What are CMMC Registered Practitioners and do I need one?

Title card: "What are CMMC Registered Practitioners?"

by Scott Jack
Content Contributor, E-N Computers
Over 10 years of experience in healthcare IT and tech support.

Updated August 2, 2026

If you’re a defense contractor preparing for CMMC certification, a Registered Practitioner (RP) or Registered Practitioner Organization (RPO) can help you get ready. It’s not required, but given the complexity of CMMC, most organizations find it’s worth it.

Working with one is an up-front cost, but it can save you significant time and money before and during the audit.

If you are a contractor or subcontractor that 1) works with the Department of War (formerly the Department of Defense) and 2) handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), you need to become CMMC-compliant.

CMMC became official when the program rule took effect in December 2024. Contracts started requiring Level 1 and Level 2 self-assessments under DFARS 252.204-7021 (48 CFR) in November 2025. Level 2’s third-party assessment requirement was on track to follow on November 10, 2026, but the Department of War suspended that rollout in July 2026 and opened a 60-day review of the program.

Your DFARS 252.204-7012 obligation to protect controlled unclassified information hasn’t changed, and self-assessment requirements remain in place. Because getting compliant takes 12 to 18 months no matter when you start, most contractors are better off continuing to prepare now instead of waiting to see how the review turns out.

E-N Computers is a Registered Practitioner Organization, and we have two Registered Practitioners. We offer CMMC consulting services tailored to smaller businesses.

QUICK ANSWER:

What are CMMC Registered Practitioners and do I need one?

CMMC Registered Practitioners are individuals recognized by The Cyber AB, the official accreditation body authorized by the Department of War to oversee the CMMC ecosystem, as being qualified to help organizations prepare for CMMC certification. If you rely on Department of War contracts and plan to become CMMC certified, working with one is worth it. Preparing for and passing the audit is complex and expensive — a good RP helps you avoid the mistakes that make it more so.

The CMMC ecosystem
Working with a Registered Practitioner
What does it cost to become CMMC compliant?
How to prepare for a CMMC audit
Frequently asked questions
Not sure which level you need?
Learn more about CMMC

The CMMC ecosystem

The Cyber AB

The Cyber AB is the official accreditation body authorized by the Department of War to accredit and oversee the CMMC ecosystem. As of April 1, 2026, it no longer handles assessor training and certification — that role now belongs to ISACA, the CMMC Assessor and Instructor Certification Organization (CAICO). The Cyber AB still oversees C3PAOs, runs the CMMC Marketplace, and manages the Registered Practitioner programs. Its website gives an overview of the roles across the CMMC ecosystem. Here are a few of the key ones.

Registered Practitioner

CMMC Registered Practitioners are individuals with in-depth knowledge and experience in cybersecurity. A Registered Practitioner can help your organization prepare for and achieve CMMC certification according to its needs, capabilities, and budget. There are two levels of Registered Practitioner — regular and advanced. As The Cyber AB states, “Individuals holding any level of an RP designation can provide CMMC implementation consulting services”. RP and RPA designations, applications, and renewals are unaffected by the suspension.

There are several steps to become a Registered Practitioner:

Complete the required application process, which includes fees, background checks, training, and agreement to The Cyber AB’s code of professional conduct
Maintain the designation through ongoing requirements and annual renewal

After achieving the RP designation, an individual can pursue the Registered Practitioner Advanced (RPA) designation by completing additional training, demonstrating deeper technical competency, and passing the required exam. Requirements and associated fees are set by The Cyber AB and may change over time.

Registered Practitioner Organization

A Registered Practitioner Organization is a business that has one or more Registered Practitioners on staff. They can guide companies through the full compliance process. E-N Computers became a Registered Practitioner Organization in October 2023.

CMMC Third-Party Assessment Organizations (C3PAOs)

C3PAOs are the companies authorized to run official CMMC Level 2 certification assessments. Before The Cyber AB will authorize one, the C3PAO has to pass an assessment of its own systems by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), the government’s assessment team.

The people who do the work hold different credentials depending on their role. Certified CMMC Assessors (CCAs) lead assessments and make the final compliance determinations. Certified CMMC Professionals (CCPs) can verify Level 1 practices and serve on a Level 2 assessment team. Both credentials are issued by ISACA.

