CMMC Level 2: Self-Assessment vs. C3PAO

The September 10, 2025 Defense Federal Acquisition Regulation Supplement (DFARS) final rule estimates that 35% of the defense industrial base, about 118,000 companies, will need a Cybersecurity Maturity Model Certification (CMMC) Level 2 certificate from a CMMC Third-Party Assessment Organization (C3PAO). Only 2% are expected to qualify for a Level 2 self-assessment.

The Department of War (DoW, formerly the Department of Defense) includes assessment types in solicitations, specifying the contractor's required assessment path. Planning around that designation helps a company account for a potential assessor queue and assessment engagement. Accurate scoping, evidence, and scoring support a defensible affirmation.

Key Takeaways

• Same control set. Both Level 2 paths require all 110 National Institute of Standards and Technology (NIST) SP 800-171 Rev2 requirements; only the verifier and the record differ.
• Solicitation sets the path. Controlled Unclassified Information (CUI) inside the Defense Organizational Index Grouping triggers a C3PAO requirement; self-assessment covers CUI outside it.
• Self-assessment requires direct accountability. A senior official signs the Supplier Performance Risk System (SPRS) affirmation, which should be supported by accurate scoring and records.
• Phase II suspension. On July 13, 2026, the DoW suspended CMMC Phase Two, including the mandatory C3PAO certification milestone. Phase 1 self-assessment remains live, while Phase 2, Phases 3 and 4, and all later milestones are in abeyance pending the CMMC Reform Task Force review. Title 32 of the Code of Federal Regulations (CFR) Part 170 remains in force, and DFARS 252.204-7012 remains in effect.

Both Paths Demand the Same 110 NIST SP 800-171 Controls

The CMMC rule ties Level 2 to NIST SP 800-171 Rev2, and the CMMC model documentation states that the Level 2 requirements match that publication: 110 security requirements across 14 families, all aimed at protecting CUI.

The Level 2 assessment guide covers the self-assessment and certification assessment in a single document because it uses a single requirement set. NIST withdrew Rev2 on May 14, 2024, but assessments under DFARS 252.204-7012 remain against NIST SP 800-171 Rev2 until Rev3 is adopted through future rulemaking. Rev3 had not been adopted by September 2026.

Both paths require multi-factor authentication for all users and validated encryption. They differ in who verifies compliance and what record that verification leaves behind.

Related: CMMC vs. NIST 800-171: The Practical Difference for Defense Contractors

The Contract Clause Specifies the Path, Not the Contractor's Preference

The 32 CFR Part 170 final rule states that the required Level 2 assessment type is "determined by the Department based upon the sensitivity of the CUI and will be identified in the solicitation." The contracting officer fills in a blank in DFARS 252.204-7021 with one value:

• CMMC Level 1 (Self)
• Level 2 (Self)
• Level 2 (C3PAO)
• Level 3 (DIBCAC)

The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) conducts the Level 3 assessment. The assessment type depends on the CMMC requirements specified in the contract and DoW implementation guidance.

Under the Office of the Secretary of Defense (OSD) CMMC Implementation Policy memo, Level 2 (Self) suffices only for CUI outside that grouping, and Level 2 (C3PAO) is the minimum when the contractor or its subcontractors will process, store, or transmit CUI inside it. Controlled Technical Information and Naval Nuclear Propulsion Information sit inside the grouping.

The Phase II suspension changed which values a contracting officer may currently enter; the framework stands. On July 13, 2026, the DoW suspended Phase II, which would have made C3PAO certification a condition of award beginning November 10, 2026, and opened a 60-day CMMC Reform Task Force review. Program managers may now designate only Level 1 (Self) or Level 2 (Self), and a September 2026 class deviation directs contracting officers to remove C3PAO requirements from active solicitations and contracts. 32 CFR Part 170 is unamended, and DFARS 252.204-7012 obligations continue.

Contractors operating under those current values therefore need to understand what a defensible Level 2 self-assessment requires.

A Level 2 Self-Assessment Requires Documented Evidence and a Signed Affirmation

A Level 2 (Self) assessment is a contractor-run evaluation of all 110 NIST SP 800-171 Rev2 requirements, scored against the DoD Assessment Methodology, documented in a System Security Plan (SSP), and affirmed in SPRS by a senior company official.

1. Scope the environment and map CUI flows. The Level 2 scoping guidance sorts assets into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, and Specialized Assets; cloud services touching CUI need FedRAMP Moderate authorization or equivalent.
2. Score all 110 requirements. Use the DoD Assessment Methodology v1.2.1; subtract 1, 3, or 5 points from 110 for unmet items, with partial credit only for MFA and FIPS 140-3 cryptography.
3. Document the SSP and any POA&M. The SSP requirement cannot enter a POA&M; POA&Ms require a score of at least 88, apply only to 1-point items plus the encryption exception, and expire after 180 days.
4. Submit the results to SPRS. Record the level, status date, overall score, and POA&M status, then repeat the assessment on the required recurring cycle.
5. Have the Affirming Official sign. A senior representative with authority over CMMC compliance provides the annual SPRS affirmation, which DFARS 252.204-7021 requires to be no older than one year.

