What an RPO is
A Registered Provider Organization (RPO) is a company registered with The Cyber AB, the accreditation body for the CMMC ecosystem, to provide CMMC advice and implementation help. To register, an RPO must employ at least one Registered Practitioner (RP) (an individual trained and registered to advise on CMMC), pass a background check, and follow The Cyber AB's code of professional conduct.
What an RPO typically does:
- Gap assessments against Level 1 or Level 2.
- Help defining your scope, including enclave decisions.
- Writing or reviewing your System Security Plan, policies, and procedures.
- Remediation plans and, sometimes, hands-on implementation.
- Preparation for your assessment (sometimes called a mock assessment).
What an RPO does not do
An RPO cannot perform your certification assessment or certify you. Level 2 certification assessments are performed by a C3PAO (CMMC Third-Party Assessment Organization, authorized by The Cyber AB), using certified assessors.
The CMMC rule also keeps advice and assessment apart: someone who consulted to prepare your organization cannot take part in your Level 2 certification assessment for three years. If a firm offers to both prepare you and certify you, ask exactly how that fits these rules.
Check that they are legitimate
- Look them up in The Cyber AB's Marketplace and confirm their RPO registration is current.
- Check the people, not just the company: who will actually work on your account, and what CMMC credentials they hold (for example Registered Practitioner, Certified CMMC Professional, or Certified CMMC Assessor).
- Ask for references from companies of your size and type.
Questions to ask before you sign
- Scope of work: what exactly is included? Gap assessment, documentation, implementation, assessment preparation? Get it in writing.
- Deliverables: will you own the System Security Plan and policies they write, in editable form?
- Who does the work: will they implement changes, or tell your IT people what to change?
- Experience: how many companies like yours have they taken through a Level 2 assessment, and how did those go?
- Pricing: fixed fee, hourly, or retainer? What triggers extra charges?
- Their own systems: if they will touch your CUI or your security tools, they become part of your assessment scope. How do they handle that?
- After the assessment: what support, if any, do they offer for the annual affirmations and the three years until reassessment?
Red flags
- Guaranteed certification. No one but a C3PAO can certify you, and no one can guarantee the result.
- Calling themselves "CMMC certified" without saying what that means. Ask which credential, held by whom.
- Pressure to buy a specific product as the only way to comply.
- No written scope, or deliverables you would not own.
- Offering to both prepare and assess you.