Redspin Earns ISO Accreditation as a CMMC Assessment Provider

On November 10, 2026, Redspin announced it had achieved ISO/IEC 17020:2012 accreditation and become an accredited CMMC Third Party Assessment Organization (C3PAO). The accreditation is an independent validation of its processes for assessing organizations under the Cybersecurity Maturity Model Certification program. For contractors in the Defense Industrial Base (DIB) that handle Controlled Unclassified Information and seek Department of Defense (DoD) work, the announcement is relevant to choosing an assessor and planning for certification. It is an accreditation milestone—not a government contract award, solicitation, or change to CMMC deadlines.

ISO/IEC 17020 is an international standard for organizations performing inspections. According to Redspin, accreditation required extensive documentation of its assessment processes, followed by review from Cyber AB accreditation assessors. Those assessors observed the full lifecycle of a CMMC assessment, from initial contract discussions through issuance of a CMMC certification. The review examined whether assessment teams could interpret CMMC requirements accurately, communicate with clients, answer CMMC-related questions, and follow the prescribed assessment procedure. This evaluation provides contractors evidence that an assessor’s practices have been independently reviewed rather than relying only on the provider’s own claims.

Redspin described the accreditation as a step toward demonstrating the cybersecurity readiness needed to compete for government contracts and confirming compliance with DFARS 7012. Accreditation may therefore factor into contractor due diligence when selecting an assessor, especially for organizations preparing for CMMC Level 2. It does not, by itself, certify any contractor, guarantee a successful assessment, or establish that a contractor meets contract-specific requirements. Companies should continue to assess their own readiness, confirm applicable obligations, and plan assessment timing around current program guidance.

The source material also reports that 78.2% of surveyed DIB organizations were continuing Level 2 certification efforts or had already achieved certification, notwithstanding a temporary pause in the Phase 2 rollout. That figure suggests continued industry attention to certification, but it does not indicate a new deadline or government procurement action. Redspin’s accreditation may give prospective clients another credentialed provider to consider as they plan, while the broader market signal is that many DIB organizations have continued readiness work despite rollout uncertainty. Robert Teague, Redspin’s Vice President of Federal Consulting, said: “Contractors shouldn't have to take an assessor's word that their end-to-end processes are rigorous, and accreditation means they don't have to.”

• Redspin announced its accreditation on November 10, 2026, becoming one of the first accredited C3PAOs, according to the company.
• The accreditation is to ISO/IEC 17020:2012, a standard addressing the competence, impartiality, independence, and consistency of inspection bodies.
• Cyber AB accreditation assessors reviewed documentation and observed Redspin’s process from initial contract discussions through certification issuance.
• The observed assessment lifecycle included evaluating requirements interpretation, client communications, responses to CMMC-related questions, and adherence to assessment procedures.
• DIB contractors pursuing CMMC Level 2 can include Redspin in their assessment-provider evaluation and readiness planning.
• The company says its assessment services help contractors demonstrate cybersecurity readiness for government work and confirm compliance with DFARS 7012; accreditation does not itself certify a contractor.
• The source reports 78.2% of surveyed DIB organizations were continuing Level 2 efforts or had already achieved certification despite a temporary Phase 2 rollout pause.
• The announcement is an accreditation development, not a DoD contract award or solicitation, and it does not change CMMC compliance deadlines.
• Contractors should independently verify current program requirements and assess provider suitability against their specific certification needs and schedule.