Level 1 is a self-assessment. Level 2 comes in two forms — a self-assessment or a C3PAO certification assessment — depending on what the contract calls for. Level 3 assessments are conducted by DIBCAC, not by C3PAOs.

While Phase 2 is suspended, contracting officers can designate only Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 are on hold, and active solicitations that already carried those requirements are being amended to remove them. C3PAOs are still performing voluntary Level 2 assessments.

Working with a Registered Practitioner

How much does it cost to work with a Registered Practitioner?

At E-N Computers, CMMC consulting with a Registered Practitioner is typically offered in tiers:

$750/month for two meetings
$1,500/month for weekly engagement
$225/hour for ad hoc consulting

Most organizations choose the $1,500/month tier because consistent weekly engagement helps maintain momentum and avoid delays during implementation.

It also costs you some time: we expect you to set aside at least one hour every one to two weeks to work through all the details. CMMC compliance will affect your business workflows, and this collaborative approach produces much better results and less disruption than having us make all the decisions for you.

That time pays off. It speeds up certification, and it usually turns up problems worth fixing whether or not CMMC required it. Consultation is just one part of the overall cost. Below, we break down the full cost of becoming CMMC compliant.

Why use a Registered Practitioner

Three things set RPs apart from a general IT provider:

Commitment to the CMMC ecosystem
Registered Practitioners actively invest in ongoing training and education specific to CMMC requirements, so they remain current as rules evolve.
Ethics and accountability under Cyber AB oversight
RPs must follow a formal code of professional conduct governed by The Cyber AB. Failure to comply can result in loss of designation, which creates a higher level of accountability.
Specialized compliance expertise
RPs understand both the technical cybersecurity controls and the certification interpretation of those controls. This helps organizations avoid expensive scoping mistakes, misinterpretations, and unnecessary rework.

Can a Registered Practitioner or organization help maintain compliance?

Yes. Compliance is ongoing work. NIST 800-171 gets updated, contract requirements change, and your own business changes.

Am I required to work with a Registered Practitioner?

No, you don’t have to work with a Registered Practitioner. But if you do, you’ll be working with a consultant The Cyber AB has vetted for the knowledge, skills, and experience to guide you through the process.

Can an individual be my Registered Practitioner and my assessor?

No. An individual can hold multiple designations, but they cannot assess your company if they previously assisted you with an implementation consultation.

What does it cost to become CMMC compliant?

The cost of CMMC depends on where you’re starting, but there are realistic ranges you can plan around.

For most organizations pursuing Level 2 compliance (handling Controlled Unclassified Information), costs typically fall into three categories:

Consultation (planning and guidance)

This is where you figure out where you stand. You’ll work with your RP to assess your current setup, identify gaps, and define your scope correctly — which has a big effect on everything that comes after.

A typical cost is $750–$1,500 per month depending on engagement level. Most organizations choose $1,500/month for weekly progress and faster results.

Implementation (the largest variable)

This is where the real work happens: deploying security tools, restructuring access controls, documenting policies and procedures, and training your team.

A typical cost here is $30,000 to $70,000+.

Costs vary widely depending on how mature your current IT and security setup is, whether you need to migrate to secure platforms like Microsoft 365 GCC High or Google Workspace, and how well you define your CUI scope.

Organizations that scope their systems correctly early on often save tens of thousands of dollars here.

Audit (certification assessment)

A C3PAO assessment costs about $22,000 to $100,000, as of mid-2026. Around $40,000 is common for a mid-sized, single-site company with 20 to 40 employees. The price climbs with multiple locations, more complicated systems, and more users.

This is the one line item you can defer right now. While Phase 2 is suspended, no contract can require you to hold a Level 2 certification, so scheduling an assessment is a business decision rather than a deadline. Some contractors are going ahead anyway — a certification is still the strongest answer when a prime asks for proof, and it protects you if your self-assessed score is ever challenged. Others are redirecting that budget into closing the gaps an assessment would have found, which is money well spent no matter how the review turns out.

Preparation pays off either way. Companies that come in prepared get through assessments faster, with fewer findings to remediate afterward and less staff time lost to hunting down evidence.

Typical total cost

Category
Consultation (12 months)
Implementation
Subtotal (what’s required now)
Audit (currently not required)
Total with certification

Estimated Cost
$10,000–$20,000
$30,000–$70,000+
$40,000-$90,000+
$22,000–$100,000+
$62,000–$190,000+

What drives cost up (or down)?

