You can complete all 110 NIST SP 800-171 requirements and submit an SPRS score. You may still fail the CMMC requirement tied to your award. The costly mistake is treating maturity as a company choice. Contract terms decide the required assessment route.
A CMMC self-assessment is not just a checklist. Your DoD contract decides whether self-assessment is allowed or a C3PAO must assess you. For Level 2, map 110 requirements to scoped CUI systems. Keep objective evidence, record the required SPRS score, and secure senior-official affirmation.
Your DoD clause decides the assessment type
Your contract language decides whether self-assessment is acceptable. Company preference does not control this decision.
Many contractors assume any CUI handler can choose Level 2 Self. That assumption is incomplete. Under phased CMMC acquisition requirements, a DoD program office may require self-assessment or C3PAO assessment. The contract requirement controls that choice.
A contractor may complete all 110 controls yet fail an award condition. This happens when it chooses the wrong assessment route.
A current SPRS score may be necessary for a DoD award. It does not prove a contract-required Level 2 C3PAO assessment occurred. Read the clause first. Then choose the assessment method.
Read the clauses before the checklist
DFARS 252.204-7012 covers covered defense information safeguards and cyber incident reporting. DFARS 252.204-7019 and 252.204-7020 cover NIST SP 800-171 assessment information. They also address DoD assessment access.
The CMMC Program rule appears in 32 CFR Part 170. Acquisition requirements enter contracts through applicable DFARS clauses and solicitation language.
Compare the three assessment paths
| Contract data and requirement | Assessment path | Primary output | Independent assessor |
|---|
| FCI, when the contract requires Level 1 | CMMC Level 1 self-assessment | Annual self-assessment and affirmation | No |
| CUI, clause permits Level 2 Self | CMMC Level 2 self-assessment | Assessment record, evidence, SPRS entry where required, affirmation | No |
| CUI, clause requires certified Level 2 | CMMC Level 2 C3PAO assessment | CMMC certification status and required affirmation | Yes, authorized C3PAO |
Use a clause-first sequence before collecting evidence. First, identify the CMMC level and assessment type in the solicitation, award, modification, or subcontract flow-down. Check for the applicable CMMC clause, such as DFARS 252.204-7021 when included.
If the requirement states Level 1, use the annual Level 1 self-assessment route. If it states Level 2 Self, assess against all 110 NIST SP 800-171 requirements.
If it states Level 2 certification or names a C3PAO, schedule an authorized C3PAO assessment. Treat DFARS 252.204-7019 and 252.204-7020 as separate requirements. They may require assessment information and DoD access, but they do not convert self-assessment into C3PAO certification.
Several errors create avoidable award risk. A DFARS 252.204-7019 Basic Assessment score is not a Level 2 C3PAO assessment. A bidder can become ineligible if the award requires certification.
A Level 2 Self result also cannot transfer to a subcontract requiring a C3PAO. Another common error involves a broad enterprise SSP. The SSP may omit shared identity, logging, MSP, or cloud administration services protecting CUI.
That mismatch creates conflicts between the boundary and the evidence.
Submitting affirmation before validating evidence or remediation status creates risk. It can expose the senior official and company to unsupported representations. Results may include delayed award, failed option exercise, corrective action demands, or lost access to covered work.
An SPRS score is not a CMMC certification
An SPRS score records NIST SP 800-171 assessment information. It is not CMMC certification by itself.
The Supplier Performance Risk System gives DoD visibility into supplier assessment status. A score may reflect a Basic, Medium, or High Assessment. Those labels do not establish compliance with a later C3PAO-led Level 2 clause.
An SPRS entry normally records the assessment date, score, and related NIST SP 800-171 information. It must be accurate and current under applicable requirements. A supporting System Security Plan, or SSP, must explain each requirement.
A C3PAO is an authorized CMMC Third Party Assessment Organization in the Cyber AB ecosystem. The Cyber AB was previously called the CMMC Accreditation Body. A C3PAO conducts independent assessments when contracts require that route.
