Roles in the CMMC ecosystem

The ecosystem separates the organisations being assessed from the organisations that assess them, and separates both from the bodies that certify the people doing the assessing. An Organization Seeking Certification (OSC) is the contractor under assessment. A CMMC Third-Party Assessment Organization (C3PAO) conducts certification assessments. Registered Provider Organizations (RPO) and Registered Practitioners (RP) advise and consult but do not assess. The CMMC Assessors and Instructors Certification Organization (CAICO) certifies the assessors and instructors themselves.

The separation is the point: an organisation that helped an OSC implement its controls cannot also certify that the implementation is adequate.

Recall

The terms and figures from this lesson, one at a time.

Card 1 of 6Level 1 of 5

What does OSC stand for, and who is it?

This deck does not remember you yet. Spaced repetition arrives with accounts.

Check yourself

1. A contractor engages a firm to help remediate gaps ahead of a CMMC Level 2 certification assessment. Which role does that firm hold, and what does it prevent?

A Registered Provider Organization, which may not then conduct the certification assessmentA C3PAO, which may conduct the assessment because it already knows the environmentThe CAICO, which certifies the contractor directly once remediation is completeA Licensed Partner Publisher, which may assess if its practitioners hold CCP

By QualExam editorial. Written against the awarding body’s published blueprint and checked against it on every build.

Source: ISACA CCA/CCP Exam Candidate Guide

Last checked against the source: 2026-09-22