department of Defense, Department of State, Department of Homeland Security and Treasury along with supporting the DIB. Since 2002, experienced in assessing government, manufacturing and contractor systems. Fixed-price Gap and CMMC Assessments. Our staff have Certifications in ISO, FedRAMP, CMMI, CISSP, CISA, CISM. https://www.steeltoad.com | North Bethesda, MD 20852 12358 Parklawn Drive, Suite #300 | team@steeltoad.com +1 833-333-8623 | ||
STRATEGICIT SOLUTIONS LLC Herndon, VA 20171 StrategicIT Solutions provides preparation and assessment services to federal contractors for Cybersecurity Maturity Model Certification (CMMC). We are a Candidate C3PAO Organization. Our CMMC Certified Assessor and Professionals can help your organization prepare for or get assessed at CMMC Level 2 certification. | Herndon, VA 20171 13800 Coppermine Rd | manas.das@strategicit-solutions.com +1 703-880-2492 | ||
SYSAUDITS Williamsburg, VA 23185 SysAudits, LLC is a small minority owned company located in Virginia that specializes in offering exceptional service involving information technology security audits. Contact info: info@sysaudits.com. SysAudits staff and ownership is composed of skilled auditors with certifications as Certified Public Accountants (CPA), Certified Information Systems Auditor’s (CISA), Certified in Risk and Information Systems Control (CRISC), and Certified Information Systems Security Professional (CISSP). We believe our skill mix and mind set of understanding technology and business risks, costs, and internal controls is found to be beneficial for both the Audit department and the Technology operations side of an organization. We specialize in performing and assessing system audits for government (Federal, State, Local, Non-Profits, and Education) as well as the commercial sector. Serves Offered: SysAudits system security services include regulatory gap/pre-assessments, network assessments, general system administration controls, security solution support, audit liaison support, and many other IT cyber assessments. More specifically, our services are directed towards performing regulatory assessments, readiness assessments involving NIST 171, 800-53, FISMA, HiTrust, ITAR, and many others. FISMA/ITAR/CMMC/HIPAA/HiTrust Assessments and Audits The Federal Information Security Management Act (FISMA) is a federal law under the E-Gov Act that was enacted to increase the security posture of government agency federal systems, bureaus, departments and their supporting entities. For Federal agencies that are required to comply with FISMA, the requirement extends to compliance with their 3rd party providers which may include outsourced data centers, application providers, and cloud service providers. International Traffic in Arms Regulations (ITAR) control the export and import of defense-related articles and services on the United States Munitions List (USML). Overseen by the U.S. State Department, U.S. Commerce Department, and Department of Defense, ITAR data must be protected and restricted under NIST 171 guidance. DOD CMMC and NIST 171 security control assessment for Levels 1-3. Perform readiness assessments for compliance with mandated policies, procedures, design, and implementation of the 120+ security controls. Assist organizations in designing and implementing the security controls. Assist organizations through knowledge transfer to support enhanced policies, procedures, and operations to meet CMMC controls. The HiTrust and Health Insurance Portability and Accountability Act (HIPAA). HIPAA was enacted by Congress in 1996 with the Security Rule in place as a methodology to safeguard electronic Protected Health Information. HIPAA applies to healthcare providers, plans, and clearinghouses, (known as covered entities), and any organization contracted by covered entities to perform work including ePHI (business associates). The HIPAA Security Rule is based on three types of security safeguards (physical, technical, and administrative. HiTrust is an independent certification for HIPAA and SysAudits has assisted organizations in HiTrust readiness assessment, gap assessment, and audit liaison support. SysAudits offers a variety of services to assist in meeting regulatory compliance from an operational Office of CIO and an Inspector General (IG) audit perspective. OCIO pre-assessments can assist IT leadership in identifying weaknesses in meeting regulatory and assist in developing plans of actions and milestones prior to an Audit assessment. The value in an internal self-assessment is identifying weaknesses prior to an external audit. Audit assessments are clearly performed as an independent audit to determine an organization compliance in meeting regulatory requirements. SysAudits staff have extensive experience on both the Audit and CIO perspective. This perspective brings value in performing pre-assessments and audits which makes SysAudits stand out amongst other consulting firms. SysAudits methodology consists of assessing, testing and reviewing information systems through in-depth assessment of NIST defined management, operational, and technical testing of controls. The following represents services provided by SysAudits: NIST 171, ITAR and CMMC compliance NIST 800-53 compliance FIPS 199 categorization, FIPS 200 and agency control selection. Security controls assessment. Authorization recommendation of system and continuous monitoring. Security Assessment Plan (SAP), Rules of Engagement (ROE), and Security Assessment Report (SAR) development. Vulnerability Management and Continuous Monitoring Penetration testing. Internal Vulnerability testing. Wireless and mobile security assessments. Application, database, and infrastructure vulnerability scanning and results interpretation. Architecture and system boundary assessments. Secure configuration management administration and operations. Network design and third-party service provider evaluations. Contingency system planning and additional guidance based on your agency’s requirements. Compliance program pre-assessments. FISMA documentation development, including System Security Plan (SSP), Contingency Plan (CP), Incident Response Plan (IRP), Configuration Management Plan (CMP), Privacy Impact Assessment (PIA), and FIPS 199 Security Categorization, Policies, Procedures, etc. IT Audits SysAudits Has Extensive Experience In Performing All Types Of IT Audits That Include Audits Of: Vulnerability management programs. General and application controls. Disaster recovery, business continuity, and backup and recovery. Event management, incident response, and remediation. Penetration testing. Internal vulnerability testing. Secure configuration management. Complete data center and outsourced service provider physical, environmental, and access controls. Cloud Planning. System development life cycle for new applications and enhancements. IT Contracting and procurement. IT Contract re-design, consolidation, and enterprise re-architect of enterprise IT contracts. IT contract investigation and litigation support: cost mischarging; contract close outs under terminations for convenience and performance. IT policy and procedures. OCIO and IT Organizational Assessments (structure, personnel, and services) Many others. | Williamsburg, VA 23185 1313 Jamestown Rd, #104, #104 | 11dc@sysaudits.com +1 703-867-0424 | ||
SSE Saint Louis, MO 63132 SSE is uniquely qualified as an authorized C3PAO because of our multiple roles within the Defense Industrial Base (DIB). We bring unparalleled experience and direct, practical expertise: As a defense contractor responsible for protecting our own CUI. As an RPO and MSP/MSSP helping businesses assess, implement, and maintain compliance with NIST SP 800-171 since 2020. As a C3PAO authorized to perform CMMC Level 2 certification assessments. Our expertise comes from supporting hundreds of clients as they prepare for their CMMC certification assessments, as well as from achieving our own CMMC Level 2 certification. Our team brings deep technical knowledge of every control and assessment objective, along with the many ways those requirements can be effectively implemented. We have worked with a broad range of CMMC solution sets, including GCC High, VDI, cloud enclaves, on-premises systems, and hybrid environments. That knowledge and experience are the key to your success and the timely completion of the assessment process. With SSE, you engage a team that has: Operated as a DoW contractor responsible for protecting CUI under the same requirements we assess. Guided hundreds of companies through CMMC preparation as an RPO. Achieved a perfect score of 110 in our own assessments, including CMMC Level 2 and DIBCAC High. CCA- and LCCA-certified professionals with a combined 45 years of experience managing compliance with NIST SP 800-171 and NIST SP 800-53 requirements. | Saint Louis, MO 63132 9666 Olive Boulevard, Suite 710 | eeniedringhaus@SSEinc.com +1 314-439-4700 | ||
