A CMMC self-assessment is a structured check, performed by your own company, of whether you meet the CMMC cybersecurity requirements for your level. You then post the result in the Department of Defense’s Supplier Performance Risk System (SPRS), and a senior official at your company affirms it. Level 1 contractors self-assess every year. Level 2 contractors self-assess every three years when their contract allows it, and affirm every year in between.
It matters right now for a specific reason. Phase 1 of the CMMC rollout, which began November 10, 2025, centers on Level 1 and Level 2 self-assessments. Phase 2, the third-party certification phase, was suspended on July 13, 2026, and no replacement date has been announced. The requirements didn’t pause with it. As of early November 2026, your score and affirmation are what you can be asked for. Our Phase II suspension guide tracks the current status.
This guide covers both levels, how to do each, what score you need, and how to keep a self-assessment from becoming a liability.
What Is a CMMC Self-Assessment?
Under the Cybersecurity Maturity Model Certification (CMMC) program, a self-assessment is an assessment your organization performs on itself, instead of one performed by a Certified Third-Party Assessor Organization (C3PAO) or by the DoD. You evaluate each requirement for your level as MET or NOT MET, calculate your result, submit it in SPRS, and have an affirming official affirm that it’s accurate and that you comply.
Under CMMC 2.0, a self-assessment is the only assessment available at Level 1 and an allowed path at Level 2 for select contracts, and the self-assessment process has to be done properly. It isn’t a casual checklist. The result becomes your CMMC status, and a valid status is a condition of contract eligibility: before award of a contract with a Level 1 (Self) requirement, you must have both the status and an affirmation in SPRS, which is what a contracting officer will look for. Note the vocabulary, too. A self-assessment earns you a CMMC status, while the assessment a C3PAO performs is called a certification assessment, which is where the phrase “CMMC certification” comes from. A self-assessment is also a representation to the government, which matters more than most contractors realize (more on that below).
Who Needs a CMMC Assessment? Self-Assessment, Third-Party C3PAO, and Costs by Level
Which assessment you need, and whether you qualify for a self-assessment at all, is set by your contract and by the information you handle, not by preference. The self-assessment requirements differ by level, so start with the table. The alternative to a self-assessment is a third-party assessment by a C3PAO, or a DoD-led assessment at Level 3.
| | Level 1 (Self) | Level 2 (Self) | Level 2 (C3PAO) | Level 3 |
| Protects | Federal contract information (FCI) | Controlled unclassified information (CUI) | CUI | CUI (highest priority) |
| Requirements | 15 (FAR 52.204-21) | 110 (NIST SP 800-171) | 110 | 134 (110 plus 24) |
| Assessed by | You | You | A C3PAO | The DoD (DIBCAC) |
| How often | Every year | Every 3 years, affirm yearly | Every 3 years, affirm yearly | Every 3 years, affirm yearly |
| POA&M allowed | No | Limited; close within 180 days | Limited; close within 180 days | Limited |
| DoD cost estimate, small entity | $5,977 a year | $34,277 ($37,196 over 3 years) | $101,752 ($104,670 over 3 years) | Not shown |
Those cost figures are DoD’s own planning estimates from the final rule’s cost analysis, and they cover assessment and affirmation only. They assume your controls are already in place, so the work of implementing them is on top.
The question we hear most is whether you can self-assess Level 2. You can if your contract says Level 2 (Self). DoD describes Level 2 self-assessment as available for select programs, and program managers decide, contract by contract, which path a Level 2 contract calls for. The solicitation says which one applies. Levels 2 and 3 allow limited POA&Ms; Level 1 allows none. A Level 2 status also satisfies Level 1 for the same scope. If you aren’t sure whether you handle FCI or CUI, start with our guide to FCI vs. CUI.
How to Do a CMMC Level 1 Self-Assessment for FCI
Level 1 is the simpler of the two, and it’s pass/fail.
- Define your scope. Identify the systems that process, store, or transmit FCI. Your SPRS entry will record the assessment scope and your CAGE codes.
- Assess the 15 requirements. They come from FAR 52.204-21 and cover access controls, identification and authentication, media protection, physical protection, system and communications protection, and system and information integrity. Some materials count 17 practices because the CMMC assessment guides split a few of these requirements into separate practices. DoD’s own count for the CMMC Level 1 requirements is 15.
- Record each as MET or NOT MET. Every requirement must be MET. No POA&M is permitted at Level 1.
- Enter the results in SPRS. That includes your CMMC level, status date, assessment scope, CAGE codes, and compliance result.
- Affirm and repeat. A senior official affirms compliance. A Level 1 status is valid for one year, so put the next self-assessment on the calendar.
Keep the evidence behind every MET. If you’re weighing whether Level 1 is enough for your contracts, see is CMMC Level 1 enough.
How to Scope and Do a CMMC Level 2 Self-Assessment for CUI
To conduct a self-assessment at Level 2, you’re evaluating all 110 controls in NIST SP 800-171, and it takes real preparation. Here is the order that works.
- Scope your CUI environment. Identify where CUI is stored, processed, and transmitted, and which assets, people, and facilities touch it. A data flow diagram helps. In a recent scoping call, a client’s remote users meant the on-premises network could be scoped out, while a building’s badge and camera systems, run by the landlord, created a shared-responsibility dependency. Scope before you score, because scope decides what you’re scoring.
- Document your plan. Write the system security plan and the policies and procedures behind each requirement. The plan should stay at the policy level, with changing details like user lists and device inventories kept in supporting records.
