theagentindex.io/guides/cmmc-c3pao-list/ · Last reviewed 25 Oct 2026
Free guide · CMMC · C3PAO · 25 Oct 2026
CMMC C3PAOs: how to check an assessment organization and shortlist one
The Cyber AB authorizes CMMC Third-Party Assessment Organizations (C3PAOs). This page quotes those requirements, how to check a name on the Marketplace, and how the 75 CMMC firms in this directory break down by US state. Not a ranking.
What the Cyber AB requires
C3PAO requirements include “Pass an Experian financial review conducted by The Cyber AB, FOCI review conducted by DCSA, and CMMC Level 2 Assessment conducted by DCMA DIBCAC.” [1]
For programme status and phase dates, see the CMMC hub rather than restating them here.
Open the official pages: Cyber AB Assessing and Certification roles · Cyber AB Marketplace.
How to verify a C3PAO
- Search the Cyber AB Marketplace for the exact legal entity.
- Confirm the listing is a C3PAO (assessment organization), not another ecosystem role.
- Each firm page on Agent Index shows the date we last checked that Marketplace row.
Related: CMMC hub · agents tagged CMMC · FedRAMP 3PAOs · GovRAMP 3PAOs.
What this directory lists
Agent Index lists 75 organisations whose frameworks field contains “CMMC”. Counts below are computed at build from that field. Listings are verified against the Cyber AB Marketplace on each firm’s checked date. [3]
CMMC C3PAOs in the United States (75 firms with a US office).
Related: auditors directory · FedRAMP 3PAOs · PCI DSS QSA companies · Get matched.
States
Office counts below are computed at build from CMMC-tagged listings. A state page exists only where at least three Verified firms match both the framework and an office there. Not a ranking.
- Virginia — 30 firms (US office)
- Florida — 19 firms (US office)
- Texas — 17 firms (US office)
- Pennsylvania — 16 firms (US office)
- Maryland — 14 firms (US office)
- North Carolina — 11 firms (US office)
- California — 10 firms (US office)
- Georgia — 7 firms (US office)
- Missouri — 7 firms (US office)
- Ohio — 7 firms (US office)
- Colorado — 6 firms (US office)
- Illinois — 6 firms (US office)
- Massachusetts — 6 firms (US office)
- South Carolina — 6 firms (US office)
- Tennessee — 6 firms (US office)
- Alabama — 5 firms (US office)
- Indiana — 5 firms (US office)
- Arizona — 4 firms (US office)
- Kentucky — 4 firms (US office)
- New York — 4 firms (US office)
- Oklahoma — 4 firms (US office)
- Arkansas — 3 firms (US office)
- Washington — 3 firms (US office)
- Iowa — 2 firms (US office)
- Minnesota — 2 firms (US office)
- Nebraska — 2 firms (US office)
- New Jersey — 2 firms (US office)
- Wisconsin — 2 firms (US office)
- District of Columbia — 1 firm (US office)
- Delaware — 1 firm (US office)
- Hawaii — 1 firm (US office)
- Kansas — 1 firm (US office)
- Louisiana — 1 firm (US office)
- Maine — 1 firm (US office)
- Mississippi — 1 firm (US office)
- Rhode Island — 1 firm (US office)
- Utah — 1 firm (US office)
- West Virginia — 1 firm (US office)
- Wyoming — 1 firm (US office)
Firms in this directory
- A-LIGN — Tampa, FL · checked
- Anthony Timbers — Fredericksburg, VA · checked
- Aprio — Atlanta, GA · checked
- ArCybr — Aberdeen, MD · checked
- Auditwerx — Tampa, FL · checked
- August Schell — Rockville, MD · checked
- Blue Mantle Technology — Sterling, VA · checked
- Booz Allen Hamilton — McLean, VA · checked
- Boston Government Services — Oak Ridge, TN · checked
- C.H. Guernsey & Company — Oklahoma City, OK · checked
- Cherry Bekaert — Raleigh, NC · checked
- CISEVE — Burlington, MA · checked
- Coalfire — Chicago, IL · checked
- CohnReznick — Tysons, VA · checked
- Concordant — Laramie, WY · checked
- ControlCase — Fairfax, VA · checked
- CyberRx — Silver Spring, MD · checked
- Cybersec Investments — Melbourne, FL · checked
- Databrackets — Cary, NC · checked
- DataSoftNow — Melville, NY · checked
- Digital Beachhead — Colorado Springs, CO · checked
- ecfirst — Waukee, IA · checked
- Edwards Performance Solutions — Columbia, MD · checked
- Emagine IT — North Bethesda, MD · checked
- First Information Technology Services (FITS) — Arlington, VA · checked
- Fortreum — Lansdowne, VA · checked
- Forvis Mazars — Charlotte, NC · checked
- Gray Analytics — Huntsville, AL · checked
- H2L Solutions — Huntsville, AL · checked
- Hive Systems Defense Solutions — Richmond, VA · checked
