Cyber AB Marketplace Guide: How to Find and Verify CMMC Providers

If you read nothing else, read this table

Terms defined as we go: C3PAO (CMMC Third-Party Assessment Organization), RPO (Registered Practitioner Organization), MSP/MSSP (Managed Security Service Provider), CCA (Certified CMMC Assessor), CCP (Certified CMMC Professional), SSP (System Security Plan), DFARS (Defense Federal Acquisition Regulation Supplement).

What is the Cyber AB Marketplace?

CMMC — the Cybersecurity Maturity Model Certification program — became a federal regulation on December 16, 2024, codified at 32 CFR Part 170. The program exists to verify that defense contractors protect two kinds of government data: Federal Contract Information (FCI), which is non-public information generated under a contract, and Controlled Unclassified Information (CUI), which is more sensitive unclassified information that requires safeguarding.

The Marketplace is where the ecosystem becomes real. It lists the firms that assess you, the firms that help you prepare, and the individuals who carry credentials — and it shows the role and status each one holds. That’s its job. It is a status directory. It is not a recommendation engine, a quality ranking, or a price comparison.

What does a Cyber AB Marketplace listing actually prove — and what does it not prove?

A Marketplace listing is necessary, but it isn’t sufficient — and the government’s own watchdog has said so. In January 2025, the DoD Office of Inspector General published an audit (Report No. DODIG-2025-056) of how assessment firms get authorized. The finding was blunt: the DoD had failed to effectively implement the process that authorizes third-party organizations to conduct Level 2 CMMC assessments. A C3PAO has to clear 12 separate requirements before it’s authorized — only two of those 12 were fully implemented. The OIG issued 10 recommendations.

This isn’t a reason to distrust C3PAOs as a group — it’s a reason to verify the specific one you’re considering. Confirm its current status, confirm the assessment team, confirm independence, and keep a record of what you saw. Two minutes of verification beats a failed engagement.

Who runs the Cyber AB Marketplace, and who certifies CMMC assessors now?

This is the single most common thing outdated guides get wrong. For years, the Cyber AB did both jobs: it accredited the firms andcredentialed the people. That split at the end of 2025. Here’s the division of labor today:

C3PAO vs. RPO vs. RP vs. CCA: every Cyber AB Marketplace role, explained

We built the table below by reading the Cyber AB’s official role definitions and cross-checking the authority and conflict rules against 32 CFR Part 170. The column most other guides skip — “who credentials this now” — reflects the December 2025 ISACA transition.

See also: RPO vs. C3PAO — what’s the difference? · CMMC provider categories guide

Cyber AB Marketplace guide: how to verify a provider in 5 steps

Real defense contractors describe this directory as hard to use. On Reddit’s r/CMMC, contractors have vented that it’s tough to search and that results don’t always line up with the profile you clicked. So here’s the workflow we’d use.

1. Step 1: Go to the official directory

   cyberab.org/Catalog. Not a third-party "marketplace," not the provider's own badge page.

2. Step 2: Search the exact legal name

   (and any "doing business as" name). Common names produce noise — be precise.

3. Step 3: Confirm the role

   Is the firm shown as a C3PAO, or only as an RPO, RP, CCP, or training role? People assume "they're on the Marketplace" means "they can assess me." Often it doesn't.

4. Step 4: Confirm the status

   For a C3PAO you want Authorized or Accredited — not "Candidate," not "in process," and definitely not "pre-certified" (which isn't a real status).

5. Step 5: Check the people, then check for conflicts

   For a C3PAO, look for listed CCAs and a Lead CCA. For an RPO, confirm it has at least one listed RP or RPA. For an individual, confirm their affiliation with a listed firm. Then apply the independence test.

See the full list of verified providers: Find an authorized C3PAO · C3PAO directory

What should you screenshot or save from the Cyber AB Marketplace?

Treat verification like a procurement control, not a formality. For each provider you seriously consider, capture and keep:

• The provider's legal name (and any trade name).
• The role and status, copied exactly as displayed.
• The profile URL and a dated screenshot (with time zone).
• The individual credentials you checked (CCA, Lead CCA, RP/RPA), and their firm affiliation.
• Whether the legal entity matches the one on your statement of work.
• The independence question you asked, and the provider's written answer.
• Your re-check date — and re-check before you sign, before kickoff, and again before your assessment window. Statuses change.

Authorized vs. accredited C3PAO — and why the listing isn’t the whole story

This is a detail almost no buyer guide explains, and it can quietly affect your timeline. The codified requirement is the 27-month ISO/IEC 17020 accreditation window in § 170.9. The Cyber AB has also described an interim reauthorization step in its Town Halls, after which a firm reauthorizes or moves into the formal accreditation program. You don’t need to memorize the mechanics. You need to ask one fair question: “Where are you on the 27-month accreditation clock, and what’s your plan?”

