Find an auditor

Find an auditor while going through the audit process. The audit must be led by authorized and accredited assessors, known as C3PAOs. There are not many C3PAOs available, which means that finding time on a C3PAO’s schedule can be a lengthy process. If you are interested in finding out whether a third-party assessor is a C3PAO, check out the CMMCAB.org directory.

There are a few things you should consider when selecting an auditor:

1. Accreditation: Ensure that your auditor is an authorized and accredited C3PAO.
2. Find a reputable firm. It doesn’t have to be a brand-name firm like KPMG; one with a good reputation will suffice. If you need guidance in this area, we’re happy to provide some recommendations using this list of audit partners
3. Experience matters. An auditor with more experience is likely to have a better and more thorough understanding of CMMC, how to evaluate controls against your organization, and the best practices that apply.
4. It’s important that your auditor understand your business, so they can expertly assess if there are any gaps or deficiencies.

Learn more about CMMC compliance automation with TrustOps!