The Cyber AB

What The Cyber AB does

The Cyber AB (legally Cybersecurity Maturity Model Certification Accreditation Body, Inc.) is a 501(c)(3) nonprofit organization founded in January 2020 and headquartered in National Harbor, Maryland. It operates under a no-cost contract with the U.S. Department of Defense as the sole authorized non-governmental accreditation body for the Cybersecurity Maturity Model Certification (CMMC) program, which verifies that defense contractors meet cybersecurity requirements for protecting Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). The organization accredits Certified Third-Party Assessment Organizations (C3PAOs), Licensed Training Providers (LTPs/ATPs), Licensed Publishing Partners (LPPs), and Registered Practitioners (RPOs), and oversees individual professional credentials (CCP, CCA, LCCA, CCI) through its wholly owned subsidiary CAICO, now operated in partnership with ISACA.

The Cyber AB's core technology consists of digital marketplace platforms — the CMMC Marketplace, SCF Marketplace, and SCA Marketplace — that connect the approximately 80,000+ Defense Industrial Base contractors seeking certification with authorized service providers. The 2026 partnership with RAMPxchange extends this with CMMC Marketplace 2.0, adding multi-language international support and improved functionality. The organization generates revenue through C3PAO authorization fees ($6,000 application + $15,000 authorization/re-authorization), individual certification registration and annual renewal fees, ecosystem membership dues, and training/content licensing. The go-to-market combines event-driven engagement (annual CS5 Conference, monthly Town Halls since 2021, webinars) with channel-partner distribution through the authorized C3PAO and ATP networks. The organization is pursuing ISO 17011 accreditation by end of FY2026 to operate under both DoD and international accreditation requirements, and has expanded beyond CMMC into the Secure Controls Framework (SCF) and Supply Chain Assurance (SCA) ecosystems.

Name

The Cyber AB

Legal name

Cybersecurity Maturity Model Certification Accreditation Body, Inc.

Website

https://cyberab.org

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

11–50 employees

Short description

The Cyber AB is the sole U.S. Department of Defense-authorized nonprofit accreditation body for the CMMC cybersecurity certification program, serving defense industrial base contractors through its C3PAO, training, and professional certification ecosystem across CMMC, SCF, and SCA verticals.

Ownership category

akta.pro rank

Product category

Cybersecurity Accreditation Services

akta.pro primary industry

Information Technology (IT) & Cybersecurity Certifications (EDAAANAA)

akta.pro secondary industry

Secure Browser, Device Lockdown & Exam Security Tools (EDAFADAI)

Keywords

• Cybersecurity accreditation services
• CMMC certification programs
• Defense industrial base compliance
• Third-party assessment authorization
• Professional certification credentials

Headquarters

HQ city

Bethesda

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Infrastructure, Others

Revenue model

1. C3PAO Authorization Fees: Organizations seeking to become Certified Third-Party Assessment Organizations pay application fees of $6,000 and authorization/re-authorization fees of $15,000. These organizations are then authorized to conduct CMMC assessments for defense contractors.
2. Individual Certification Fees: Certification fees for individual professionals including CMMC Certified Professional (CCP) registration ($200 one-time) plus exam fee ($275), annual renewal ($250); CMMC Certified Assessor (CCA) registration ($50) plus exam fee ($350), annual renewal ($500); Lead CCA registration ($100) plus renewal ($100).
3. Membership and Ecosystem Fees: The organization generates revenue through membership fees for ecosystem participants including Registered Practitioners Organizations (RPOs), Registered Practitioners, and other ecosystem members seeking to participate in the CMMC marketplace.
4. Training and Content Licensing: Revenue generated through Licensed Training Providers (LTPs) and Licensed Publishing Partners (LPPs) who deliver formal CMMC training curricula and professional certification preparation programs.

Pricing tiers

Go-to-market motion3 records

Distribution channels4 records

Marketing channels6 records

Core offering

The Cyber AB is the sole authorized non-governmental accreditation body for the U.S. Department of Defense's CMMC program. It accredits Certified Third-Party Assessment Organizations (C3PAOs), authorizes training and publishing partners, certifies individual cybersecurity professionals (CCP, CCA, Lead CCA, CCI), and operates digital marketplaces that connect Defense Industrial Base contractors with authorized assessors, consultants, and training providers.

