The Office of the Under Secretary of Defense for Acquisition and Sustainment (OUSD - A&S) is the
ultimate authority, but the certification itself is provide by the C3PAOs approved by the CMMC.