TALATEK Scottsdale, AZ 85251 CMMC Compliance Expertise with Continuous Monitoring Compliance isn’t a one-time milestone—it’s an ongoing process. As regulations and technologies evolve, organizations in the Defense Industrial Base must implement continuous monitoring to stay up to date with changing regulations, technology, and provide evidence of ongoing compliance. Our services ensure you remain audit-ready and resilient by delivering: Advisory and readiness planning Gap assessments and POA&M development Continuous monitoring strategies for real-time visibility Centralized evidence management for audits and reporting FedRAMP & Broader Compliance Support As a FedRAMP 3PAO since 2014, we’ve guided numerous clients through authorizations and sustainment. Our expertise spans HIPAA, FISMA, and other frameworks, ensuring secure compliance across healthcare, defense, and federal sectors. Powered by TiGRIS Our FedRAMP-accredited TiGRIS platform automates alerts, POA&M tracking, and evidence collection—giving you confidence in your compliance posture every day. Start Your Continuous Compliance Journey Today: Request a Consultation Download the Readiness Guide Talk to a Compliance Expert | Scottsdale, AZ 85251 6900 E. Camelback rd, #900 | balsinawi@talatek.com +1 571-771-0711 | ||
TCIC COE LTD. Taipei, TPE 110032 TCIC CoE Ltd. (TCIC), based in Taipei, Taiwan, is a CMMC Third-Party Assessment Organization (C3PAO) providing independent CMMC Level 2 Certification Assessment services to Organizations Seeking Certification (OSCs) supporting the Defense Industrial Base (DIB). Working in collaboration with its affiliated organizations, TCIC Global Certification Ltd. in Canada and TCIC LTD. in Taiwan, TCIC combines international resources, cybersecurity expertise, and third-party conformity assessment experience to support OSCs worldwide. This international network enables TCIC to effectively serve organizations across North America, the Asia-Pacific region, and other global markets. TCIC's CMMC assessment services are delivered by qualified CMMC assessment professionals in accordance with CMMC requirements and The Cyber AB requirements. With extensive experience in cybersecurity, information security, privacy, artificial intelligence, IT service management, business continuity, and industrial cybersecurity, the TCIC group also provides third-party certification services for international standards including ISO/IEC 42001, ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 20000-1, ISO 22301, and IEC 62443-2-1. Through its global presence, multilingual capabilities, and extensive third-party assessment experience, TCIC is committed to delivering objective, impartial, consistent, and evidence-based CMMC assessments to OSCs worldwide and supporting the protection of Controlled Unclassified Information (CUI) throughout the global Defense Industrial Base. | Taipei, TPE 110032 12F-2, No.161, SongDe Road, Xinyi District, Taipei City 110, Taiwan | daniel@mail.tcicgroup.com +886 988 292 678 | ||
TECHELLENCE Paramus, NJ 07652 Techellence delivers trusted technology leadership services that aligns your business strategy with solutions to maximize profitability, efficiency, and security. As a C3PAO, we perform CMMC audits, readiness assessments, and provide expert consulting to help you secure and maintain government contracts. | Paramus, NJ 07652 501 Route 17, Suite 1 | sang@techellence.com +1 844-832-4244 | ||
