CMMC Level 1 · DefinitionSEC / DEFC3PAO
Definition
Certified Third-Party Assessment Organization
A CMMC Level 1 term. Also written C3PAO.
Definition
A C3PAO is an accredited organization that conducts third-party CMMC assessments. Third-party assessment applies to Level 2, not Level 1. Level 1 is self-assessed.
A supplier at Level 1 does not hire a C3PAO. You may still bring in a consultant or managed IT provider to help with the self-assessment, and it remains your self-assessment.
Term identity
- Term
- Certified Third-Party Assessment Organization (C3PAO)
- Framework
- CMMC · Level 1
- Authority
- 32 CFR § 170.4