Short answer: A CMMC self-assessment is your own evaluation of your environment against the CMMC requirements, using the assessment objectives in NIST SP 800-171A. You score it with the CMMC scoring methodology, enter the results in SPRS, and a senior Affirming Official affirms compliance. Level 1 is assessed every year (15 requirements, all must be met, no POA&M). Level 2 self-assessments happen every three years (110 requirements), with annual affirmations in between. An inaccurate self-assessment or affirmation is a legal risk, so “self” doesn’t mean informal.
Level 1 vs. Level 2 self-assessment at a glance
| Level 1 self-assessment | Level 2 self-assessment | |
|---|---|---|
| Protects | Federal Contract Information (FCI) | Controlled Unclassified Information (CUI) |
| Requirements | 15 (FAR 52.204-21) | 110 (NIST SP 800-171 Rev. 2) |
| Method | NIST SP 800-171A objectives for the mapped requirements | NIST SP 800-171A objectives for all 110 requirements |
| Result | MET or NOT MET; every requirement must be met | Score out of 110 |
| POA&M allowed? | No | Yes, with limits (see below) |
| How often | Every year | Every three years |
| Affirmation | At each assessment (annually) | At each assessment, after POA&M closeout, and annually |
| Keep evidence | 6 years | 6 years |
Not sure which level applies? See CMMC Level 1 vs. Level 2.
Step 1: Define your assessment scope
Before you assess anything, decide which systems, people, facilities, and service providers handle FCI or CUI. That’s your CMMC Assessment Scope (32 CFR 170.19). For Level 2, categorize every asset (CUI assets, security protection assets, contractor risk managed assets, specialized assets, out of scope) and record them in your asset inventory, SSP, and network diagram. A smaller scope, sometimes an enclave, means less to assess.
Step 2: Assess each requirement against its objectives
Each requirement has several assessment objectives in NIST SP 800-171A. A requirement is MET only if every applicable objective is satisfied, based on evidence. Use the three methods assessors use:
- Examine documents, configurations, and records.
- Interview the people who perform the activity.
- Test that the control actually works.
Rules that trip people up (32 CFR 170.24):
- Evidence must be final. Drafts, working papers, and unapproved policies don’t count.
- Not applicable counts as met, but be ready to justify it (for example, no publicly accessible systems in scope).
- Partial credit is rare. It applies only in limited cases, such as multi-factor authentication.
- Exceptions must be documented. An enduring exception described in your SSP, or a temporary deficiency managed in an operational plan of action, can be assessed as met.
Step 3: Score it
Level 1: all 15 requirements must be MET. There’s no partial result.
Level 2: start at 110 and subtract each NOT MET requirement’s value: 5, 3, or 1 point, depending on how much risk the gap creates. The score can go as low as −203. For a deeper walkthrough, see what an SPRS score is and how to calculate it.
Step 4: Handle gaps with a POA&M (Level 2 only)
You can reach Conditional Level 2 (Self) status with open items, but only if all of these are true (32 CFR 170.21):
- Your score is at least 80% of 110 (88 points).
- Every requirement on the POA&M is worth 1 point. The one exception is encryption that isn’t FIPS-validated (SC.L2-3.13.11).
- None of these are on the POA&M: external connections (3.1.20), control of public information (3.1.22), the System Security Plan (3.12.4), or the physical access requirements for escorting visitors, access logs, and managing physical access devices (3.10.3–3.10.5).
You then have 180 days to fix the items, perform a POA&M closeout self-assessment, and post the results in SPRS. If you miss that window, the conditional status expires. See our SSP and POA&M service.
Step 5: Enter results in SPRS
At minimum, the SPRS entry includes:
| Field | Level 1 | Level 2 |
|---|---|---|
| CMMC level | ✓ | ✓ |
| CMMC status date | ✓ | ✓ |
| Assessment scope | ✓ | ✓ |
| All CAGE codes for systems in scope | ✓ | ✓ |
| Result | Compliance result | Score (e.g., 105 of 110) |
| POA&M usage and status | — | If applicable |
Step 6: Submit the affirmation
The Affirming Official is a senior representative who is responsible for CMMC compliance and has authority to affirm for the company. The affirmation, entered in SPRS, includes their name, title, and contact information, and states that the company has implemented and will maintain all applicable requirements for everything in scope.
Affirmations are required:
- When you achieve a conditional status (Level 2 with a POA&M)
- When you achieve a final status
- After a POA&M closeout assessment
- Every year after that
An affirmation is a statement to the government about your ongoing compliance. Before signing, the Affirming Official should confirm that controls are still operating, not just that they once passed.
Step 7: Keep it current
- Retain evidence for six years from the CMMC status date.
- Reassess on schedule: Level 1 every year, Level 2 every three years.
- Reassess when things change: a new system, cloud service, office, or CUI workflow can change your score.
- Expect verification. DoD can conduct a DCMA DIBCAC assessment (under DFARS 252.240-7997 in new contracts, or 252.204-7020 in older ones), and those results take precedence over your self-assessed status.
Does the Phase II suspension affect self-assessments?
No. Phase I, covering Level 1 and Level 2 self-assessments and affirmations where contracts require them, remains in effect. The July 2026 suspension paused Phase II’s move to mandatory C3PAO certification. See what the Phase II suspension means.
Frequently Asked Questions
Can we do a CMMC self-assessment ourselves?
Yes. The rule calls it a self-assessment because your organization performs it. Many small contractors bring in outside help to prepare and to check objectives they might score too generously. DoD’s own cost estimates assume small businesses will use an outside provider.
How often do we need to affirm CMMC compliance?
At each assessment, after any POA&M closeout, and annually after that. For Level 1, the self-assessment itself is also annual.
What happens if our self-assessment score is wrong?
An inaccurate score or affirmation can create contractual consequences and False Claims Act exposure. If a DIBCAC assessment finds you’re not compliant, its results override your self-assessed status, and you can become ineligible for new awards that require that level until you achieve a new status.
Is a CMMC self-assessment the same as an SPRS score?
They’re closely related. The NIST SP 800-171 Basic assessment required by DFARS 252.204-7019/7020 (still found in older contracts) and the CMMC Level 2 self-assessment both use 110-point scoring and are entered in SPRS. CMMC adds requirements of its own: scope, CAGE codes, POA&M limits, and affirmations. See what an SPRS score is.
How USCIBER can help
A self-assessment you’re comfortable affirming starts with an honest, evidence-based baseline. USCIBER’s CMMC Readiness Review (from $7,500) walks your environment through the NIST SP 800-171A objectives, calculates your real score, flags POA&M-ineligible gaps, and gives you a prioritized plan. Our Compliance Documentation Project produces the SSP, POA&M, and policies that serve as your evidence. USCIBER is a readiness consultant. We are not a C3PAO and do not issue certifications. Learn more on our CMMC consulting page.
Sources
- eCFR — 32 CFR Part 170, CMMC Program: § 170.15 (Level 1 self-assessment), § 170.16 (Level 2 self-assessment), § 170.19 (scoping), § 170.21 (POA&M), § 170.22 (affirmation), § 170.24 (scoring)
- NIST — SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information
- Federal Register — CMMC Program final rule, 89 FR 83092 (October 15, 2024)
- DoD CIO — CMMC
This article is general information, not legal advice.