Original data
Where the CMMC assessors actually are
We captured the complete authorized-C3PAO listing from the Cyber-AB CMMC Marketplace on July 27, 2026 and mapped every firm to its headquarters state. The result is not evenly spread: 40 of 110 assessor organizations are headquartered in Virginia or Maryland, while 22 states have none at all.
Authorization status changes — firms are added, and authorizations lapse or are withdrawn — so this is a dated snapshot, not a live feed. Check current status on the Cyber-AB Marketplace before acting on anything here.
Every number on this page carries one of three labels.
Primary— read straight off the source registry. Derived— our arithmetic on those rows: tallies, shares and rollups. Reported— a figure our records note as reported elsewhere without an attributable publisher. There is no fourth category, and nothing on this page is an estimate.
Authorized C3PAOs, nationwide
Primary110
Complete result set for the authorized cohort; pre-authorized candidates excluded.
Source: Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
Headquartered in Virginia or Maryland
Derived40 of 110 (36%)
More than a third of the national assessor population sits in two adjacent states.
Source: Derived from the Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
States with no C3PAO headquartered in them
Derived22
Counted against all 50 states. Headquarters is not service area — see the limitations.
Source: Derived from the Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
Headquartered in California
Derived2
Fewer than Tennessee, Georgia or Alabama; the same as Massachusetts and Michigan.
Source: Derived from the Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
Authorized C3PAOs by headquarters state
All fifty states, including the ones with none. Find yours.
| State | Census region | C3PAOs | Share of cohort |
|---|---|---|---|
| Virginia VA | South | 25 | 23% |
| Maryland MD | South | 15 | 14% |
| Florida FL | South | 9 | 8% |
| Georgia GA | South | 8 | 7% |
| Texas TX | South | 7 | 6% |
| Tennessee TN | South | 6 | 5% |
| North Carolina NC | South | 4 | 4% |
| Ohio OH | Midwest | 4 | 4% |
| Pennsylvania PA | Northeast | 4 | 4% |
| Alabama AL | South | 3 | 3% |
| Colorado CO | West | 3 | 3% |
| New York NY | Northeast | 3 | 3% |
| California CA | West | 2 | 2% |
| Massachusetts MA | Northeast | 2 | 2% |
| Michigan MI | Midwest | 2 | 2% |
| Arizona AZ | West | 1 | 1% |
| Hawaii HI | West | 1 | 1% |
| Iowa IA | Midwest | 1 | 1% |
| Kansas KS | Midwest | 1 | 1% |
| Maine ME | Northeast | 1 | 1% |
| Minnesota MN | Midwest | 1 | 1% |
| Missouri MO | Midwest | 1 | 1% |
| New Jersey NJ | Northeast | 1 | 1% |
| New Mexico NM | West | 1 | 1% |
| Oklahoma OK | South | 1 | 1% |
| Rhode Island RI | Northeast | 1 | 1% |
| South Carolina SC | South | 1 | 1% |
| Wisconsin WI | Midwest | 1 | 1% |
| Alaska AK | West | 0 | 0% |
| Arkansas AR | South | 0 | 0% |
| Connecticut CT | Northeast | 0 | 0% |
| Delaware DE | South | 0 | 0% |
| Idaho ID | West | 0 | 0% |
| Illinois IL | Midwest | 0 | 0% |
| Indiana IN | Midwest | 0 | 0% |
| Kentucky KY | South | 0 | 0% |
| Louisiana LA | South | 0 | 0% |
| Mississippi MS | South | 0 | 0% |
| Montana MT | West | 0 | 0% |
| Nebraska NE | Midwest | 0 | 0% |
| Nevada NV | West | 0 | 0% |
| New Hampshire NH | Northeast | 0 | 0% |
| North Dakota ND | Midwest | 0 | 0% |
| Oregon OR | West | 0 | 0% |
| South Dakota SD | Midwest | 0 | 0% |
| Utah UT | West | 0 | 0% |
| Vermont VT | Northeast | 0 | 0% |
| Washington WA | West | 0 | 0% |
| West Virginia WV | South | 0 | 0% |
| Wyoming WY | West | 0 | 0% |
Showing 50 of 50 states · 110 authorized C3PAOs in total
Source: Derived from the Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27. Shares are rounded to whole percentages and therefore do not sum to exactly one hundred.