The contractor owns every number it signs, and overstated scores have produced False Claims Act settlements. When the solicitation calls for independent verification instead, that same evidence base moves under a credentialed assessor's review.

A C3PAO Assessment Brings Credentialed Assessors and a Three-Year Certification

A Level 2 (C3PAO) certification assessment is an independent evaluation of all 110 requirements performed by a Cyber Accreditation Body (Cyber AB)-authorized third party, resulting in a certificate valid for three years and recorded in SPRS through the CMMC eMASS.

1. Select an authorized C3PAO. Choose from the Cyber AB directory; assessor conflict rules bar CMMC Certified Assessors (CCAs) who helped an organization prepare from assessing it.
2. Prepare the evidence package. The Lead CCA plans around the SSP, scoping documentation, and hashed artifacts, all subject to a six-year retention requirement from the CMMC Status Date.
3. Undergo the assessment. The team applies examine, interview, and test methods at the assessment-objective level; a single NOT MET objective fails the entire requirement.
4. Receive Conditional or Final status. The C3PAO uploads results to CMMC eMASS within 20 business days of the final findings briefing, with automatic transmission to SPRS; any C3PAO may perform the 180-day POA&M closeout.
5. Maintain the certificate for three years. Final Level 2 (C3PAO) status is valid for three years, with the Affirming Official submitting an annual SPRS affirmation.

An independent record does not replace the contractor's affirmation; it documents the basis for it. That distinction shapes how the two paths compare on cost, timeline, and where the liability ultimately rests.

Self-Assessment Costs Less Upfront but Shifts All Liability to the Contractor

Both paths require the same 110 controls, but they differ sharply in who verifies the work, how it is documented, and where accountability sits when a score is questioned. The comparison below lays out the practical trade-offs a contractor weighs when the clause allows a choice.

Self-assessment removes the assessor's invoice while leaving the 110 requirements, the SSP, and the remediation untouched, and it removes the independent check as well.

Many Contractors Pursue C3PAO Even When Self-Assessment Is Permitted

Suppliers report accelerating their assessment plans even where the clause reads Level 2 (Self), for reasons that have little to do with the clause.

• Documented evidence must support every reported score. MORSECORP reported 104 in SPRS in January 2021; a consultant later found the actual score was -142, and the company paid $4.6 million in March 2025.
• Self-assessment eligibility is narrow. Only CUI outside the Defense Organizational Index Grouping qualifies, which aligns with the DFARS rule's projection that 2% of contractors take the self-assessment path.
• Self-reported scores can diverge from validated results. LOGZONE reported 110 in October 2021; a February 2024 DIBCAC assessment produced -170.
• Primes flow down CMMC requirements. DFARS 252.204-7021 requires prime contractors to ensure applicable subcontractors hold the appropriate CMMC status and to include the clause in covered subcontracts.

These pressures push contractors toward evidence they can defend on the first request, and much of that evidence lives in the cloud layer beneath the CUI. When that layer sits inside an inherited, pre-authorized boundary, controls have already been validated against federal standards before the contractor opens an SSP, shortening the path to a defensible affirmation and any C3PAO review that follows.

Move the Cloud Layer Onto a Pre-Authorized Federal Boundary

The clause dictates who verifies the work, but the contractor sets the evidence standard. A cloud foundation that has already cleared federal review supports today's Level 2 (Self) affirmation and absorbs a future C3PAO requirement without a rebuild, which is where an inherited authorization boundary pays back.

Knox Systems helps SaaS vendors reach federal authorization in roughly 90 days at approximately 90% less cost than traditional paths. Vendors on the pre-authorized FedRAMP platform inherit 60% to 80% of the required NIST SP 800-53 Rev5 controls across FedRAMP Moderate, FedRAMP High, and DISA IL-4, with IL-5 targeted for December 2026.

Contractors ready to align their cloud layer with what their customers' assessors will check can book a demo to map the FedRAMP Moderate path.

FAQs about CMMC Level 2 Self-Assessment vs. C3PAO

Does FedRAMP Moderate Authorization Replace CMMC Level 2?

No. FedRAMP Moderate authorization or an equivalent is required for cloud services that process, store, or transmit CUI, but the contractor must still scope its environment, assess all 110 requirements, document its SSP, and affirm its CMMC status.

Does a Prime Contractor's CMMC Status Cover Its Subcontractors?

No. Prime contractors must ensure that applicable subcontractors hold the CMMC status required for their work and must include the applicable clause in covered subcontracts.

Can Every Unmet Requirement Be Placed on a POA&M?

No. POA&Ms are limited by the minimum score, point value, encryption exception, and excluded-practice rules. The SSP requirement and six named practices cannot be deferred through a POA&M.

Is a C3PAO Certificate Currently Mandatory for New Awards?

No. The Phase II suspension permits program managers to designate only Level 1 (Self) or Level 2 (Self), while 32 CFR Part 170 and DFARS 252.204-7012 obligations remain in effect.

‍