TEVORA BUSINESS SOLUTIONS, INC Irvine, CA 92618 Founded in 2003, Tevora is a specialized management consultancy focused on cybersecurity, risk, and compliance services. Based in Irvine, CA, our experienced consultants are devoted to supporting the CISO in protecting their organization’s people, data, and assets. We make it our responsibility to ensure the CISO has the tools and guidance they need to build their security strategy, so they can prevent and respond to daily threats. As a CMMC RPO & C3PAO, Tevora is prepared to support your organization through its CMMC journey with compliance planning, gap assessments, document preparation, live audit support, mock assessments, or certification assessments. Our expert advisors and assessors take the time to learn about each organization’s unique pressures and challenges, so we can help identify and execute the best solutions for each case. Tevora: Go forward. We’ve got your back. | Irvine, CA 92618 17400 Laguna Canyon Rd, Suite 150 | sales@tevora.com +1 949-250-3290 | ||
TES CONSULTANTS McLean, VA 22102 The Enterprise Security Consultants, LLC (dba TES Consultants) is an authorized C3PAO and IT & Cybersecurity firm owned by Elisabeth . Backed by deep industry experience and technical expertise, TES delivers innovative solutions that strengthen the missions of U.S. Military, Federal, State, and commercial clients. | McLean, VA 22102 1751 Pinnacle Drive, Suite 600 | compliance@tesconsultants.com +1 703-861-4151 | ||
THE GOVERNANCE GROUP Johns Creek, GA 30097 | Johns Creek, GA 30097 130 Jilstone Ct | info@governancegroupinc.com +1 678-852-7911 | ||
VAULTES Reston, VA 20190 Vaultes is a leading-edge cybersecurity company specializing in cybersecurity audits, risk management, readiness, and remediation. As a Cyber Security Inspection Body and ISO 17020:2012 accredited organization, Vaultes adheres to the strictest quality standards ensuring top-notch technical delivery and customer service. In addition to being an authorized CMMC Third Party-Assessment Organization (C3PAO), Vaultes is an authorized FedRAMP-certified 3PAO and StateRAMP-certified 3PAO attesting to their deep knowledge and experience in cybersecurity and assessment services. | Reston, VA 20190 12110 Sunset Hills Rd, Suite 600 | david.nazario@vaultes.com +1 202-816-6658 | ||
COALFIRE FEDERAL Chantilly, VA 20153 Coalfire Federal has been providing cybersecurity, risk management, and compliance consulting services to government and commercial organizations for over 20 years. As the leading FedRAMP 3PAO, we possess the experience and demonstrated knowledge to help clients accelerate their cloud strategy and enable their mission. We deliver accurate, objective CMMC advisory and assessment services to ensure successful compliance programs across government frameworks including CMMC, FedRAMP, DoD RMF, FISMA, and NIST 800-171. The Coalfire Federal team's CMMC expertise can help your organization navigate the CMMC journey and help protect the mission. As an Authorized CMMC C3PAO and RPO partner, Coalfire Federal is committed to providing cybersecurity services that enable and protect the mission of the DoD and its supply chain. We support Organizations Seeking Certification (OSC) by providing vendor-agnostic, strategic CMMC advisory services: Our CMMC Advisory Services include: • CUI Boundary Analysis • Gap Analysis • Remediation Strategy and vCISO support. Coalfire Federal is ISO 9001, ISO 17020, ISO 20000, and ISO 27001 certified. As one of the first companies selected to be an RPO and an Authorized C3PAO, we are prepared to support your CMMC journey and help protect the mission. For more information about Coalfire Federal and our CMMC services, please contact us today CMMC@CoalfireFederal.com or visit www.coalfirefederal.com for more information. | Chantilly, VA 20153 PO Box 220985 | cmmc@coalfirefederal.com +1 435-999-3213 | ||
WISE TECHNICAL INNOVATIONS Norfolk, VA 23505 | Norfolk, VA 23505 249 E. Little Creek Rd., 202 | koren@wtinetworks.com +1 757-676-2205 |
Staff credential definitions are taken from the Cyber AB Ecosystem Roles page. ISACA is now the Authorized CAICO for the CMMC program. The CCP, CCA, LCCA and CCI credentials are issued through ISACA.
Official CMMC scoping and assessment guides, model overview, and documentation.
Locate certified CMMC assessors, trainers, and instructors to prepare for implementation.
Basic Safeguarding of Covered Contractor Information Systems: the 15 security requirements for CMMC Level 1.
The foundational standard for protecting CUI in nonfederal systems: the core of CMMC Level 2.
Cybersecurity guidance and resources from the Cybersecurity and Infrastructure Security Agency.
The Manufacturing Extension Partnership helps small businesses understand cybersecurity requirements.