C3PAO and 3PAO: What is The Difference Between Them?

When you’re looking into government cybersecurity certifications, like FedRAMP and CMMC, you’re going to see two acronyms everywhere you turn. These two acronyms are almost identical: 3PAO and C3PAO. With just one letter dividing them, what’s the difference?

What is a 3PAO?

A 3PAO is a Third-Party Assessment Organization.

3PAOs work within the ecosystem of FedRAMP. FedRAMP is the Federal Risk and Authorization Management Program and is a government-wide standard used for general security across different departments and sectors.

Specifically, FedRAMP applies not as much to the departments themselves as it does to the products that those departments might want to use. Specifically, FedRAMP is a security framework for authorizing cloud services to work within the government ecosystem. It’s a three-segment approach to security, beginning with an assessment and authorization, continuing with a security assessment and audit, and maintaining continuous monitoring on an ongoing basis.

The goal of FedRAMP is to ensure that any third-party cloud service that the government uses is secure. This can range from ERPs and security suites to productivity apps, document signing and analytics apps, and much more. As of this writing, there are 499 products authorized to operate at various impact levels within the FedRAMP framework.

Each and every one of these cloud services needs to be evaluated for their security by someone the government can trust. Those evaluations are audits handled by third-party assessment organizations.

In order to be a 3PAO for FedRAMP, the government needs to approve an assessment organization. To do this, they have an accreditation organization called A2LA, or the American Association for Laboratory Accreditation. This organization works across a huge array of different accreditation programs, not just FedRAMP, and operates in more than 50 countries.

A2LA’s FedRAMP 3PAO certification program requires a lot of prerequisites to be met. The assessment organization needs to adhere to requirements in ISO 17020, ILAC P15, R311, and FedRAMP-specific requirements. They also must have spent at least a year in the Cybersecurity Inspection Body Program to demonstrate appropriate levels of technical competence.

Once an organization has met all of the requirements, it can pursue accreditation as a FedRAMP 3PAO. We know this process very well – Ignyte is a FedRAMP 3PAO – so if you have any specific questions, feel free to reach out and ask.

Currently, there are 45 total assessment organizations in the FedRAMP marketplace. Any cloud service provider seeking FedRAMP authorization will need to be audited by one of these 3PAOs; anyone not listed on the marketplace is not a valid auditor.

Some 3PAOs are more popular than others. The most popular 3PAO assesses 137 different CSPs in the marketplace, while sixteen different 3PAOs do not currently assess any CSPs.

What is a C3PAO?

A C3PAO is a Certified Third-Party Assessment Organization.

Despite the extreme similarity in name, C3PAOs and 3PAOs are actually very different. They serve similar roles but with entirely different knowledge bases and different arrays of skills, requirements, and processes.

The primary difference is not actually in the term “certified.” 3PAOs are FedRAMP-certified and accredited, after all. No, the actual difference is that C3PAOs are not part of the FedRAMP ecosystem but instead are part of the CMMC ecosystem.

CMMC is the Cybersecurity Maturity Model Certification. CMMC is both broader and narrower than FedRAMP, depending on the angle you’re looking at. Specifically, it’s broader in that it encompasses more of cybersecurity and more security in general for more organizations. Rather than applying solely to cloud service providers, it applies to any business that operates as part of the defense industrial base or defense supply chain, regardless of whether or not their services are cloud-based.

CMMC is, in some ways, narrower than FedRAMP at the same time. For one thing, it only applies to businesses that handle certain types of information, like controlled unclassified information and covered defense information. (More tightly controlled information, like classified or secret information, has other frameworks to govern it.) Additionally, while FedRAMP applies to all departments and portions of the federal government (and a similar StateRAMP set of programs does the same for state-level services), CMMC applies only to the Department of Defense and its contractors in a trickle-down fashion.

Unlike FedRAMP, CMMC C3PAOs are managed by the CyberAB, an organization with an exclusive contract with the Department of Defense and a sole mission to evaluate and authorize C3PAOs for the DoD’s ecosystem.

In order to become a C3PAO, an assessment organization must follow a rigorous process. They must pass a risk assessment, pass a Foreign Ownership, Control, or Influence analysis, pass interviews with senior management, and more. Once they’ve passed the basic filtering and screening, they will need to be assessed by DIBCAC, pass assessments from the program management office, and achieve certification. They must also obtain and maintain insurance, proof of a dispute resolution process, and meet other requirements.

One interesting aspect of the CMMC C3PAO process is that, since CMMC is only just coming into full enforcement this year, there are relatively few C3PAOs, and the official C3PAO process is relatively new. The current slate of C3PAOs includes just 57 organizations.

While this might seem like a robust list, especially considering that the equivalent FedRAMP list is shorter, remember that this list of assessment organizations has an immense amount of work to do in auditing the CMMC compliance for hundreds of businesses making up the defense supply chain and a relatively short amount of time in which to do it. They will be very busy.

What’s the Biggest Difference Between 3PAOs and C3PAOs?

As you can see from the above, the biggest difference between the two kinds of assessment organizations is the overall program they work with. 3PAOs work within the FedRAMP ecosystem, while C3PAOs work within the CMMC ecosystem.

