CMMC Level 2 Assessment: Self vs C3PAO Paths

A CMMC Level 2 assessment is the check that an organization handling controlled unclassified information (CUI) for the Department of Defense meets every Level 2 security requirement. Which kind of assessment applies is set by the contract: some awards call for a Level 2 self-assessment, others for a certification assessment by an authorized or accredited CMMC Third-Party Assessment Organization (C3PAO). This guide sets the two tracks side by side, using the text of 32 CFR Part 170 as described on the eCFR on 2026-10-29 (version dated 2025-11-10).

What it is and who runs it

The assessment rules sit in Subpart D of 32 CFR Part 170, the Department of Defense rule that defines the CMMC Program. Section 170.16 covers the Level 2 self-assessment and section 170.17 covers the Level 2 certification assessment. Under both, the organization must achieve a MET result for every security requirement listed in section 170.14(c)(3), and both are performed against NIST SP 800-171 using the assessment procedures in NIST SP 800-171A (June 2018 edition, as the rule incorporates it).

The difference is who performs it:

Level 2 self-assessment: the organization itself conducts the assessment and submits the results in the Supplier Performance Risk System (SPRS).
Level 2 certification assessment: an authorized or accredited C3PAO performs it and submits the results into the CMMC instantiation of eMASS, which transmits them automatically to SPRS. The organization receives the final results in a CMMC Assessment Findings Report.

A Level 2 (C3PAO) status also satisfies the Level 1 (Self) and Level 2 (Self) requirements for the same assessment scope, and a Level 2 (Self) status satisfies Level 1 (Self) for the same scope.

Which track applies: Level 2 self-assessment or C3PAO certification

The contract decides. Before award of a contract or subcontract that carries a requirement for the CMMC status of Level 2 (Self), the organization must hold a Conditional or Final Level 2 (Self) status and must have submitted an affirmation of compliance into SPRS (section 170.16(b)). The parallel rule for a Level 2 (C3PAO) requirement is in section 170.17(b). For a university or research institute, that means reading the CMMC status requirement stated for each award or subaward rather than assuming one track for the whole institution. For how this plays out on a campus, including scoped enclaves, see CMMC compliance for universities and CMMC compliance for research institutions.

Level 2 self-assessment versus C3PAO assessment, side by side

Point	Level 2 (Self)	Level 2 (C3PAO)
Who assesses	The organization (section 170.16(c)(1))	An authorized or accredited C3PAO (section 170.17(c)(1))
Where results go	Entered in SPRS by the organization	Entered in eMASS by the C3PAO, then transmitted to SPRS
Renewal cycle	Self-assessment every three years, results submitted in SPRS	Certification assessment completed within three years of the status date
Affirmation	At the time of each assessment and annually thereafter	At the time of each assessment and annually thereafter
Evidence retention	Six years from the status date	Six years from the status date, with artifacts hashed using a NIST-approved algorithm
POA&M closeout	Closeout self-assessment by the organization	Closeout certification assessment by a C3PAO

What is assessed and how it is scored

Each security requirement is scored MET or NOT MET under the CMMC Scoring Methodology in section 170.24. The result is an overall score; the rule’s own example of an SPRS entry is a score of “105 out of 110”. A Final Level 2 status requires the passing score defined in section 170.24, which can be reached on the first assessment or after a POA&M closeout. For how the numeric score is built from the NIST SP 800-171 requirements, see SPRS score and NIST SP 800-171 self-assessment guide.

Scope matters as much as score. The assessment covers the systems inside the defined CMMC assessment scope. If CUI is processed, stored or transmitted in a cloud service, the cloud offering must be FedRAMP Authorized at the Moderate baseline (or higher) or meet security requirements equivalent to it, and the organization’s infrastructure connecting to that service is part of the assessment scope and is assessed too.

Steps in a Level 2 assessment

Define the CMMC assessment scope for the systems that handle CUI.
Document the requirements in a system security plan, including how any cloud or external service provider is used.
Assess each requirement against NIST SP 800-171A procedures and score it MET or NOT MET.
For the self track, enter the results in SPRS. For the certification track, the C3PAO performs the assessment, scores it and uploads the results to eMASS.
Submit the affirmation of compliance, which the rule requires for every Level 2 assessment (procedures are in section 170.22).
If a POA&M exists, remediate the NOT MET requirements and complete a closeout assessment on the same track.

On the certification track, a requirement scored NOT MET may be re-evaluated during the assessment and for 10 business days after the active assessment period, if additional evidence shows it is MET, doing so cannot change or limit the effectiveness of requirements already scored MET, and the Assessment Findings Report has not been delivered (section 170.17(c)(2)).