The concentration is regional, not just local
Grouping the same rows by U.S. Census Bureau region — a published federal standard, so the grouping is not one we invented to make a point — shows the imbalance is structural rather than a quirk of two states.
| Census region | C3PAOs | Share | States represented |
|---|---|---|---|
| South | 79 | 72% | 10 |
| Northeast | 12 | 11% | 6 |
| Midwest | 11 | 10% | 7 |
| West | 8 | 7% | 5 |
Source: Derived from the Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27, grouped by U.S. Census Bureau, Census Regions and Divisions of the United States (grouping standard only)
The coverage gaps
No headquartered C3PAO
Derived22 states
Alaska, Arkansas, Connecticut, Delaware, Idaho, Illinois, Indiana, Kentucky, Louisiana, Mississippi, Montana, North Dakota, Nebraska, New Hampshire, Nevada, Oregon, South Dakota, Utah, Vermont, Washington, West Virginia, Wyoming.
Source: Derived from the Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
Exactly one
Derived13 states
Arizona, Hawaii, Iowa, Kansas, Maine, Minnesota, Missouri, New Jersey, New Mexico, Oklahoma, Rhode Island, South Carolina, Wisconsin.
Source: Derived from the Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
Cities with three or more assessor headquarters
Derived- Tampa, FL 6
- Atlanta, GA 5
- McLean, VA 4
- Herndon, VA 3
- Huntsville, AL 3
- Reston, VA 3
Source: Derived from the Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
How the authorized population has moved
Only the last figure below is our own capture. The three earlier counts are recorded in our notes without an attributable publisher, so they are labelled Reported and shown for direction only. We do not treat this as a measured trend, and neither should you.
| Period | Authorized C3PAOs | Provenance |
|---|---|---|
| Feb 2026 | 98 | ReportedReported count recorded in our capture record; no publisher attributed — treat as indicative only |
| Mar 2026 | 103 | ReportedReported count recorded in our capture record; no publisher attributed — treat as indicative only |
| Jun 2026 | 107 | ReportedReported count recorded in our capture record; no publisher attributed — treat as indicative only |
| Jul 2026 | 110 | PrimaryCyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27 |
What this means if you are not on the beltway
Read this before you draw a conclusion. Headquarters is not service area. This dataset measures where assessor organizations are based — a real signal about the industry’s centre of gravity — but it records nothing about where they work. A state’s count is not the number of assessors available to you, in either direction, and it says nothing about who will travel to you, how soon, or at what price. Our capture recorded organization name and location and nothing else — no pricing, no travel policy, no assessor headcount — so this page quotes none of those things.
With that stated, the geography still changes how you plan. If your facility sits in one of the 22 states with no headquartered C3PAO, every firm on the authorized list is an out-of-state firm to you, and travel becomes something you negotiate rather than assume. Budget conversations about assessment cost that ignore it are budgeting for the beltway.
The 13single-assessor states carry a subtler problem. One local option is not a market. It becomes zero the moment that firm’s calendar fills — or the moment the conflict-of-interest rule applies: the rule bars CMMC ecosystem members from assessing an organization they consulted for within the previous 3 years, so certification assessment and readiness work must be bought from different firms.
Source: CMMC Final Rule, 89 FR 83221 (32 CFR 170.8(b)(17)(ii)(G))
That rule is why concentration compounds. Your readiness partner and your assessor must be different firms, so the practical question is not “is there a C3PAO near me” but “is there a C3PAO near me that I have not already worked with.” In a state with one, the answer is often no.
The other half of capacity: who helps you prepare
The conflict-of-interest rule means the firm that certifies you cannot be the firm that got you ready, so assessor supply is only half the question. One federal channel on the preparation side is the NIST Manufacturing Extension Partnership: MEP Centers "are also equipped to help you meet the Defense Federal Acquisition Regulation Supplement cybersecurity requirements for manufacturers." We checked NIST’s own directory on the same date.
Source: NIST MEP Cybersecurity Services, nist.gov/mep/cybersecurity-services (quoted as published; MEP directory captured 2026-07-27)
NIST MEP centers listed
Primary48
Source: NIST MEP center directory (quick list, centers index and interactive map), nist.gov/mep/centers, captured 2026-07-27
MEP centers publishing a cybersecurity or CMMC page
Derived16 of 48
Homepage link discovery on the capture date. A blank means not found from the homepage, not absent.
Source: Derived from the NIST MEP center directory (quick list, centers index and interactive map), nist.gov/mep/centers, captured 2026-07-27
Not listed in NIST’s MEP directory
PrimaryCalifornia, Ohio
Neither state appeared on NIST’s quick list, its centers index, or its rendered interactive map on July 27, 2026. This records what the federal directory listed on one date. It is not a claim that manufacturing-extension services are unavailable in either state, and it is not a statement about any particular organization’s status — if you need the current position, ask NIST.
Source: NIST MEP center directory (quick list, centers index and interactive map), nist.gov/mep/centers, captured 2026-07-27
Read the two datasets together and the picture for a manufacturer outside the DC corridor sharpens: fewer assessor organizations nearby, and in some states no listed federal preparation channel either. That is the gap this firm was built to sit in.