Product overview

The Cyber AB is an accreditation body offering a platform-based ecosystem approach to cybersecurity certification for the Defense Industrial Base. The core offering consists of the CMMC Marketplace connecting organizations with authorized service providers, supported by professional certification programs (CCP, CCA, Lead CCA) administered through CAICO, and C3PAO organization certifications. The organization has expanded beyond CMMC to encompass the SCF Ecosystem (with SCF Marketplace and SCF Certifications) and SCA Ecosystem, each with their own marketplaces. A wholly owned subsidiary, The Cyber EF (Cyber Engagement Forum), drives sustained stakeholder engagement through training and market facilitation. The organization also hosts the annual CS5 Conference and monthly Town Halls as community engagement vehicles.

Differentiator

Problem solved

Functional benefit

Products and services

• CMMC Marketplace Digital marketplace where defense contractors can find and engage with authorized CMMC service providers including C3PAOs, assessors, consultants, and training providers, with visibility into provider credentials and services.
• C3PAO Organization Authorization Organization-level accreditation for entities seeking authorization to conduct CMMC Level 2 third-party assessments for defense contractors. Includes $6,000 application fee plus $15,000 authorization/re-authorization fee, with annual renewal and accreditation included in the C3PAO Agreement.
• Certified CMMC Professional (CCP) Certification Entry-level individual certification for professionals responsible for assessment, examination, verification, and review of organizations for CMMC compliance. Requires DoD CUI Awareness Training prerequisite; $200 registration, $275 exam fee, $250 annual renewal.
• CMMC Certified Assessor (CCA) Certification Individual certification for professionals qualified to work on CMMC Level 2 assessments as part of a C3PAO assessment team. Requires active CCP certification, 3 years cybersecurity experience, 1 year assessment/audit experience, and qualifying certifications; $50 registration, $350 exam fee, $500 annual renewal.
• Lead CMMC Certified Assessor (Lead CCA) Certification Advanced certification for lead assessors who can make final determinations on CMMC assessments. Requires meeting DoD Experience and 8140 requirements; $100 registration fee, $100 annual renewal.
• SCF Marketplace Marketplace for Secure Controls Framework related services and providers, supporting the SCF Conformity Assessment Program for company-level certification.
• SCA Marketplace Marketplace for Supply Chain Assurance services and providers, supporting cybersecurity requirements across supply chains.
• SCF Certifications Certification programs under the SCF Conformity Assessment Program, including SCF Certified - NIST CSF 2.0 and other framework-based certifications for company-level conformity assessment.
• CMMC Central Centralized hub providing access to CMMC marketplace, resources, and ecosystem information for defense contractors navigating CMMC requirements.
• CMMC Marketplace 2.0 (Powered by RAMPxchange) Next-generation version of the CMMC Marketplace with enhanced functionality, dynamic customer-provider matching, and international multi-language support.

Quantifiable outcome

• Fewer than 100 authorized C3PAOs serving 80,000+ defense contractors requiring CMMC certification
• +1 more outcomes

Named customers1 record

Segments4 records

Ideal customer profiles4 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature3 records

Partnerships

Five partnerships are on record, tiered core and minor.

