CMMC Level 2 Self-Assessment vs C3PAO Assessment: Which Path Your Contract Actually Requires

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. This page is editorial research, not legal, contractual, or compliance advice. We are not affiliated with the Department of Defense, the Cyber AB, NIST, DCMA DIBCAC, or any U.S. government agency.

The 60-second answer

Here is the part nobody on the vendor side leads with: most defense contractors do not actually get to pick between a CMMC Level 2 self-assessment and a C3PAO assessment. Your solicitation language under DFARS 252.204-7025 (the Notice of CMMC Level Requirements) and your contract clause under DFARS 252.204-7021 (Contractor Compliance With the CMMC Level Requirements) do the picking for you. The clause inserted at award is the answer.

Both Level 2 paths grade your environment against the same 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 control families and evaluated using the assessment procedures and objectives in NIST SP 800-171A. Same rulebook. The difference is who validates the result, where the result is recorded, and what your CMMC status legally means at award:

• Level 2 (Self)— your organization (the OSA) conducts the assessment, calculates the score, posts results in SPRS(the Supplier Performance Risk System), and submits the annual affirmation required by 32 CFR § 170.22.
• Level 2 (C3PAO) — an authorized or accredited C3PAO (CMMC Third-Party Assessor Organization), listed in the Cyber AB Marketplace, conducts the assessment using NIST SP 800-171A. The C3PAO uploads results into CMMC eMASS, which transmits the applicable data to SPRS. The result is a Conditional or Final Level 2 (C3PAO) CMMC Status associated with CMMC UID information for the covered information systems.

Last reviewed June 2026

In short: whether your CMMC Level 2 compliance can be self-assessed or must be verified by a C3PAO is determined by your contract, not by preference. The right route depends on the information you handle and your contract requirements. Use Find My CMMC Path to map your situation before requesting quotes or scheduling an assessment.

How rare is the self path? The Department of Defense’s own Regulatory Impact Analysis projects, by Year 4 of full implementation, 6,759 entities at Level 2 (Self) against 118,289 entities at Level 2 (Certificate) — about 94.6% of projected Level 2 populations on the C3PAO path, not on self-assessment. That figure is DCR’s calculation from DoD’s published RIA table in the Federal Register (DFARS Final Rule, September 10, 2025).

If you want to find yourself before reading further:

Who actually decides — and why it usually is not you

Answer capsule.Whether a CMMC Level 2 self-assessment is sufficient, or a Level 2 C3PAO assessment is required, is determined by the contract — not by the contractor. DFARS 252.204-7025 identifies the required CMMC status level in the solicitation prior to award. DFARS 252.204-7021 obligates the awardee to maintain that status (or higher) during performance for any information system that will process, store, or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

This is where most contractor confusion starts. The instinct is to ask “which path should we pick?” The regulatory reality is that you read the clause and execute against what it says. The DFARS Final Rule (DFARS Case 2019-D041) took effect November 10, 2025, and Phase 1 of the CMMC rollout began the same day.

Where to find the answer in your paperwork:

• DFARS 252.204-7025 (solicitation):the contracting officer inserts the required CMMC status level before award. Look for the inserted level — Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC).
• DFARS 252.204-7021 (contract): the awardee must maintain the inserted CMMC status (or higher) for any information system that processes, stores, or transmits FCI or CUI during performance.
• DFARS 252.204-7019 (legacy/codified solicitation provision):requires offerors to have a current NIST SP 800-171 DoD Assessment summary level score in SPRS — not more than three years old — for covered information systems. Present in legacy/codified solicitations; replaced by DFARS 252.240-7997 in solicitations issued under the 2026 RFO/Class Deviation.
• DFARS 252.204-7020 (legacy/codified contract clause): governs Government access rights for DoD Medium and High assessments and requires assessment results to be posted in SPRS. Present in legacy/codified contracts; the assessment-and-SPRS-posting function is carried by DFARS 252.240-7997 in contracts issued under the 2026 RFO/Class Deviation.