The biggest cost drivers aren’t just size — they’re decisions:

Poor scoping → paying to protect more systems than you need
Misinterpreting requirements → rework and delays
Treating CMMC like “just IT” instead of a business process

On the other hand, clearly defined CUI boundaries, strong internal collaboration, and working with an experienced consultant can reduce both time and total cost.

How to prepare for a CMMC audit

To prepare for a CMMC audit, you need to set realistic expectations about what CMMC level you need, how long it takes, your role in the process, and how expensive it is.

Which CMMC level do I need to reach?

CMMC is built on NIST 800-171 and has three levels.

Level 1 (15 requirements): Sufficient for businesses handling Federal Contract Information (FCI). The audit for this level is not expected to be as documentation heavy.
Level 2 (110 requirements): Required for handling Controlled Unclassified Information (CUI). Because each requirement can have multiple objectives, there are over 300 objectives to meet. The plan was for some contracts to require a third-party assessment and others to allow self-assessment, depending on whether the contract involves “prioritized” CUI. That third-party assessment requirement is on pause. Check with your contracting officer to confirm which standard applies to your contract.
Level 3 (24 additional requirements): For contractors supporting the highest-priority programs. Which contracts fall here depends on the program and the data involved, not on whether you are a prime or a subcontractor.

A Registered Practitioner can help you determine which level you realistically need. Together, we’ll examine 1) what kind of information you handle and 2) what systems process and store sensitive information. We’ll also look at what systems you have in place to simplify administrative tasks like user account control (for example, single sign-on.)

How long does it take to become CMMC compliant?

Most contractors need 12 to 18 months to get compliant, depending on where they’re starting and which level applies. That’s the timeline that makes an RP worth the up-front cost — the work is sequential, and there’s no way to compress it once a requirement lands. Here’s the full breakdown of what happens in those months.

How involved will I be?

You will be regularly and actively involved throughout the process of working toward CMMC compliance. Full collaboration is critical to a successful implementation and audit, for a few reasons.

CMMC implementation will affect the way you do business. A Registered Practitioner knows cybersecurity and CMMC, but you know your business and team. The combination of your areas of expertise will produce the best result — one that you understand, support, and that works for you day-to-day.

There will be a lot of documentation. As you can expect when working with the government, especially the Department of War, paperwork is the name of the game. There will be a lot of documentation to produce and review in preparation for the audit. You have information that will be integrated into that documentation. But you will also be expected to understand how all the pieces fit together.

This is a chance to simplify your technology and fix the problems that have been slowing you down. Too often, poorly designed and implemented tech inhibits business functions. The close review you will do while preparing for certification will reveal inefficiencies and weaknesses in your tools and processes. You can ignore them and do the bare minimum to reach compliance, or you can use the opportunity to fix them with an expert’s help.

Frequently asked questions

What happens if we don’t pass the audit the first time?

Falling short doesn’t mean starting over. If you score at least 88 out of 110, you can put the remaining gaps on a remediation plan and get a conditional status while you close them. You then have 180 days to finish the work and pass a closeout assessment. The status expires if you miss that window. The same rules apply whether you self-assess or bring in a C3PAO.

The catch is that only the smallest gaps qualify. Higher-weighted requirements have to be fully met before the assessment starts, and including even one item that isn’t eligible means no status at all, regardless of your score. That’s why preparation matters more than the assessment itself.

What happens if we don’t maintain CMMC compliance?

Failure to comply with CMMC requirements can lead to serious consequences, including losing existing Department of War contracts, becoming ineligible for future contracts, legal penalties, and reputational damage. Non-compliance can also be considered a breach of contract.

Where can I find a list of Registered Practitioners?

Visit The Cyber AB Marketplace for an updated list of Registered Practitioners (RP/RPA), Registered Practitioner Organizations (RPO), CMMC Third-Party Assessment Organizations (C3PAOs), and more.

We also encourage you to ask for references, case studies, and detailed explanations of the RP’s approach to make sure their experience aligns with your specific needs and expectations.

Not sure which level you need?

Most contractors we talk to aren’t sure whether they need a consultant or just need someone to confirm they’re already on the right track. A short conversation usually settles it. Tell us what contracts you hold and what kind of information you handle, and we’ll walk you through which level applies to you and what the work looks like from here.