.png)
Three Organizations, One Initiative
The Cyber AB lists SCR RPOs in the SCF Marketplace. The Cyber EF's practitioner development and marketplace work supports providers like them.
%20(white).png)
The SCF Council writes the content. It owns the control set, the body of knowledge and the assessment guides, but it does not accredit assessors or issue certifications.
%20Ecosystem%20-%20SCR%20Ecosystem%202026%20draft1%20(1).png)
The Cyber AB is the Accreditation Body for the SCR CAP and the same body that operates in the CMMC ecosystem. It decides who is qualified to assess and support organizations, and it lists them in the SCF Marketplace.
The Cyber EF is an entity of The Cyber AB dedicated to sustained engagement with CMMC and SCF stakeholders through training, education, outreach and market facilitation.
Individual certifications sit with SAICO, the SCR Assessor and Instructor Certification Organization.
What Is an SCR RPO?
An SCR RPO is a consulting or advisory organization registered to provide SCF implementation, advisory and assessment preparation services. RPOs have demonstrated a commitment to professionalism and expertise in implementing the SCF across diverse business environments. When the next requirement lands, that same work extends the control set rather than starting a new project.
Assessment Readiness
Prepare organizations for SCR CAP conformity assessments conducted by 3PAOs.
SCF Adoption
Streamline SCF implementation across diverse organizational environments.
Professional Services
Provide expert consulting to ensure alignment with cybersecurity and compliance objectives.
Role in the SCR CAP Ecosystem
RPOs are a key player in the broader SCF Ecosystem, helping Organizations Seeking Assessment (OSAs) prepare for and successfully complete SCR CAP conformity assessments conducted by Third-Party Assessment Organizations (3PAOs).
Assessors Cannot Also Advise
An RPO helps you prepare; a 3PAO assesses you. Treat them as distinct engagements.
Same Letters, Different Program
In CMMC, RPO stands for Registered Practitioner Organization. An SCR RPO is a Registered Provider Organization under the SCR CAP, preparing organizations for SCF-based assessments. Check which program a provider is registered for before you engage them.
The Cyber AB Marketplace
The Cyber AB is the official Accreditation Body (AB) for the Secure, Compliant & Resilient Conformity Assessment Program (SCR CAP). The Cyber AB runs the SCF Marketplace where all accredited RPOs, 3PAOs, and other ecosystem participants are listed.
Organizations looking to find an RPO to assist with SCF implementation or assessment preparation should visit The Cyber AB Marketplace to identify accredited RPOs with the expertise relevant to their specific needs. You can learn more about being an RPO and sign up through The Cyber AB’s website.
The Cyber AB SCF Marketplace
The Cyber AB is the official Accreditation Body for the SCR CAP. All accredited SCR RPOs are listed in The Cyber AB Marketplace. Visit cyberab.org to find an RPO or apply to become one.
SCR RPOs in the Broader Ecosystem
SCR RPOs are a key player in the broader SCF Ecosystem. RPOs help Organizations Seeking Assessment (OSAs) prepare for SCR CAP assessments and work alongside 3PAOs throughout the process.
SCR CAP Ecosystem Participants
SCF Council (content), The Cyber AB (accreditation), the Cyber EF (engagement), 3PAO (assessment), RPO (preparation, you are here), ASP (solutions), CAT (GRC platforms), LCP (licensed content), OSA (the organization seeking assessment).
