RP / RPO

A Registered Practitioner (RP) is an individual who has completed Cyber AB training requirements and is authorized to provide CMMC consulting services to defense contractors. RPs are not assessors — they help organizations prepare for assessments but cannot conduct certification assessments themselves (that role belongs to Certified CMMC Assessors employed by C3PAOs).

A Registered Practitioner Organization (RPO) is a firm that employs at least one RP and has been credentialed by the Cyber AB to deliver CMMC consulting services as a business. RPOs can scale CMMC implementation work across multiple clients.

There are roughly 700 RPs and 200 RPOs active in the United States. They are the primary external workforce most defense contractors use to prepare for a CMMC Level 2 assessment, and they typically work with a platform like CMMCDocs to manage their clients' SSPs, POA&M items, and evidence collection.