CMMC C3PAOs by State: Cyber AB Directory Snapshot
The Cyber AB Marketplace snapshot contains 121 active C3PAO listings in good standing in the selected directory role. The state counts below use each listing’s primary address, not its service area or assessment capacity. This is a dated directory snapshot; verify current authority and availability before choosing an assessment organization.
Key Takeaways
- •The snapshot includes 121 active directory listings marked in good standing.
- •Primary office region is different from supported service geography.
- •Directory listings do not measure assessor headcount or available assessment slots.
- •One observation establishes a baseline, not a historical growth trend.
For implementation support, review vCISO support for government contractors and CMMC certification timing. Confirm scope and operating responsibilities before choosing an engagement.
What does the directory count represent?
Agency retrieved the C3PAO role results from the Cyber AB Marketplace and checked the returned listing records. The analysis includes active records marked in good standing. It counts directory organizations rather than assessors, assessment slots, or completions.
The current CMMC policy must be checked separately. A directory count does not establish a contractor deadline or the assessment required under a particular contract.
How are C3PAOs assigned to a state?
Each retained record uses the region of its primary contact address. Organizations with a non-US primary address are grouped separately. Regions supported by a provider are not substituted for office locations, because doing so would count the same organization repeatedly across states.
Use the accessible table or CSV for the complete regional breakdown. A state’s count does not measure whether providers will travel, work remotely, or have experience with your system.
What can we say about counts over time?
Only a single verified snapshot is available in this repository. It establishes the starting point for quarterly observations; it does not establish a historical growth rate. Download the snapshot history to see the dates actually observed.
Future runs should append a dated snapshot after repeating the complete directory query. Do not reconstruct previous accreditation status from a record’s creation date: creation, authorization, and later status changes are different events.
How should a contractor use this analysis?
Use it to locate possible organizations, then perform the C3PAO diligence process. Verify current listing status, scope, personnel, conflicts, scheduling, and engagement terms directly.
For readiness support, review CMMC services and the CMMC compliance offering. Readiness support and independent assessment have distinct responsibilities.
Dataset findings
| Category | Count |
|---|---|
| VA | 29 |
| MD | 19 |
| FL | 9 |
| GA | 7 |
| TX | 7 |
| TN | 6 |
| NC | 4 |
| OH | 4 |
| PA | 4 |
| CA | 3 |
| NY | 3 |
| CO | 3 |
| AL | 3 |
| MA | 2 |
| MI | 2 |
| AZ | 2 |
| RI | 1 |
| KS | 1 |
| MN | 1 |
| OK | 1 |
| WY | 1 |
| WI | 1 |
| NM | 1 |
| IA | 1 |
| SC | 1 |
| ME | 1 |
| HI | 1 |
| MO | 1 |
| Outside US: TWN | 1 |
| NJ | 1 |
Methodology
- Data source
- Cyber AB Marketplace public directory role TypeID=7, complete paginated result set and listing details.
- Sample size
- n = 121
- Period
- 2026-11-01/2026-11-01
- Inclusion criteria
- Unique listing IDs in the C3PAO role with Active=true and IsActiveAndInGoodStanding=true.
- Exclusion criteria
- Other directory roles, inactive records, and records not marked in good standing. Service regions do not create additional records.
- Calculation
- Verify returned listing count equals directory query total, deduplicate by listing ID, and count by primary contact address region. Non-US addresses remain in a separate country group.
- Limitations
- A directory status snapshot does not measure accreditation history, assessment capacity, or availability. Address location is not service coverage. There are no inferred historical points; future quarterly snapshots are required for a trend.
Frequently Asked Questions
Does the state table measure local assessment capacity?
Why is there no growth-rate claim?
Should I rely on this snapshot to confirm authorization?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