It evaluates applicable Level 2 practices and assessment objectives.
An old score helps only when its scope and evidence remain accurate. The next step is to define the CUI boundary correctly.
Map every CUI path before setting scope
Scope starts with CUI and FCI data flows. It does not start with servers owned by IT.
A defensible boundary identifies users, endpoints, identities, networks, SaaS tenants, and cloud workloads. It also identifies integrations, mobile devices, backups, administrative tools, MSP access, and subcontractors. Include shared security services that protect CUI systems.
Those services include identity and access management, EDR, centralized logging, and encryption key management. They also include vulnerability scanning and incident response.
The error most often found here is excluding shared services from scope. A shared identity tenant with CUI access is part of the assessment boundary.
Start with a data-flow interview
Run brief interviews with program management, engineering, contracts, IT, HR, security, and the MSP. Ask where CUI enters and which identities can access it. Ask which devices process it, how it is shared, and how it is deleted.
Document answers against actual workflows, not policy statements. Data-flow diagrams should show every CUI transfer and security dependency.
Include cloud, MSP, and remote access
Cloud services and managed providers belong in scope when they affect CUI systems. This includes processing, storage, transmission, administration, or security protection. Providers that materially affect CUI systems also belong in scope.
A provider that only invoices the company may be outside the boundary. A provider with tenant administration rights is not outside the boundary.
A complete data-flow map makes later evidence testing defensible. The next task is assigning proof to each required practice.
Build evidence for each CMMC practice
A complete assessment package maps each in-scope practice to an owner and artifact. It also records a test method, result, and evidence location.
NIST SP 800-171A gives assessment procedures and objectives for testing NIST SP 800-171 requirements. The National Institute of Standards and Technology publishes materials through its Computer Security Resource Center. Use these objectives to test existence, configuration, and operating evidence.
Policies alone do not prove control operation.
Assign evidence to accountable owners
Compliance leads should coordinate the evidence register. They should not own every artifact. IT and HR may own access reviews and termination records.
Security and program leadership may own incident exercises. Facilities and IT may own media controls.
- Access Control: MFA settings, privileged-account inventory, role maps, quarterly reviews, termination tickets, and authentication logs.
- Audit and Accountability: Log-source inventory, retention settings, alert records, time synchronization evidence, and sample investigations.
- Configuration Management: Baselines, approved change tickets, endpoint settings, remediation records, and exception approvals.
- Incident Response: Response plan, tabletop records, incident tickets, communication procedures, and lessons-learned actions.
- Recovery: Backup settings, restore test results, backup access limits, and records identifying protected CUI repositories.
Test the control, not the statement
Test MFA with current authentication logs and conditional-access settings. Test encryption with device-management settings and key controls. Test incident response with a dated exercise.
The exercise should record participants, decisions, communications, and corrective actions. A practical evidence matrix should list the practice identifier and system boundary. It should also list the owner, artifact link, objective, test date, result, and remediation status.
Preserve evidence in a controlled repository. Give the assessment team read access. Keep version history for disputed artifacts.
This evidence model supports an honest assessment result. It also determines whether open findings can be reported safely.
POA&Ms, SPRS, and affirmation need control
A Plan of Action and Milestones is a managed remediation record. It is not a universal exception.
The error most often found here is treating a POA&M as permission for every unfinished control. That approach creates contract risk. Permitted POA&M use depends on the assessment method and affected practice.
It also depends on current CMMC rules and contract terms.
Verify which gaps may remain open
Do not assume every Level 2 gap may remain open for 180 days. Do not assume any other fixed period applies. Confirm current program rules and contract language before recording an open item.
Some deficiencies may block the required outcome. Others may be unsuitable for deferred treatment because they weaken CUI protection.
Submit the right post-assessment record
SPRS updates should reflect the required assessment information and date. Keep the assessment package, score rationale, SSP version, evidence index, and approval record. The portal entry does not replace source material.
Closeout should follow a documented sequence. Finalize the assessment record, SSP version, evidence index, test results, and scope statement. Finalize any permitted POA&M before entering required information into SPRS.
