Schellman & Company, LLC

Schellman & Company, LLC is a Cyber AB Marketplace-listed C3PAO based in Tampa, FL.

Headquarters

Tampa, FL

Region

Tampa, FL

Founded

2002

Last verified

May 14, 2026

Sources

3 cited

Listing position

Editorial · unranked

Vendor website

Visit ↗

Plain-English description

What this provider does

Schellman & Company, LLC is a Cyber AB Marketplace-listed C3PAO based in Tampa, FL, listed on the marketplace as operating since 2002. The Cyber AB listing names assessment services, audit services, governance, risk & compliance, other, penetration testing & phishing, and third-party risk management among the services they offer. We have not independently verified the vendor's own website; the Cyber AB Marketplace listing is the basis of every claim on this page.

Registered as / claimed status

Stated affiliations and certifications

What the vendor (or a third party) states about their formal status. Each line is anchored to its source.

Listed on the Cyber AB Marketplace as a C3PAO[01]

Why buyers hire them

What this provider is commonly used for

Formal CMMC Level 2 certification assessments (provider's own scope and authorization should be verified on their own site).
[01]
Formal CMMC Level 2 certification assessments under their C3PAO authorization.
[02]
Independent cybersecurity audits beyond CMMC scope.
[02]

Stated services

Services the vendor claims

CMMC Level 2 third-party assessments[01]
Assessment Services[02]
Audit Services[02]
Governance, Risk & Compliance[02]
Other[02]
Penetration Testing & Phishing[02]
Third-Party Risk Management[02]
CMMC Level 1 Assessment[03]
CMMC Level 2 Assessment[03]
CMMC Level 3 Assessment[03]
SOC 1 Audit[03]
SOC 2 Audit[03]
ISO 27001 Audit[03]
FedRAMP Assessment[03]
PCI DSS Assessment[03]
HITRUST Assessment[03]
NIST 800-171 Assessment[03]

What we don't know

Gaps in this record

Facts that could not be confirmed against a public source on the retrieval date. If you can point to an authoritative source for any of these, we'll update the record.

·This record is derived from the Cyber AB Marketplace listing. We have not independently verified the vendor's own CMMC page, pricing, or current engagement capacity.
·Vendor self-description and detailed service mix are not captured here — see the linked Cyber AB profile for the vendor's own narrative.
·We have not independently verified the vendor's own website. Cyber AB Marketplace listing is the basis of every claim on this page.
·Vendor pricing, current capacity, and engagement model are not captured here.

Sources

[01]Cyber AB · Cyber AB Marketplace listing — C3PAO
“Schellman & Company, LLC appears on the Cyber AB Marketplace with the address Tampa, FL. Role(s): C3PAO.”
Retrieved May 14, 2026 · high confidence
[02]The Cyber AB · Schellman & Company, LLC | Cyber AB Marketplace
“Schellman brings unmatched federal assessment experience to the CMMC certification ecosystem. As the #1 FedRAMP 3PAO, we have completed more than 150 federal cloud authorizations and maintain DoD IL6 clearance for assessing the most sensitive classified environments. Defense contractors benefit from Schellman's unique position as the only leading C3PAO assessing CMMC alongside FedRAMP, ISO 27001, SOC 2, PCI DSS, and HITRUST. Our cross-framework expertise allows organizations to streamline compliance efforts across their entire framework portfolio. Our assessment-only model (no consulting, no remediation services, and no upselling) ensures fully independent, objective certification aligned with CMMC requirements. Backed by over 20 years of pure assessment experience, Schellman provides defense contractors with the trusted, audit-focused expertise needed to achieve and maintain CMMC compliance.”
Retrieved May 14, 2026 · high confidence
[03]Schellman & Company · Schellman CMMC Assessment and Certification
“Schellman & Company is one of the first authorized C3PAOs and the first authorized firm to perform SOC, ISO, FedRAMP, PCI, and HITRUST services alongside CMMC assessments. The CMMC service supports Levels 1, 2, and 3 of the CMMC 2.0 model — Level 1 (17 NIST SP 800-171 requirements protecting FCI, self-assessment), Level 2 (110 NIST SP 800-171 requirements protecting CUI, typically requiring C3PAO assessment), and Level 3 (Level 2 plus a subset of NIST SP 800-172, very small number of contracts). Schellman uses an outcome-based, fixed-fee pricing model and reports less than 5% of clients see scope amendments. The firm publishes guidance content on CMMC certification, federal assessments, and audit cost frameworks.”
Retrieved May 14, 2026 · high confidence

Sources are the basis of every factual claim on this page. If the vendor has updated their site, the “last verified” date will lag. Re-check the vendor URL before relying on it.