Method, sources and limitations
Capture. The authorized-C3PAO listing was read from the public Cyber-AB CMMC Marketplace catalog page with the Ecosystem Role facet set to C3PAO, on July 27, 2026— the CMMC accreditation body’s own public catalog of ecosystem members. The capture is the complete result set for that facet; firms carrying the separate “Pre-Authorized C3PAO” label are excluded, so this is the authorized cohort and not candidates.
What we publish, and what we do not. The capture includes firm names, addresses and websites. This page deliberately publishes headquarters geography and aggregate counts only, plus the two-firm California cohort where the names are the finding. It is a capacity analysis, not a republished directory, and it carries no contact details for any firm. Use the marketplace to reach an assessor.
Preparation-side data. MEP figures come from NIST’s center directory, cross-checked against its centers index and interactive map on the same date. The count of centers publishing cybersecurity or CMMC material was produced by fetching each center’s homepage and following on-domain links whose URL or label matched CMMC, cybersecurity, 800-171 or defense. A center not counted has not been shown to lack a cybersecurity practice — only that no such page was reachable from its homepage that day.
Headquarters is not service area. This dataset shows where assessor organisations are based; it records nothing about where they work. A state’s count is therefore not the number of assessors available to you, in either direction, and it says nothing about who will travel to your facility or what that will cost.
Source: Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
Authorization status changes. Firms gain authorization and authorizations lapse or are withdrawn. Everything here is a single capture dated July 27, 2026 — verify current status on the marketplace before relying on it.
Source: Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
A count of firms is not a count of assessment capacity. Our capture recorded no assessor headcount, throughput or backlog, so this dataset cannot tell you how many assessments the population can actually deliver in a year, and we do not estimate it.
Source: Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
Only the July 2026 figure in the growth series is our own primary capture. The three earlier counts are marked reported: our capture record notes them without attributing a publisher, so they show direction, not verified levels.
Source: Internal capture record, 2026-07-27
The MEP finding records which states NIST's directory listed on July 27, 2026. It is not a claim that manufacturing-extension services are unavailable in a state, nor a statement about any particular organisation's status.
Source: NIST MEP center directory (quick list, centers index and interactive map), nist.gov/mep/centers, captured 2026-07-27
Primary sources
- Cyber-AB CMMC Marketplace — Cyber-AB CMMC Marketplace (Ecosystem Role = C3PAO), cyberab.org/Catalog, captured 2026-07-27
- NIST MEP center directory — NIST MEP center directory (quick list, centers index and interactive map), nist.gov/mep/centers, captured 2026-07-27
Reusing these figures? Please cite this page and the underlying registries, and carry the capture date — July 27, 2026— with them. The counts will change.
Questions this data answers
- How many authorized C3PAOs are there?
- 110 organizations were listed as authorized C3PAOs on the Cyber-AB CMMC Marketplace when we captured it on July 27, 2026. That is the complete authorized cohort on that date; firms carrying the separate "Pre-Authorized C3PAO" label are excluded. Authorization status changes, so verify current status on the marketplace before relying on any count.
- Where are CMMC C3PAOs located?
- They are concentrated around Washington DC. 40 of the 110 authorized C3PAOs — 36% — are headquartered in Virginia or Maryland alone, and 79 (72%) are in the Census South region. Only 28 states have any C3PAO headquartered in them at all. These are counts of headquarters locations, not service areas — the capture records where assessor organizations are based, not where they work.
- Are there any C3PAOs in California?
- Two, as of July 27, 2026: 123 Efficient CMMC and KNC Strategic Services. California has fewer authorized C3PAOs than Tennessee, Georgia or Alabama, and the same number as Massachusetts and Michigan. This counts headquarters, not service area, so it is not a count of the assessors available in California.
- Which states have no C3PAO?
- 22 states had no authorized C3PAO headquartered in them on July 27, 2026: Alaska, Arkansas, Connecticut, Delaware, Idaho, Illinois, Indiana, Kentucky, Louisiana, Mississippi, Montana, North Dakota, Nebraska, New Hampshire, Nevada, Oregon, South Dakota, Utah, Vermont, Washington, West Virginia, Wyoming. A further 13 states had exactly one. Again, headquarters is not service area: this counts where assessor organizations are based, not where they work, so a zero is not a statement that no assessor will come to you.
- Is the number of C3PAOs growing?
- Our own capture found 110 authorized C3PAOs on July 27, 2026. Earlier counts in our records, going back to Feb 2026, suggest the population has been rising, but we cannot attribute those earlier figures to a named publisher, so we present them as reported rather than verified and do not treat the trend as measured.
Turn this gap analysis into a remediation plan
This C3PAO capacity map is the start, not the answer. Book a 25-minute compliance assessment — you leave with a prioritized roadmap and a fixed-fee implementation quote.
Book a 25-min assessment