Third-Party Assessment

A third-party assessment is an independent evaluation of your cybersecurity practices conducted by a C3PAO — an organization authorized by the CyberAB to perform CMMC assessments. The C3PAO sends trained assessors to review your documentation, interview your team, and verify that your security controls are properly implemented and effective.

This is required for CMMC Level 2 when the contract involves prioritized CUI, and for all Level 3 assessments (conducted by DIBCAC). The assessment results in a formal certification that is valid for three years, after which you must be reassessed.