5 Steps to become an RPO

Let’s walk through the step-by-step process for meeting the requirements to become a CMMC Registered Practitioner Organization.

Step 1: Hire a Registered Practitioner

The first requirement for becoming a CMMC RPO is to employ at least one CMMC Registered Practitioner (RP). An RP is an individual who has completed CyberAB-approved training and passed the required exam and background check. They must also agree to abide by the CMMC Code of Professional Conduct. Your RP will be your organization’s credentialed expert, helping you meet and maintain your RPO requirements and status.

Hiring an RP doesn’t necessarily require onboarding a new employee. Many organizations sponsor training for existing team members. However, the RP must be active and listed in the CyberAB system for your organization to be eligible for RPO status.

Step 2: Register with the CyberAB

Next, your organization will need to formally register as an RPO through the CyberAB’s online portal. This process involves:

• completing the RPO application
• submitting organization details
• providing proof of your RP’s status
• paying a $6,000 registration fee, which covers listing in the CyberAB Marketplace and access to official branding

The registration process is designed to verify your organization’s legitimacy and ensure you're prepared to ethically and effectively support OSAs on their CMMC journey.

Step 3: Sign the Code of Professional Conduct

All RPOs must agree to uphold the CyberAB’s Code of Professional Conduct. This code outlines your responsibilities as a consulting organization and establishes standards around confidentiality, ethical behavior, conflicts of interest, and professionalism.

Your RP(s) and your organization as a whole must adhere to this code. Violations can result in disciplinary action, removal from the Marketplace, or revocation of RPO status so it’s crucial to understand and comply with these obligations.

Step 4: Complete identity and background checks

The CyberAB requires identity verification and background checks for all RPs and your organization as a whole. These checks help maintain trust and integrity across the CMMC ecosystem by ensuring only vetted individuals and organizations support defense contractors and subcontractors.

Once complete, your RPO profile is activated in the CyberAB system and visible in the CyberAB Marketplace, allowing organizations seeking assessment to find and engage your services.

Step 5: Maintain active status

Becoming an RPO is not a one-time event. To stay listed in good standing, you’ll need to pay $5,000 to renew your registration annually and keep your RP(s) current on training and other obligations. 

Maintaining active status ensures you’re consistently providing accurate and compliant guidance to clients working toward CMMC certification.

How to choose an RPO for your organization

Choosing the right RPO can provide a streamlined path to compliance, saving you months of confusion and rework. 

Here are a few key factors to consider when evaluating an RPO:

Verify their CMMC experience

Not all RPOs offer the same level of experience. To evaluate this, ask how many clients they’ve helped prepare for CMMC Level 1 or Level 2 assessments and whether they’ve worked with organizations similar to yours in size, industry, or technical environment. Ask them which C3PAO’s audits they’ve helped customers get through. This will help you assess their familiarity with real-world implementation challenges that your organization may face, which is often just as important as their knowledge of the CMMC framework.

Experienced RPOs should be able to walk you through the readiness process, provide sample documentation, and explain what to expect during a C3PAO assessment.

And don’t forget to verify that the RPO is officially listed in the CyberAB marketplace and employs at least one RP.

Check their knowledge of CMMC

Just as with experience, not all RPOs offer the same level of expertise. You want to assess an RPO’s knowledge of DoD requirements, including the DFARS 70 series, FAR 52.204-21, and NIST 800-171 requirements.

For example, say you’re seeking a Level 2 assessment. Because CMMC Level 2 is based almost entirely on NIST SP 800-171 Revision 2, any credible RPO should have deep knowledge of those 110 security requirements. If your RPO doesn’t understand these requirements or how to meet them in a real operational environment, it may lead to incomplete documentation or unaddressed gaps.

Additionally, some RPOs will have more knowledgeable and experienced staff than others. The best RPOs will have more than one RP on staff and even RPAs ready to support their customers.

Understand their service offerings

Based on their experience and expertise, RPOs will offer different services. You want to ensure you select an RPO that can meet your specific needs. 

For example, if you’re preparing for a CMMC Level 2 certification from scratch, ask whether the RPO helps with gap assessments, SSP development, and POA&M tracking. These services are all essential for preparing for a successful Level 2 certification. On the other hand, if you’ve made some progress towards CMMC readiness but are frustrated with your speed or the technical complexity, then you may want an RPO who can manage SSP updates and monitor progress toward remediation milestones.

Ask for references and case studies

Finally, don't hesitate to ask for success stories or referrals. A reputable RPO should be able to share case studies or connect you with satisfied customers who can speak to the effectiveness of their support and C3PAO audits that the customers have gone through.

Direct feedback from peers can offer valuable insight into what it’s really like to work with a particular RPO, especially in terms of responsiveness, technical depth, and overall value.

RPO vs C3PAO: What’s the difference between these organizations in the CMMC ecosystem?

There are many roles in the CMMC ecosystem, including CMMC consulting organizations (RPOs) and assessment organizations known as Certified Third-Party Assessment Organizations (C3PAOs). It’s important to understand the difference between an RPO and a C3PAO so you can find and select the right partner at the right time in your CMMC compliance journey.

An RPO acts as an advisory firm or Managed Service Provider (MSP) to help prepare defense contractors for implementing CMMC requirements and eventually undergoing a CMMC assessment, whereas a C3PAO is an organization that actually performs the assessment. 

Many OSAs work with both an RPO and C3PAO. The RPO helps them prepare for the assessment conducted by a C3PAO.

While an RPO and C3PAO can employ individuals holding multiple designations, i.e. RP/RPA and assessor certifications, these individuals cannot assess a company if they have previously assisted with CMMC implementation for that same company in their role as RP/RPA.

Here’s a quick breakdown of the different roles and responsibilities of an RPO and C3PAO in the CyberAB ecosystem: