For most defense contractors the self-assessment is not a rehearsal. It is the assessment. Level 1 has always been self-assessed, many Level 2 contracts allow a self-assessment instead of third-party certification, and with third-party assessments currently suspended, the score you post in SPRS is the main thing the government and your primes see.
That makes the self-assessment a representation, signed by a senior official, that can carry False Claims Act exposure if it is wrong. This guide sets out how to run one that holds up.
Who self-assesses, and how often
| Situation | What you do | How often |
|---|---|---|
| You handle FCI only (Level 1) | Self-assess all 17 practices, enter the result in SPRS, and have a senior official affirm compliance | Every year |
| You handle CUI and the contract allows Level 2 (Self) | Self-assess all 110 requirements against the 320 objectives, post the score in SPRS, and affirm | Assessment every three years, affirmation every year |
| You handle CUI under DFARS 252.204-7012 and 7019 | Post a current NIST SP 800-171 Basic Assessment score in SPRS | At least every three years, and whenever the environment changes materially |
If you are not sure which row applies, check the clauses in your contracts first. The clause-by-clause test and FCI vs CUI settle it.
Step 1: Fix the scope
Every score describes a boundary. List the people, systems, facilities and external services that process, store or transmit FCI or CUI, plus the security tools that protect them. Anything outside that list is out of scope only if you can show that controlled information never reaches it.
Narrow scope is the single biggest lever on cost and effort. Finding CUI in your environment shows how to trace it, and an enclave can keep it in a small, defensible space.
Step 2: Score every requirement at objective level
Work through each requirement using the official CMMC assessment guide for your level. For each objective, decide whether it is met and note the evidence: a configuration screenshot, an access list, a training record, a log extract. If you cannot point to evidence, treat the objective as not met.
At Level 1 there is no score. Every one of the 17 practices must be met before you affirm, and no POA&M is allowed. The detail is on the CMMC Level 1 page.
At Level 2 the result is a number from 110 down to -203, using the 5, 3 and 1 point weights of the DoD Assessment Methodology. The free SPRS score calculator applies the weights and the partial-credit rules for 3.5.3 and 3.13.11.
Step 3: Document what you found
- A System Security Plan that describes how each requirement is implemented in your environment, not a restatement of the requirement. Without an SSP the assessment is void. Start from the free SSP template.
- A POA&M for every requirement that is not yet met, with an owner and a date. Only eligible gaps may be deferred. See the POA&M template.
- An evidence folder organized by requirement, so the score can be defended later by someone other than the person who produced it.
Step 4: Post the result in SPRS
The score is entered in the Supplier Performance Risk System with the standard assessed against, the assessment date, the scope it covers, and the date by which you expect to reach 110. Primes can see whether a supplier has a current assessment, and under DFARS 252.204-7020 they cannot award work requiring NIST SP 800-171 to a supplier without one. How the score is built is explained on the SPRS score page.
Step 5: Affirm, and keep it true
A senior official affirms that the organization meets, and will continue to meet, the requirements assessed. The affirmation is repeated annually and should be revisited whenever the environment changes: a new cloud service, a new site, a new MSP, or a merger.
A score that was accurate when it was posted and has since stopped being accurate is the situation False Claims Act cases are built on. Ongoing monitoring is what keeps the affirmation honest, which is what CMMC managed services are for.
Common self-assessment mistakes
- Scoring at requirement level and missing an objective that would have made it NOT MET.
- Counting a policy as implementation when the control is not actually configured.
- Leaving security tools, MSP access or cloud services out of scope.
- Treating encryption as FIPS-validated because the algorithm is strong, rather than checking for a validated module.
- Posting a score once and never revisiting it.
If you want a second opinion before you affirm, a CMMC gap assessment scores the same requirements independently and shows where your own score was optimistic.
Frequently asked questions
Can I self-assess for CMMC Level 2?
Yes, where the contract calls for Level 2 (Self) rather than Level 2 certification. You assess all 110 requirements, post the score in SPRS, reassess every three years and affirm annually.
Is there a free CMMC self-assessment tool?
This site provides a free SPRS score calculator, a readiness checklist, an SSP template and a POA&M template, all ungated. Together they cover scoring, documentation and tracking for a self-assessment.
Who signs the CMMC affirmation?
A senior official of the company who is responsible for ensuring compliance. The affirmation is a representation to the government, so it should only be made once the self-assessment is supported by evidence.
What is the difference between a self-assessment and a C3PAO assessment?
Both use the same requirements and the same assessment guide. In a self-assessment the contractor does the scoring and affirms it. In a certification assessment an authorized C3PAO examines, interviews and tests, and issues the result.