Preserve the basis for every reported result. Include the assessment date and boundary. Later review may test whether the reported status still matches the CUI environment.
For a C3PAO assessment, address findings through the applicable CMMC process. Retain the resulting certification documentation. In either route, senior-official affirmation is a separate accountability step.
The affirming official should verify reported status, scope, and evidence. They must remain accurate at affirmation and each required annual renewal.
Controlled closeout limits unsupported contract representations. Budget planning then determines whether that work can finish before bid or award deadlines.
Budget Self-Assessment and C3PAO work separately
A Level 2 self-assessment has no universal fixed price. Discovery, remediation, evidence collection, and recurring operations drive most costs.
For a small, bounded CUI enclave, initial discovery and evidence work often takes 80 to 240 staff hours. A larger shared enterprise may require 300 to 900 hours before remediation starts. This is common when identity, SaaS, endpoints, and MSP access lack mapping.
Independent assessment prices also vary by scope, assessor availability, travel model, and evidence maturity. In the U.S. market, organizations commonly budget $25,000 to $70,000 for a Level 2 C3PAO assessment. That excludes remediation, internal labor, and recurring security tools.
Separate work into four cost lines
| Cost line | Typical scope driver | Budget owner |
|---|
| Internal assessment effort | Interviews, scope map, SSP, evidence register, testing | Security and program leadership |
| Remediation | MFA, endpoint management, logging, segmentation, backup testing | IT and security |
| Specialized support | Assessment preparation, architecture, SSP and evidence review | Compliance or contracts |
| C3PAO assessment | Required only when the clause calls for independent assessment | Executive sponsor |
Reduce scope without hiding systems
A zero trust architecture can reduce the assessment boundary. It requires enforceable segmentation, least privilege, managed endpoints, and central identity controls. NIST SP 800-207 describes zero trust as an architectural approach, not a product purchase.
This works in theory, but weak segmentation does not reduce scope. Assessors will follow administrative paths and security dependencies that reach CUI.
Before submitting a bid or signing a flow-down, request a contract-and-scope review. Confirm the clause, CUI boundary, evidence plan, and likely assessment route.
A self-assessment is not a compliance path when the applicable DoD clause requires a C3PAO CMMC assessment. A CMMC self-assessment also does not apply outside the Defense Industrial Base without contract-protected FCI or CUI. ISO 27001, SOC 2, and PCI DSS require different evidence, scope, and assessor rules.
Questions & answers
Can CMMC level 2 be self-assessed?
CMMC Level 2 may be self-assessed only when the applicable DoD contract permits Level 2 Self. If the solicitation or award requires a C3PAO, self-assessment and an SPRS score fail that requirement.
What does an SPRS score prove?
An SPRS score records NIST SP 800-171 assessment information. It does not prove CMMC certification. Keep the SSP, score rationale, evidence, assessment date, and scope records supporting the entry.
How long does a CMMC self-assessment take?
A bounded, mature enclave may need 3 to 7 business days for final evidence validation. Scope must already be stable. Discovery and remediation often take 4 to 16 weeks with SaaS, MSP access, or shared services.
Can a POA&M cover every missing control?
A POA&M cannot cover every missing CMMC practice or control deficiency. Permitted use depends on current rules, the assessment route, affected requirements, and DoD contract terms.
The contract check comes before the score
The defensible sequence is simple. Confirm the clause, map CUI and FCI, define the boundary, and test evidence. Manage permitted findings, submit required records, and affirm only supported results.
- The essentials: The contract clause determines whether self-assessment is valid, not company preference.
- The essentials: An SPRS score needs a current SSP, scoped evidence, and documented testing.
- The essentials: CUI scope includes data paths, identities, cloud services, MSP access, backups, and affecting security tools.
- The essentials: Budget internal preparation, remediation, specialist support, and C3PAO fees as separate cost lines.
Further reading
If you want to learn more about this topic, these sources may interest you:
