~80,000 contractors need CMMC Level 2.
The assessment pipeline is the bottleneck.
ZeroTrustCMMC is a free, neutral register of authorized assessment organizations — who they are, where they operate, and whether they have capacity — plus a quote router that gets you answers without cold-calling the whole list.
The CMMC Scoping Map
Before you can price an assessment, you have to scope it. Place every asset in its §170.19 category — CUI, SPA, CRMA, Specialized, or Out-of-Scope — and watch the assessment boundary and relative effort update live. Apply a baseline for your architecture (enclave / hybrid / flat) and company type, then switch to Equip to see which vendors cover the surface you scoped. Free, runs in your browser, nothing leaves the page.
Open the scoping tool →Assessor directory
Authorized C3PAOs with state, services, and capacity signals. Filter by state and availability. Sponsored listings are always labeled — and never affect ordering.
The register
The underlying structured register: 82 C3PAOs and 25 RPOs with permalinks, source citations, and CSV export. Built to be cited.
Capacity tracker
Certifications issued vs. the ~80,000 needed before the phase-in completes. One chart, updated monthly, freely shareable.