- Assess the requirements. Evaluate the 110 requirements against NIST SP 800-171A’s 320 assessment objectives, and record each as MET or NOT MET. Do it at the objective level. One practical habit: map each piece of evidence to one objective, in a repository that contains no CUI, so the package is organized before anyone asks for it. A simple checklist for each requirement keeps it honest: the policy that requires it, the procedure that carries it out, proof it’s implemented (a configuration export, screenshot, or log), and a named owner.
- Calculate your score. Scoring uses the DoD Assessment Methodology: you start at 110 and subtract points for each unmet requirement, weighted by how critical it is. The range runs from −203 to 110.
- Post the results to SPRS. Enter your assessment results, and have your affirming official affirm them.
- Affirm every year and reassess every three. If you finished with a POA&M, you also owe a closeout self-assessment inside 180 days.
What Score Do You Need to Pass CMMC?
To meet CMMC requirements at Level 1, all 15 must be MET. At Level 2, a perfect 110, meaning full compliance with all 110 requirements, earns Final Level 2 (Self). A minimum score of 88 earns Conditional Level 2 (Self), but only if every open item is eligible for a POA&M, since the rule bars certain critical requirements from one. A Conditional status expires if you don’t close out the POA&M within 180 days, and then you’re ineligible for new awards that require it. Our posts on the passing score and the POA&M go deeper.
Real scores vary more than people expect:
- A strict standard changes the number. A manufacturer with about 40 users and a single IT person scored itself −137 when it required policies, procedures, implementation, and evidence for each requirement, not just good intentions.
- A low score has a price. One manufacturer’s SPRS score of 18 put roughly $9–10 million of prime-contractor business at risk, which triggered a fast recovery plan built around firewall hardening, security baselines, media protection, and encryption.
- A few areas carry the points. Another client self-assessed in the low-to-mid 80s, with 10–15 points left, mostly in patch management and vulnerability assessments. In its plan, vulnerability management, remediation, access training, and system-flaw controls together were worth 15 or 16 points.
A better score is not the same as audit-ready evidence. The manufacturer above was clear that its near-term work was aimed at what it could report to its customer, while a complete evidence package for an assessment was a later milestone.
The Risk for Contractors: Scoring Honestly and When a Gap Analysis Helps
A self-assessment is a representation to the government, and the government has treated inaccurate ones as false claims. In March 2025, MORSECORP agreed to pay $4.6 million to resolve False Claims Act allegations. According to the Justice Department, it submitted a self-assessed score of 104 in January 2021 and did not update it until June 2023, three months after being served with a subpoena. DOJ alleged it had not fully implemented the NIST controls or maintained a system security plan, and an outside consultant had calculated a far lower score. The company settled the allegations.
The lessons are practical, and they lower your compliance risk. Score what’s true, not what you hope to be true, because an honest score is also the only accurate picture of your security posture. Update SPRS when you learn it’s wrong, or when your compliance status changes. Keep evidence for every MET. And make sure your affirming official understands what they’re signing. This is general information, not legal advice. If there’s doubt, talk to counsel.
This is also where an independent review pays off. A gap analysis, or a third-party review of your evidence before sign-off, catches the optimistic answers before they become a filing. Clients are doing exactly that: one is having an independent party review its body of evidence before its planned self-assessment, and another weighing self-assessment against a C3PAO concluded that either path needs accurate SPRS responses and an assessment-grade evidence package. For the full picture of what we do, see our CMMC compliance work.
Most self-assessment problems are avoidable. These come up repeatedly in readiness work:
- Scoring intent instead of implementation. A requirement is MET when it’s documented, carried out, and provable, not when you plan to get to it.
- Scoping too narrowly, or from stale data. One client’s device inventory, dated months earlier, missed machines added since, and USB devices and virtual machines needed separate tracking. Scope drives everything else.
- Writing the plan and never adopting it. Policies need a formal adoption process: review, implementation, training, and approval. A draft in a folder isn’t a control.
- Treating Conditional status as the finish line. The 180-day closeout clock is real, and the status expires if you miss it.
- Letting the score go stale. Your affirmation is annual, and ongoing compliance means updating SPRS when something material changes, not just on the anniversary.
- Posting a score nobody can support. If you can’t produce the evidence behind a MET, it isn’t one.
Not sure where you’d land? Start with an estimate. Our CMMC Level 2 Readiness Check takes about eight minutes, never asks about your CUI or system names, and returns an estimated SPRS score range and a readiness tier.
Start the CMMC Level 2 Readiness Check to see roughly where you stand. It’s an educational estimate, not an official assessment or a score to submit to SPRS.
FAQs
Can you self-assess CMMC Level 2?
Yes, if your contract requires Level 2 (Self). DoD allows Level 2 self-assessment for select programs and decides contract by contract; otherwise you need a C3PAO assessment. The solicitation tells you which applies.
How often do you have to do a CMMC self-assessment?
Level 1 every year. Level 2 every three years, with an affirmation after each assessment and again every year. If you have a Conditional Level 2 status, you must close out the POA&M with a closeout self-assessment within 180 days.
Who signs the CMMC affirmation?
A senior official of your company, called the affirming official. They’re affirming that the results are accurate and that the company meets the requirements, and each year after, its continued compliance, so they should understand the evidence behind the score and the False Claims Act exposure that comes with it.
Can I do the self-assessment with my own staff, or do I need outside help?
Either. You can perform a self-assessment with internal staff, and many contractors bring in outside help for scoping, documentation, or an independent review. The company and its affirming official remain responsible for the result either way