Pair that with the OIG audit from earlier, which found gaps in how the authorization process was implemented in its early days, and the takeaway is consistent: a listing tells you a firm cleared a bar at a point in time. Your job is to confirm it’s current, confirm the team, and confirm independence. See our Best C3PAO for CMMC Level 2 guide for a deeper evaluation framework.

How many providers are in the Cyber AB Marketplace right now?

We compiled the figures below from the Cyber AB’s own monthly Town Hall reports and a published March 2026 analysis of the full Catalog. We’re showing the trend on purpose: a single snapshot tells you less than the direction of travel.

How we compiled this: figures are drawn from the Cyber AB’s monthly Town Hall reports (January–March 2026) and a published March 2026 analysis of the full Catalog export. These are point-in-time counts. Confirm the live number in the Catalog before you rely on it.

And the queue does tighten on a date you can plan around. According to the DoD CIO’s CMMC office, the program is rolling out in four phases. Phase 1 runs November 10, 2025 through November 9, 2026 and leans on self-assessments. Phase 2 begins November 10, 2026 — and from that point, where applicable, DoD solicitations will require Level 2 (C3PAO) certification, though the Department may choose to defer a given contract’s Level 2 requirement to an option period. For many contractors handling CUI, that’s when self-attestation stops being enough. Readiness work takes months. If a third-party assessment is in your future, November 10, 2026 is the date to plan backward from. That’s not manufactured scarcity; it’s the published schedule. See our C3PAO wait times and assessment backlog guide for the queue data.

Does your contract require Level 2 (Self) or Level 2 (C3PAO)?

This is where a lot of money gets wasted — people buy a third-party assessment they didn’t need, or assume self-assessment is fine when the contract demands a C3PAO. DFARS 252.204-7025 became effective November 10, 2025. It’s a solicitation provision (it shows up before award) and it does one job: it puts you on notice of the CMMC level you’ll need to be eligible. The contracting officer selects from these four:

The provision also asks you to list your CMMC Unique Identifier(s)— a CMMC UID is a 10-character alphanumeric identifier generated in SPRS for a CMMC assessment, covering the contractor information system(s) in that assessment’s scope.

How do DFARS 252.204-7012, -7019, -7020, -7021, and -7025 fit together?

How do CSPs, ESPs, cloud enclaves, MSPs, and GRC tools fit in?

Can the same provider prepare you and assess you?

The firm that knows your environment best is often the wrong firm to assess it. That feels inefficient. It isn’t. Independence is what gives your certification credibility and protects you from a conflict challenge.

So separate the work, and put it in writing. When you scope an engagement, get the provider to confirm: that it has not provided implementation or remediation services that would create a conflict for the assessment; that it will flag any actual or potential independence issue; and that it won’t represent readiness help as if it were a certification.

If you’re affected by this — say, you love your MSP and were hoping it could also certify you — don’t get stuck. Use your MSP for readiness, then bring in a separate assessor. We can help you map that handoff so neither relationship creates a problem.

How does the Cyber AB Marketplace work for primes and subcontractors?

The flow-down logic, in practice:

For primes, the Marketplace is also a verification tool for the partners and suppliers in your base. For subs, it’s how you confirm any readiness or assessment provider you bring in is real before the prime’s deadline lands on you. See our CMMC compliance guide for DoD subcontractors.

What if a provider isn’t listed in the Cyber AB Marketplace?

What we actually verified

We’re a trade publication, not a government office, and we think you should be able to see our work. For this guide we:

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification.

Sources we read

• 32 CFR Part 170 — CMMC Program (eCFR): § 170.9, § 170.14, § 170.17, § 170.23
• DFARS 252.204-7012, -7019, -7020, -7021, -7025; DFARS subpart 204.75 (Acquisition.gov)
• DoD CIO — CMMC program pages and phased-implementation schedule (dodcio.defense.gov)
• The Cyber AB — Marketplace/Catalog, Ecosystem Roles, and official notices (cyberab.org)
• ISACA — CAICO authorization announcement (December 17, 2025) and CMMC credentialing pages (isaca.org); defense-trade coverage of the transition
• DoD Office of Inspector General — Report No. DODIG-2025-056 press release (January 2025)
• Cyber AB Town Hall reports, January–March 2026, and a published March 2026 Catalog analysis
• NIST SP 800-171 Revision 2 (NIST CSRC)

Frequently asked questions about the Cyber AB Marketplace

The Cyber AB Marketplace: a status directory, not a rating system

The Cyber AB Marketplace is the official place to confirm a CMMC provider’s role and status — but a listing proves authorization, not fit. Verify the badge, document what you saw, keep readiness and formal assessment in separate hands, and remember the role map changed at the end of 2025 when ISACA took over individual credentialing. If you already know the exact authorized C3PAO you want, you don’t need us — open the Catalog and confirm them in two minutes. If you’re still deciding which kindof provider you need, that’s where a source-checked match saves you the most time and risk.

Also relevant: Best C3PAO for CMMC Level 2 · C3PAO directory · RPO vs. C3PAO · CMMC provider categories · vCISO services for CMMC · NIST 800-171 gap analysis