- I.S. Partners — Dresher, PA · checked
- IBSS Corp — Silver Spring, MD · checked
- Ignyte Assurance — Centerville, OH · checked
- Insight Assurance — Tampa, FL · checked
- Kieri Solutions — Woodbine, MD · checked
- Kimmell Cybersecurity (KCFS) — Akron, OH · checked
- KLC Consulting — Framingham, MA · checked
- KNC Strategic Services — Carlsbad, CA · checked
- Kompleye — Reston, VA · checked
- Kratos — Herndon, VA · checked
- KTL Solutions — Frederick, MD · checked
- Lazarus Alliance — Scottsdale, AZ · checked
- Life Cycle Engineering — Charleston, SC · checked
- Linford & Company — Denver, CO · checked
- Lunarline — Ashburn, VA · checked
- MAD Security — Huntsville, AL · checked
- ManageIT Security — Arlington, VA · checked
- McKonly & Asbury — Camp Hill, PA · checked
- Meerkat Cyber — McLean, VA · checked
- MNS Group — Belcamp, MD · checked
- Monarch Information Security Consulting — Portland, ME · checked
- OSC Edge — Atlanta, GA · checked
- Paragon Cyber Solutions — Tampa, FL · checked
- Peak InfoSec — Tampa, FL · checked
- Penacity — Hanover, MD · checked
- Prescient Security — Nashville, TN · checked
- Referentia Systems — Honolulu, HI · checked
- REI Systems — Sterling, VA · checked
- Resilient IT — Springfield, VA · checked
- RSI Security — Southlake, TX · checked
- Schellman — Tampa, FL · checked
- Schneider Downs — Pittsburgh, PA · checked
- Securesoft Technologies — Greenbelt, MD · checked
- SecureStrux — Lancaster, PA · checked
- Sentar — Huntsville, AL · checked
- Sentinel Blue — Warrenton, VA · checked
- Sera Brynn — Plano, TX · checked
- Shellproof — Greenvale, NY · checked
- Smithers Quality Assessments — Fairlawn, OH · checked
- Specialized Security Services (S3) — Plano, TX · checked
- Systems Service Enterprises (SSE) — St. Louis, MO · checked
- TES Consultants — McLean, VA · checked
- Tevora — Irvine, CA · checked
- Vaultes — McLean, VA · checked
- Wise Technical Innovations — Norfolk, VA · checked
Get matched
If you want a shortlist of listed firms for CMMC or another published framework, use Get matched or the form below. We store the request for review; we do not email firms automatically.
Request received
Reference:
We'll review your request; no automatic emails. Introductions start later. Nothing was sent to any firm.
FAQ
What is a C3PAO?
A CMMC Third-Party Assessment Organization (C3PAO) is an organization authorized by The Cyber AB to perform CMMC assessments. Listings on Agent Index are verified against the Cyber AB Marketplace on each firm’s checked date.
How do I verify a C3PAO?
Check the Cyber AB Marketplace for the exact legal entity. C3PAO requirements include “Pass an Experian financial review conducted by The Cyber AB, FOCI review conducted by DCSA, and CMMC Level 2 Assessment conducted by DCMA DIBCAC.” https://cyberab.org/CMMC-Ecosystem/Ecosystem-roles/Assessing-and-Certification
How many C3PAOs are listed?
75 Verified C3PAOs are in this directory, by US state (office counts): Virginia 30, Florida 19, Texas 17, Pennsylvania 16, Maryland 14, North Carolina 11, California 10, Georgia 7, Missouri 7, Ohio 7, Colorado 6, Illinois 6, Massachusetts 6, South Carolina 6, Tennessee 6, Alabama 5, Indiana 5, Arizona 4, Kentucky 4, New York 4, Oklahoma 4, Arkansas 3, Washington 3, Iowa 2, Minnesota 2, Nebraska 2, New Jersey 2, Wisconsin 2, District of Columbia 1, Delaware 1, Hawaii 1, Kansas 1, Louisiana 1, Maine 1, Mississippi 1, Rhode Island 1, Utah 1, West Virginia 1, Wyoming 1.
Saved
Reference:
We'll email you when a matching listing is added; no other automatic emails. Nothing is sent automatically now.
Get updates by email
Subscribe to the Brief
Weekly, free, unsubscribe anytime.
Check your inbox to confirm your email. We’ll only send the weekly brief after you click the link.
We use your email only to send the newsletter. See our privacy policy.
Sources
- The Cyber AB, Assessing and Certification roles, checked 25 Oct 2026. https://cyberab.org/CMMC-Ecosystem/Ecosystem-roles/Assessing-and-Certification
- Cyber AB Marketplace. https://cyberab.org/Catalog
- Agent Index auditors dataset v0.1.32, generated 2026-10-27. https://theagentindex.io/auditors.json
Prepared by Agent Index (Heritage Services). Last reviewed 25 Oct 2026. General information, not legal advice. Confirm scope with your counsel or auditor. Licensed CC BY 4.0.