CMMC Level 1 · DefinitionSEC / DEFC3PAO
Definition
CMMC Third-Party Assessment Organization
A CMMC Level 1 term. Also written C3PAO.
Definition
A C3PAO is an organization authorized or accredited by the CMMC Accreditation Body to conduct Level 2 certification assessments (32 CFR 170.4). Third-party assessment applies only where a contract calls for Level 2 (C3PAO), never to Level 1. Level 1 is self-assessed.
A supplier at Level 1 does not hire a C3PAO. You may still bring in a consultant or managed IT provider to help with the self-assessment, and it remains your self-assessment.
Term identity
- Term
- CMMC Third-Party Assessment Organization (C3PAO)
- Framework
- CMMC · Level 1
- Authority
- 32 CFR § 170.4
Related Definitions
Related Questions
Primary Sources
Cite This Page
“CMMC Third-Party Assessment Organization (C3PAO): CMMC Level 1 Definition.” AssessrLog, a product of ProfytAI Pte. Ltd.. https://assessrlog.com/cmmc/definitions/c3pao/