CMMC Level 2: Requirements, Self-Assessment vs C3PAO, and Cost

Level 2 (Self) vs Level 2 (C3PAO), status checked October 24, 2026 on dodcio.defense.gov:

Who needs CMMC Level 2?

Any defense contractor or subcontractor that stores, processes or sends CUI on its systems needs CMMC Level 2; a company that only handles Federal Contract Information (FCI) needs Level 1. The requirement flows down to subcontractors at every tier that handle CUI, so a prime’s purchase order can carry it. The three levels, Level 1 and the overall program status are covered in our CMMC certification guide.

CMMC Level 2 requirements: the 110 controls in 14 families

CMMC Level 2 requirements are the 110 security requirements of NIST SP 800-171 Rev 2, grouped into 14 families, with 320 assessment objectives in DoD’s Level 2 Assessment Guide (our count). Each requirement passes only if all of its objectives are met.

The full text of each requirement is in NIST SP 800-171 Rev 2 and DoD’s Assessment Guide.

SPRS score and POA&M rules

A CMMC Level 2 score starts at 110 and loses 5, 3 or 1 points for each requirement not met, so it can fall below zero (32 CFR 170.24). The point value depends on how much damage a missing control could do: limiting system access to authorized users (AC.L2-3.1.1) is worth 5 points, tracing actions to individual users (AU.L2-3.3.2) is worth 3.

• Conditional status needs a score of at least 80% of the maximum, which is 88 out of 110.
• Open items go on a POA&M and must be closed within 180 days, then confirmed by a closeout assessment. Otherwise the Conditional status expires.
• Some items can never go on a POA&M: anything worth more than 1 point (except encryption that is in place but not FIPS-validated) and a named list that includes the system security plan (CA.L2-3.12.4) and visitor escort (PE.L2-3.10.3), per 32 CFR 170.21.

Level 2 self-assessment: how it works

A Level 2 self-assessment is your own check of all 110 requirements, scored with DoD’s method, entered in SPRS and affirmed by a senior official.

1. Define the assessment scope (see scoping below).
2. Assess each requirement against its objectives in the Level 2 Assessment Guide, using evidence in final form, not drafts; compliance software for CMMC can store it.
3. Score the result and enter it in SPRS.
4. Have the Affirming Official, a senior company representative, affirm compliance.
5. Close any POA&M items within 180 days, then affirm again every year.

The affirmation matters legally. Morgan Lewis, a law firm, warns that inaccurate self-assessments or unsupported affirmations can create False Claims Act exposure, and that the government may look harder at them while self-assessments are the main check.

C3PAO assessment: what it is and when it applies

A C3PAO (Certified Third-Party Assessment Organization) is an outside assessor authorized by The Cyber AB to run Level 2 certification assessments; as of October 24, 2026, DoD contracts may not require one. C3PAOs are listed on The Cyber AB’s CMMC Marketplace.

DoD’s July 2026 implementing memo goes further than pausing new requirements:

• Active solicitations that asked for Level 2 (C3PAO) must be amended to remove it.
• Existing contracts that carry it are to drop it at the next option period or administrative modification.
• No waivers will be granted during the review, and further guidance is due after the CIO’s 60-day review.

What a resumed C3PAO requirement would look like is unknown. DoD set up a CMMC Reform Task Force, and as of October 24, 2026 DoD CIO’s CMMC pages had not posted its findings.

How much CMMC Level 2 costs

DoD estimates a CMMC Level 2 self-assessment costs $34,277 for a small business and $43,403 for a larger one, against $101,752 and $112,345 for a C3PAO assessment. The figures come from the 32 CFR Part 170 regulatory impact analysis (89 FR 83182–83186) and cover only the assessment, affirmations and the assessor’s fee.

DoD’s estimates leave out the cost of meeting the requirements, because NIST SP 800-171 has been a contract requirement since 2017. If you have gaps, budget for that work separately.

Scoping: CUI assets, enclaves and cloud

Scoping decides which systems a CMMC Level 2 assessment covers, and a smaller scope means less to assess. 32 CFR 170.19 sorts assets into five groups:

• CUI assets: systems that store, process or send CUI.
• Security protection assets: tools that protect them, such as a firewall, data loss prevention software or a managed security service.
• Contractor risk managed assets: assets that can, but aren’t meant to, touch CUI.
• Specialized assets: government-furnished equipment, IoT, operational technology, restricted systems and test equipment.
• Out-of-scope assets: systems that can’t touch CUI.

DoD’s Assessment Guide lets a company be assessed on its whole network or on a separate enclave. Cloud services that hold CUI must meet the FedRAMP Moderate baseline or its equivalent under DFARS 252.204-7012.

What to do while C3PAO assessments are paused

Keep meeting NIST SP 800-171 Rev 2 and keep your SPRS entry current, because the self-assessment and DFARS 252.204-7012 still apply.

• Re-score after major system changes and affirm on time every year.
• Keep the system security plan and POA&M in final form.
• Check the DoD CIO CMMC page for the Task Force outcome before you sign a C3PAO.