While the process of becoming an assessment organization differs, and the specifics of the audits and processes vary, the two are actually quite similar. This is because both FedRAMP and CMMC are based largely on the same groups of security controls. They group them differently, name them differently, and audit them differently, but if a company can certify with one, they are 80% of the way towards compliance with the other, broadly speaking.

Both kinds of assessment organizations are relatively rare, with barely over 100 companies making up both groups.

One of the biggest issues when researching and reading about US government cybersecurity and security frameworks is the use of these two terms, which are often used almost interchangeably. Since both kinds of organizations are broadly similar, but their purposes are very different, many people find that using the specific, accurate terminology falls by the wayside. Referring to C3PAOs as 3PAOs is not uncommon.

The fact is, the C isn’t really a meaningful part of the name, but it serves as a shorthand way to remember that C3PAOs work with CMMC. That wasn’t really the intent, but it works.

It’s important to keep in mind that inaccuracy in terminology can be a stumbling block. However, this is largely alleviated by the two marketplaces. FedRAMP’s marketplace lists accredited 3PAOs to make it easy to pick one to work with. Similarly, Cyber AB’s marketplace lists validated C3PAOs, again to make it easy to find ones to work with. This way, you don’t have to worry about inaccurate terminology and can use assessment organizations you know will serve the purpose you need.

Do You Need a 3PAO or C3PAO?

The answer to this question depends entirely on your business, your role within the government, and your goals for the future.

If your company is a cloud services provider, you may want to pursue FedRAMP authority to operate so that you can win government contracts and work with various governmental departments and organizations as part of the overall federal ecosystem.

If your company is not a cloud service provider, you don’t need to worry about FedRAMP. Instead, there are generally other kinds of security frameworks you will need to concern yourself with, such as FISMA. FedRAMP is exclusively for cloud services that work with the federal government and handle non-classified information.

If your company is part of the defense industrial base as a prime contractor or as a subcontractor, whether or not you need CMMC will depend on the company or department you work for and whether or not you handle controlled information. All prime contractors that handle controlled information will need to obtain CMMC certification by the coming deadline.

All defense subcontractors will also need CMMC! A common misconception is that if your company does not handle controlled information, you won’t need CMMC. However, the final rule for CMMC is that any subcontractor as part of the supply chain will need at least CMMC level 1, regardless of the information they handle. The only exception is subcontractors who supply solely COTS (Commercial Off The Shelf) products. In these cases, the producer of those products will likely need to comply instead.

So, to summarize:

• If you need or intend to achieve FedRAMP authority to operate, you will need to work with a 3PAO.
• If you need or intend to achieve CMMC certification, you will need to work with a C3PAO.
• If you do not work with or intend to work with any part of the government, you will not need either.

Additionally, you may be able to work with parts of the government that are not the Department of Defense or its supply chain and not need either, but you may still need to work with a different kind of auditor for different security frameworks like FISMA. Alternatively, you may need to comply with non-governmental security frameworks like HIPAA.

Should You Become a 3PAO or C3PAO?

Next, a question for the auditors and assessment organizations out there.

Should you become either a 3PAO or C3PAO?

The answer also depends on what your goals are. Both of these organizations work closely with the United States Federal Government and, as such, have strong and strict requirements for the kinds of leadership and internal security they require.

It can be very rewarding – not to mention potentially lucrative – to become one of the relatively exclusive clubs of organizations providing these assessments. However, the requirements to become either one of these kinds of assessors are quite high. The process can be time-consuming and expensive to achieve as well, and you have to hold yourself to as high a standard as you hold your clients, if not higher.

Are There Alternatives to 3PAOs and C3PAOs?

Yes and no.

For FedRAMP, an organization is able to achieve its authority to operate in three ways. The first is to work with a 3PAO that has been authorized in the FedRAMP marketplace. The second is to work directly with the joint assessment board and achieve a P-ATO instead. The third is to work with an independent, non-marketplace assessment organization.

This is possible, though not super common, because it requires that the assessment organization adhere to FedRAMP-specific requirements. The organization must submit an attestation of independence and impartiality, and the results of their assessment must adhere to FedRAMP requirements and use FedRAMP templates.

What this means, in general, is that most companies working to achieve and maintain FedRAMP are going to work with one of the existing 3PAOs, and while some other assessment organizations may provide their services as well, they aren’t quite as common. After all, if you’re already prepared to offer FedRAMP auditing services, why not take that additional step and become a 3PAO?

For CMMC, there is no alternative. Every organization that wants to achieve CMMC certification will need to pass the audit by a C3PAO by the deadline. Since CMMC has only just been instituted in the final rule, demand is skyrocketing for these organizations, so everyone who needs CMMC is best advised to get to it ASAP.

Finally, there are other kinds of auditors and assessment organizations for other frameworks. Achieving compliance with a program like FISMA, HIPAA, or ISO 27001 will all have their own processes and their own organizations to work with. 3PAOs and C3PAOs are just the two common acronyms for organizations used within the United States Federal Government.