RPO vs. C3PAO: Who Does What
Two kinds of organizations show up when you look for CMMC help: firms that help you prepare, and firms that assess you. They are not interchangeable.
The Cyber AB
The Cyber AB is the accreditation body for the CMMC program. Its Marketplace lists both kinds of organization.
RPO: helps you prepare
A Registered Practitioner Organization is a consulting firm registered with the Cyber AB to advise companies on CMMC. An RPO can scope your environment, find gaps, and help you fix them. It cannot certify you.
C3PAO: assesses you
A CMMC Third-Party Assessment Organization is authorized to carry out Level 2 certification assessments.
Why one firm cannot do both for you
To avoid a conflict of interest, a C3PAO cannot assess a company it has advised on the same scope. Some C3PAOs also consult, but for clients they will not assess. Ask any firm which role it would play for you.
How to check
You can confirm a firm's status at cyberab.org. Each profile in this directory also links to where a firm states its credentials.