RPO

“CMMC: THE MOST IMPORTANT CHANGE IN REGULATIONS FOR GOVERNMENT CONTRACTORS IN DECADES!” Government Contractors Association

What does an RPO do?
REGISTERED PROVIDER ORGANIZATION (RPO) – The RPOs and RPs provide advice, consulting, and recommendations to their clients. They are the “implementers” and consultants, but do not conduct Certifications. A C3PAO cannot consult on program performance AND perform your CMMC Audit for certification. This restriction is an intentional control to avoid any conflict of interest and ensure that the CMMC audit is an independent evaluation program.

Who Needs CMMC Certification?
Any company and its subcontractors that bid on a DoD contract that contains Federal Contract Information (FCI) and/or Controlled Unclassified Information (CUI) will be required to be CMMC compliant.

Which Level of CMMC?
CMMC Implementation is through Government Contracts: Once CMMC is fully implemented, certain DoD contractors that handle sensitive unclassified DoD information will be required to achieve a particular CMMC level as a condition of contract award
The CMMC level mandated will be stated in the contract information. The majority of contracts will require a Level 1 or Level 2 compliance.

CMMC 2.0

* Eliminates all maturity processes
* Eliminates all CMMC unique security practices:
* Advanced / Level 2 will mirror NIST SP 800-171 (110 security practices)
* Expert / Level 3 will be based on a subset of NIST SP 800-172 requirements

GMS Registrar is CMMC AB certified to assist in the preparation of NIST 800-171 and subsequent CMMC preparation and submission

Take Advantage of Our Knowledge, Expertise and Experience – Contact us Today.