• RAMPxchangecoreStrategic or Co-development Partner · 16 April 2026Strategic partnership at CS5 West to develop and deploy an enhanced version of the Cybersecurity Maturity Model Certification (CMMC) marketplace. The enhanced marketplace provides improved functionality, better structure, visibility, and a revamped interface to streamline how organizations identify and engage with authorized CMMC service providers. The partnership aims to reduce delays in customer-provider relationships and support the program's global reach.
• SCF CouncilcoreStrategic or Co-development Partner · 18 December 2024The Cyber AB appointed as the exclusive Accreditation Body for the SCF Conformity Assessment Program (SCF CAP), a new partnership marking significant advancement in the global landscape of compliance and certification. The SCF CAP uses the Secure Controls Framework as the control set to provide company-level certification. The Cyber AB accredits SCF Third-Party Assessment Organizations (SCF 3PAOs) and oversees conflict-of-interest governance throughout the program.
• ISACAcoreStrategic or Co-development PartnerISACA is now the Authorized CAICO (Cybersecurity Assessor and Instructor Certification Organization) for the CMMC program. ISACA manages the CCP, CCA, LCCA, and CCI credentials and examination processes for CMMC professionals.
• GAO (Government Accountability Office)minorOthersThe GAO issued a report recommending that the Defense Department better manage external risk factors affecting the CMMC program, including ecosystem capacity, program demand, and costs that could affect contractor participation. DoD agreed to assess and document these external factors as it phases in CMMC requirements.
• DCSA (Defense Counterintelligence and Security Agency)coreOthersDCSA conducts DIBCAC (Defense Industrial Base Cybersecurity Assessment Center) assessments for C3PAO candidates. FOCI (Foreign Ownership, Control, or Influence) reviews are conducted by DCSA as part of the C3PAO application process.

Scale indicators5 records

Recent moves8 records

Expansion highlights6 records

Broad incumbents

• UKAS (United Kingdom Accreditation Service): UKAS is the national accreditation body for the United Kingdom, providing ISO 17011 accreditation services across industries. It is comparable as an internationally recognized accreditation body, relevant to The Cyber AB's ISO 17011 pursuit and potential international expansion ambitions.
• ANSI (American National Standards Institute): ANSI is a major U.S. accreditation body that oversees standards and conformity assessment across multiple industries. It is comparable to The Cyber AB as a nonprofit accreditation organization, though ANSI operates broadly across industries while The Cyber AB specializes exclusively in cybersecurity/CMMC.
• A2LA (American Association for Laboratory Accreditation): A2LA is a nonprofit accreditation body providing ISO 17025 and other conformity assessment services. It is comparable as a nonprofit accreditation body pursuing ISO 17011 recognition, though it focuses on laboratory and testing accreditation rather than cybersecurity.
• NVLAP (National Voluntary Laboratory Accreditation Program): NVLAP is a NIST-administered accreditation program providing laboratory and testing accreditation. It is comparable as a government-affiliated accreditation body relevant to The Cyber AB's conformity assessment mandate and its pursuit of federal recognition standards.
• NIAS (National Institute for Automotive Service Excellence): ASE is a nonprofit organization that provides professional certification for automotive service professionals. It is comparable as a nonprofit certification body with professional credentialing programs and assessment-based credentials, though in the automotive rather than cybersecurity domain.

Direct peers

• CompTIA: CompTIA is a leading nonprofit trade association offering vendor-neutral IT and cybersecurity certifications (Security+, CySA+, etc.). It is comparable as a nonprofit certification body with vendor-neutral credentials and industry-recognized professional certification programs.
• SCF Council (Secure Controls Framework): The SCF Council is the strategic partner that appointed The Cyber AB as exclusive Accreditation Body for the SCF Conformity Assessment Program. It is comparable as the framework owner for a competing/parallel cybersecurity conformity assessment program and a direct ecosystem peer.
• ISACA: ISACA is a global professional association for IT governance, risk, and cybersecurity professionals offering CISA, CISM, and other certifications. It is comparable as both a strategic partner (now Authorized CAICO for CMMC) and a peer in cybersecurity professional certification and credentialing.
• (ISC)²: (ISC)² is a major nonprofit cybersecurity professional certification organization offering CISSP and other credentials. It is comparable to The Cyber AB's CAICO subsidiary as a professional cybersecurity certification body, with similar individual certification and renewal fee models.

Regional players

• SANS Institute: SANS Institute is a major cybersecurity training and certification organization offering GIAC credentials. It is comparable through the connection to Cyber AB board member Mathew Newfield (SANS instructor) and as a cybersecurity training and certification provider that feeds into the CMMC ecosystem.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

Compliance5 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles15 records

Subsidiaries2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about The Cyber AB