How the CMMC Level 2 Self-Assessment Works, From Score to Signature

For now, the Level 2 self-assessment is the Level 2 status that decides contract awards. Since a DFARS class deviation in July 2026, contracting officers can require only Level 1 or Level 2 self-assessments, in new solicitations and existing contracts alike (what the Phase 2 suspension changed). If your company handles CUI, "Level 2 (Self)" is the line on your SPRS record that matters.

It's easy to read "self-assessment" as the lighter option. The rule doesn't. It holds a Level 2 self-assessment to the same requirements, the same assessment objectives and the same scoring as a C3PAO certification. What changes is who does the checking.

Same test, different examiner

A Level 2 self-assessment must be conducted "in accordance with NIST SP 800-171A" and the CMMC scoping requirements, and "scored in accordance with the CMMC Scoring Methodology" (32 CFR § 170.16(c)(1)). The rule points self-assessors to the same CMMC Assessment Guide for Level 2 that C3PAO assessments use. NIST SP 800-171A breaks the 110 requirements into 320 assessment objectives, and every applicable objective has to be satisfied for a requirement to count as MET.

The difference is in the bottom row. Nobody outside your organization checks a self-assessment before it goes into SPRS. The rule's answer is a reserved right: DoD can have DCMA's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) assess you, and if it finds the requirements weren't met or maintained, its results "will take precedence over any pre-existing CMMC Status" (§ 170.16(a)(1)(iv)). The other check is the signature on the affirmation, which we come back to below.

How the score works

A Level 2 score starts at 110, one point for each requirement, and loses the value of every requirement scored NOT MET. Each requirement is worth 5, 3 or 1 points, depending on how much a gap could expose your network or CUI, and the subtraction "may result in a negative score" (§ 170.24(c)(2)). A few rules decide more than the arithmetic:

• Partial credit exists in two places only. Multifactor authentication for remote and privileged users but not everyone costs 3 points instead of 5 (IA.L2-3.5.3). Encryption that isn't FIPS-validated costs 3 instead of 5 (SC.L2-3.13.11). Every other requirement is all or nothing.
• Not applicable counts as met, when it genuinely doesn't apply. The rule's example is public-access system separation when nothing in scope is publicly accessible.
• A broken control with a fix under way can still be MET. A temporary deficiency "appropriately addressed in operational plans of action," with deficiency reviews and visible progress, is assessed as MET. So is an enduring exception described, with its mitigations, in your system security plan (§ 170.24(b)(1)).
• No SSP, no score. Without an up-to-date system security plan, the rule treats the assessment as one that "could not be completed due to incomplete information."
• Evidence has to be final. "Working papers, drafts, and unofficial or unapproved policies" don't count.

For the requirements that trip companies up most, see what DoD finds unmet most often. For what each objective's verb asks you to show, see Words Matter.

Three ways it can end

• 110 is Final Level 2 (Self).
• 88 to 109 can be Conditional Level 2 (Self), if every open item qualifies for a POA&M: each is worth 1 point (or is the 3-point case of encryption that isn't FIPS-validated), and none is one of the six requirements the rule bars from a POA&M (§ 170.21(a)(2)). You then have 180 days to fix the items, run a closeout self-assessment and post the result, or the Conditional status expires.
• Anything else is no status. A score under 88, or one open item that can't go on a POA&M, leaves you without a Level 2 (Self) status, and a contract that requires one can't be awarded to you until you have it (§ 170.16(b)).

What qualifies for a POA&M, item by item, is in our POA&M guide.

What goes into SPRS

The rule sets the minimum your SPRS entry carries (§ 170.16(a)(1)(i)):

The CMMC Status Date is the day you submit, and it doesn't move when a Conditional status becomes Final after closeout (§ 170.4). Your next Level 2 self-assessment is due within three years of it, a clock we lay out in the three-year Level 2 cycle. The entry steps themselves, from the PIEE role to handing the entry to your Affirming Official, are in the annual affirmation post.

Who signs, and what the signature says

The Affirming Official is "the senior level representative" responsible for your compliance with the CMMC program (§ 170.22(a)(1)). They affirm when the self-assessment is done, again after any POA&M closeout, and every year after the Final status date. The statement says your organization "has implemented and will maintain implementation of all applicable CMMC security requirements."

At a certification, a C3PAO's findings stand behind that sentence. At a self-assessment, nothing stands between your score and the government except your own work, so the signature carries all of it.

Who can do the work

A self-assessment means your organization owns the result, not that it has to work alone. Nothing in the rule stops you from bringing in help to scope the environment, gather evidence or score objectives. A review by someone who scores the way an assessor does, before your Affirming Official signs, is the simplest way to find a gap while there's still time to fix it.

One caution if you expect to need a C3PAO certification later: anyone who consulted on your preparation can't serve on your certification assessment team for three years (32 CFR § 170.8(b)(17)(ii)(G)). It's why the team that prepares you can't certify you.

Service providers come into scope too. A cloud offering that handles CUI has to be FedRAMP Authorized at Moderate or meet equivalent requirements. Any other external service provider's services are "assessed within the scope of the OSA's assessment against all Level 2 security requirements," and the provider's customer responsibility matrix belongs in your SSP (§ 170.16(c)(2)–(3)). Our MSP shared responsibility matrix shows what that looks like in practice.

If contracts start asking for a C3PAO again

A Level 2 (Self) status doesn't convert into Level 2 (C3PAO). They're separate statuses, and only a C3PAO assessment produces the second. But the rule treats the work as the same work: the same requirements, objectives, scoring and evidence. A self-assessment done to that standard is most of the preparation for a certification. One done loosely is a preview of its findings.

Sources: 32 CFR Part 170, §§ 170.4, 170.8(b)(17), 170.9(b)(13), 170.16, 170.17(a), 170.21, 170.22 and 170.24, and appendix A (CMMC Assessment Guide, Level 2); NIST SP 800-171 Revision 2 and SP 800-171A (June 2018); DFARS class deviation 2026-O0025, revision 2 (July 16, 2026).