Skip to content
Book Consultation
Book Consultation
CMMC Audit Readiness Compliance Strategy

CMMC Level 2 Self-Assessment: A Score You Can Defend

Travis Sands
Travis Sands

Short answer: With CMMC Phase 2 on hold, most defense contractors that handle CUI will meet Level 2 through a self-assessment and an annual affirmation in SPRS, for now. That makes the score you submit more important, not less. It is a signed statement to the government, and it has to match what an assessor would find.

Where does CMMC stand right now?

On July 13, 2026, the Department of War suspended CMMC Phase 2. Phase 2 would have made a C3PAO Level 2 certification the default condition of award for many contracts starting November 10, 2026. The same announcement set up a CMMC Reform Task Force with 60 days to review the program.

The task force's recommendations went to the DoW CIO around September 11. As of October 28, 2026, DoD has not published them and has not set a new Phase 2 date.

What did not change: Phase 1 self-assessment requirements, DFARS 252.204-7012 and NIST SP 800-171 still apply. Primes can also still require their own suppliers to get a C3PAO assessment.

Does self-assessment mean less scrutiny?

No. It moves the weight onto your own word. A Level 2 self-assessment covers the same 110 requirements of NIST SP 800-171 that a C3PAO would check. A senior official at your company then affirms the result in SPRS, and that affirmation is renewed every year.

If the score or the affirmation doesn't match reality, the risk is yours. A misstated cybersecurity claim to the government can create False Claims Act exposure. The Justice Department's Civil Cyber-Fraud Initiative, launched in 2021, uses the False Claims Act against contractors that knowingly misrepresent their cybersecurity practices. And when Phase 2 returns in whatever form, a C3PAO will compare what they find against what you reported.

How do you build a self-assessment you can defend?

  1. Scope first. Map where CUI is received, stored, processed and sent: email, file shares, engineering tools, laptops and every cloud service. A wrong boundary makes every score after it wrong.
  2. Update the System Security Plan. Describe how each requirement is met in your environment today, not how you plan to meet it.
  3. Score every requirement using the DoD Assessment Methodology. A requirement counts as met only when all of its assessment objectives are met.
  4. Collect evidence for each "met." Configuration exports, access review records, training logs, tickets. If you can't show it, don't score it as met.
  5. Put open items on a POA&M with owners and dates. Some requirements can't be left open, so check which ones before you count on a POA&M.
  6. Check your cloud services. Under DFARS 252.204-7012, a cloud service that stores CUI must meet FedRAMP Moderate or equivalent. Commercial Microsoft 365 usually doesn't.
  7. Brief the affirming official. The person who affirms should understand what they're signing, with the evidence organized so they can check it.

What do assessors look for first?

In our experience, findings rarely come from missing policies. They come from missing proof that a control operates: the last access review, MFA on every remote user, logs someone actually reviews, an incident response plan that has been tested. Our CMMC Evidence Starter Kit lists what to have ready.

What should you do this quarter?

  • Confirm which contracts carry a CMMC clause and which level they name.
  • Ask your primes whether they will require a C3PAO assessment regardless of the pause.
  • Refresh your SSP and score before your next affirmation date.
  • Close the open items a future C3PAO would find first.
  • Plan for Phase 2 to return in some form. Whatever the task force recommends, the requirements still come from NIST SP 800-171.

More on levels and how we help: CMMC readiness.

Common questions

Is CMMC cancelled?

No. Phase 2 is suspended while the task force review runs its course. Phase 1 self-assessment requirements still apply.

How often do we update our Level 2 self-assessment?

The self-assessment is valid for three years, with an affirmation every year. Update your score sooner if your environment changes in a significant way.

Who signs the affirmation?

A senior official at your company who is responsible for making sure the company meets the requirements. Not your MSP and not your consultant.

Does FirstCall submit our score?

No. Your company submits and affirms its own score. We help you prepare, build the documentation and check the evidence. Independent C3PAOs perform certification assessments.

See where you stand

Our free CMMC self-assessment walks through Level 1 or Level 2 and gives you a readiness picture you can take to leadership.

Our team is led by a Lead Certified CMMC Assessor who has worked on more than 30 C3PAO assessments.

Sources

Reviewed: October 28, 2026

Share this post

Keep reading