CMMC Level 2 comes in two forms. In one, your own organization assesses its implementation of the NIST SP 800-171 requirements and posts the result. In the other, an authorized CMMC Third-Party Assessment Organization (a C3PAO) does the assessing and you receive a certification.
Teams often treat the self-assessment as the easy version. It is cheaper and faster to schedule, but the requirements, the scoring and the legal weight of what you sign are the same. This article sets out who chooses between the two, what is identical, what differs, and how to run a self-assessment that would survive a third party looking at it later.
If you need the overall structure of Levels 1, 2 and 3 first, start with CMMC levels, explained. This piece assumes you already know you are at Level 2.
Who decides which assessment you need
You do not. The Department of Defense sets the CMMC level and the assessment type in the solicitation, and the requirement then appears in the contract. The choice reflects the program office's view of the CUI involved, not your preference or your readiness.
That has two practical consequences:
Read every solicitation for the exact requirement. "CMMC Level 2 (Self)" and "CMMC Level 2 (C3PAO)" are different conditions of award. Holding the first does not satisfy the second.
Plan for the stricter one. Your current contracts may accept a self-assessment. A recompete or a new program may not. A C3PAO assessment takes months to schedule and prepare for, so a self-assessed status is a weak foundation if your pipeline includes higher-sensitivity work.
CMMC requirements are being phased into DoD contracts over several years under the program rule (32 CFR Part 170) and the DFARS acquisition rule. Which phase applies to a given contract is set by that contract, so confirm it there rather than from a general timeline.
What stays the same in both
Both forms of Level 2 assess the 110 security requirements of NIST SP 800-171 Revision 2, using the assessment objectives in NIST SP 800-171A. A requirement is MET only when every one of its objectives is met. Each requirement scores MET, NOT MET or NOT APPLICABLE, and the same point-based scoring method applies.
The scoping rules are also shared. You categorize assets the same way (CUI assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets), and you need a current System Security Plan in either case. The sister articles on scoping where CUI lives and the NIST 800-171 System Security Plan cover those foundations.
A final status lasts three years in both cases, and both require an annual affirmation from a senior official. Neither is a one-time event.
Where they differ
The difference is not the standard. It is who checks your work, how hard they check it, and where the result is recorded.
| Level 2 (Self) | Level 2 (C3PAO) | |
|---|---|---|
| Who assesses | Your organization | An authorized C3PAO with certified assessors |
| Evidence scrutiny | Whatever rigor you apply | Examine, interview and test against each objective |
| Where results go | You enter them in SPRS | The C3PAO submits them through the CMMC system, which feeds SPRS |
| What you receive | A self-assessed CMMC status | A certificate and a C3PAO-assessed status |
| Main cost | Internal time and any outside help | The assessment fee, plus internal time |
| Who can contradict you | DoD, if it later reviews your environment | The assessor, during the assessment |
The last row matters most. In a C3PAO assessment, a weak control surfaces as a NOT MET finding while you can still act on it. In a self-assessment, a weak control you scored as MET stays in place, inside a number you have affirmed to the government.
The evidence bar
A C3PAO assessor uses three methods from NIST SP 800-171A: examine (documents, configurations, records), interview (the people who run the control) and test (watch the mechanism work). They expect each objective to be supported by more than a policy statement.
Self-assessors are often generous with themselves on exactly the objectives assessors find hardest to satisfy: whether a requirement is applied to every in-scope asset, and whether a periodic activity actually happened at the stated interval. If you score yourself, score those objectives against records, not memory.
Conditional status and POA&Ms
Both forms allow a conditional status when some requirements are NOT MET, under the same limits:
Your score must reach at least 88 points out of the 110 maximum.
Only certain requirements may be carried on a POA&M. The rule excludes most of the higher-weighted requirements, so a gap in one of those blocks a conditional status entirely.
Every POA&M item must be closed within 180 days, confirmed by a closeout assessment of the same type.
If the items are not closed in time, the conditional status expires. That is not a grace period you can extend by updating a spreadsheet. Writing those items well is covered in writing a POA&M that assessors accept.
The affirmation carries the real weight
Every Level 2 status comes with an affirmation. A senior official, the Affirming Official, attests in SPRS that the organization has met and will maintain the requirements. This happens at initial assessment, after a POA&M closeout, and annually afterward.
The affirmation is what turns a self-assessment from an internal exercise into a representation to the government. Misrepresenting cybersecurity compliance on a federal contract can create exposure under the False Claims Act, and the Department of Justice has brought cases on that basis. How that applies to your situation is a question for counsel. The practical point is simpler: the person signing should be able to see the evidence behind the score, not only the score.
Your score also connects to the older NIST SP 800-171 assessment obligations in DFARS. If you need the mechanics of how points are calculated and posted, see the SPRS score, explained.
Running a self-assessment a C3PAO would recognize
If your contract allows a self-assessment, run it as though an assessor will read it later. Sometimes one will, and the next contract may require a C3PAO anyway.
Assess against objectives, not requirements. Work through each NIST SP 800-171A objective and record the evidence that satisfies it.
Separate the assessor from the implementer. The person who configured a control should not be the only person who scores it. Even a small team can swap reviewers between domains.
Record who assessed what, and when. Keep the assessor's notes with the artifacts, dated.
Capture evidence at the time. Exports, configuration snapshots and records produced during the assessment window, not reconstructed after.
Be honest about NOT MET. A lower, defensible score with a real POA&M is a better position than a higher score you cannot support.
Keep the package together. The SSP version, the scope description, the evidence and the score should be retrievable as one set for the full three-year period.
The cost difference between the two forms is real, but it is smaller than it first looks. Most of the cost of a C3PAO assessment is the internal work of getting ready, and a self-assessment done properly requires the same work.
How TrustLynce helps
TrustLynce maps the NIST SP 800-171 requirements to your controls and collects evidence on a schedule, timestamped and attributed, so a self-assessment rests on records captured at the time. Continuous monitoring routes failing controls to their owners between assessments, which keeps the annual affirmation grounded in current evidence. For framework coverage, see our CMMC page.