A C3PAO — a CMMC Third-Party Assessment Organization — is accredited to perform certification assessments. They examine your System Security Plan, interview your people, and test evidence against the 110 requirements. They are the only ones who can certify. Readiness firms, including this one, prepare you for that assessment; we do not perform it and cannot grant it.
When you need one
When the contract says so. Level 2 requirements are met either by self-assessment or by a C3PAO certification assessment, depending on what the contract specifies and how sensitive the information is. The November 10, 2026 date on which third-party certification was to become the default for CUI contracts was suspended by DoD on July 13, 2026, pending a 60-day Reform Task Force review. Until that review reports, no new solicitation can require a C3PAO assessment; the self-assessment, the SPRS score, and the annual affirmation remain required.
If third-party assessment returns in some form, the practical problem will not be the date. It will be the queue: a limited population of accredited assessors and a very large population of suppliers discovering the requirement in the same quarter. Preparation done now is the only thing that shortens your place in it.
What it costs
Publicly quoted figures for small suppliers with a clean, narrow scope commonly run in the tens of thousands of dollars for the assessment alone, rising sharply with the number of in-scope systems, sites, and enclaves. Treat any single number you read — including that one — as a range that only your scope resolves. Get quotes from more than one C3PAO.
- Scope is the price lever: every additional system, site, and cloud service inside the boundary adds examination time.
- Remediation is usually the larger cost, and it lands before the assessment, not after.
- A failed assessment costs twice — the re-assessment, and the contract months you spend waiting for it.
The cheapest lever available to a small shop is a smaller boundary. Moving CUI into one controlled enclave, rather than letting it sit anywhere the estimator saved it, can change the assessment's size before you have spent a dollar on tooling.
The sequencing that saves money
Score yourself honestly, define and shrink the boundary, close the gaps that are cheap to close, write the SSP and POA&M, then book the assessor. Booking first and preparing second is how shops end up paying for an assessment that tells them what a free calculator would have.