Conditional and Final status: scoring and POA&M rules

A Conditional Level 2 status is available only when the assessment produces a POA&M that meets every condition of section 170.21(a)(2):

The assessment score divided by the total number of Level 2 security requirements is at least 0.8. The rule states the ratio rather than a number; with 110 requirements, as the rule’s example score implies, that works out to 88 as simple arithmetic.
No requirement on the POA&M has a point value above 1 under section 170.24, with one exception: SC.L2-3.13.11 (CUI encryption) may be on a POA&M if encryption is used but is not FIPS-validated, which carries a point value of 3.
None of the six requirements listed below is on the POA&M.

The six requirements that can never sit on a Level 2 POA&M are:

AC.L2-3.1.20 External Connections (CUI Data)
AC.L2-3.1.22 Control Public Information (CUI Data)
CA.L2-3.12.4 System Security Plan
PE.L2-3.10.3 Escort Visitors (CUI Data)
PE.L2-3.10.4 Physical Access Logs (CUI Data)
PE.L2-3.10.5 Manage Physical Access (CUI Data)

A missing system security plan therefore cannot be deferred, and neither can the physical-access and external-connection controls.

Typical timeline phases

The rule fixes durations, not calendar dates, and the phases run in this order:

Initial assessment. Produces a Final status if the passing score is met, or a Conditional status if a permitted POA&M remains.
Closeout window. The POA&M must be closed out, with a closeout assessment confirming it, within 180 days of the Conditional status date. The rule’s text uses the status date, not the date of the SPRS submission.
Expiry. If the closeout does not happen in 180 days, the Conditional status expires. Where that falls within a contract’s period of performance, standard contractual remedies apply and the organization is ineligible for further awards requiring that status or higher until it achieves a new one.
Maintenance. A new assessment within three years of the status date, with annual affirmations in between.

The Department of Defense also reserves the right to conduct a DCMA DIBCAC assessment of an organization. If its results show the rule has not been met or maintained, they take precedence over any existing CMMC status.

Common mistakes

Putting a barred requirement on the POA&M. The six requirements above cannot be deferred, so a plan that relies on them cannot reach Conditional status.
Treating 0.8 as the only test. A score at or above the ratio still fails the Conditional route if a POA&M item carries more than one point and is not the FIPS-validated encryption exception.
Leaving out the affirmation. Contract eligibility requires both the status and the affirmation in SPRS.
Ignoring cloud and service-provider scope. The organization’s infrastructure that connects to a cloud service is part of the assessment scope.

Related programs: CMMC levels compared

Level and method	What the rule says
Level 1 (Self)	A POA&M is not permitted at any time (section 170.21(a)(1)). A Level 2 status of either type also satisfies Level 1 (Self) for the same scope.
Level 2 (Self)	Self-assessment, results in SPRS, repeated every three years (section 170.16).
Level 2 (C3PAO)	Certification assessment by a C3PAO, results via eMASS to SPRS (section 170.17).
Level 3 (DIBCAC)	Requires a Final Level 2 (C3PAO) status first (section 170.18); its Conditional status needs a 0.8 ratio and excludes seven named requirements from the POA&M (section 170.21(a)(3)).

For the underlying CUI protections, see NIST 800-171 and CUI in university research, and for ownership of the work, who is responsible for CUI compliance at a university.

FAQ

What is a CMMC Level 2 assessment?

It is the assessment of whether an organization meets all CMMC Level 2 security requirements for the systems that handle CUI. It is performed either by the organization (self-assessment) or by a C3PAO (certification assessment), as the contract requires.

What is a CMMC Level 2 self-assessment?

It is the assessment the organization conducts itself under 32 CFR 170.16, following NIST SP 800-171A procedures. Results go into SPRS, the assessment is repeated every three years, and an affirmation is required at each assessment and annually.

Can an organization pass with some requirements not met?

Only conditionally. It can reach Conditional Level 2 status with a permitted POA&M, then it has 180 days from the status date to close the POA&M out or the status expires.

Sources

32 CFR 170.16, Level 2 self-assessment and affirmation requirements: eCFR, checked 2026-10-29.
32 CFR 170.17, Level 2 certification assessment and affirmation requirements: eCFR, checked 2026-10-29.
32 CFR 170.21, Plan of Action and Milestones requirements: eCFR, checked 2026-10-29.
32 CFR 170.18, Level 3 certification assessment: eCFR, checked 2026-10-29.
32 CFR 170.24, CMMC Scoring Methodology: eCFR, checked 2026-10-29.

All rules above are stated as described on the eCFR on 2026-10-29. This guide is informational and is not legal advice or a substitute for the contract’s own CMMC clauses.

CMMC Level 2 Assessment: Self vs C3PAO, Scoring and POA&M Rules