What to do before you spend a dollar on vendor work:

1. Locate the exact CMMC status inserted in your solicitation under DFARS 252.204-7025.
2. Confirm whether the inserted status is Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC).
3. If the language is silent or ambiguous, ask the contracting officer in writing and document the response.
4. If you are a subcontractor, request your prime’s required CMMC status and the flow-down level in writing — before subcontract award.

The legal test — which CUI triggers a C3PAO assessment

Answer capsule.Under the DoD CMMC Implementation Guidance Memo, CUI that falls under the National Archives CUI Registry’s Defense Organizational Index Groupingnormally drives the Level 2 Certification (C3PAO) path. But during Phase 1 of the rollout, the DoD CMMC Program FAQ and 32 CFR § 170.3(e) confirm that Level 2 (C3PAO) is not automatically required even for Defense-grouping CUI — DoD expects some Level 2 (Self) requirements during Phase 1 and program managers exercise discretion based on program risk and competition availability.

That test comes straight from the DoD memo Implementing the Cybersecurity Maturity Model Certification Program: Guidance for Determining Appropriate CMMC Compliance Assessment Levels and Process for Waiving CMMC Assessment Requirements(hosted at the DoD Procurement Toolbox), read against 32 CFR § 170.3(e) and the DoD CMMC Program FAQ.

The five Defense Organizational Index Grouping categories, plainly:

For most DIB suppliers, CTI is the trigger that decides this. If your contract sends drawings, specifications, or technical data for a defense item to you, you are inside the Defense Organizational Index Grouping.

The Phase 1 nuance that competitor pages keep missing.Even where the DoD memo would normally point to Level 2 (C3PAO), § 170.3(e)(1) lets DoD include Level 2 (C3PAO) during Phase 1 at its discretion — the DoD CMMC Program FAQ frames that discretion in terms of program risk and market research showing adequate competition. The practical effect: in Phase 1, you may see Level 2 (Self) inserted in some solicitations that involve Defense-grouping CUI. That does not mean the controls are different. The requirements are the same 110.

Two additional things worth flagging from the DoD memo:

1. Waivers for the Level 2 self-assessment requirement are unlikely to be granted. The memo treats Level 2 self-assessment as a permanent, non-waivable requirement when it applies.
2. Program managers have discretion to elevate. A program manager may insert Level 2 (C3PAO) when CUI risk warrants it; during Phase 1 the FAQ adds that the decision should be supported by market research showing adequate competition.

What both paths share — do not skim this

Answer capsule.A CMMC Level 2 self-assessment and a CMMC Level 2 C3PAO assessment use the same 110 security requirements drawn from NIST SP 800-171 Revision 2, organized into 14 control families and evaluated using the assessment procedures and objectives in NIST SP 800-171A. Both require annual affirmation by a senior Affirming Official under 32 CFR § 170.22. Both use the DoD scoring methodology in § 170.24. Both allow Plans of Action and Milestones (POA&Ms) only under the same restricted conditions.

This is the most common misunderstanding in the field: contractors hear “self-assessment” and assume the rules get easier. They do not. The control set is identical. Only the verification step changes.

The 14 control families, in NIST SP 800-171 Rev. 2 order:

1. Access Control (AC)
2. Awareness and Training (AT)
3. Audit and Accountability (AU)
4. Configuration Management (CM)
5. Identification and Authentication (IA)
6. Incident Response (IR)
7. Maintenance (MA)
8. Media Protection (MP)
9. Personnel Security (PS)
10. Physical Protection (PE)
11. Risk Assessment (RA)
12. Security Assessment (CA)
13. System and Communications Protection (SC)
14. System and Information Integrity (SI)

Same families on both paths. Same control catalog. Same SSP requirement. Same annual affirmation obligation. Same three-year validity for Final status. The only material differences are operational — and that is where we go next.

CMMC Level 2 self-assessment vs C3PAO: where the two paths actually diverge

Answer capsule. Level 2 (Self) is scored by the OSA and submitted to SPRS, producing a self-assessment CMMC status. Level 2 (C3PAO) is scored by Cyber AB authorized or accredited assessors using NIST SP 800-171A, uploaded into CMMC eMASS by the C3PAO, transmitted to SPRS, and produces a Conditional or Final Level 2 (C3PAO) CMMC Status associated with CMMC UID information for the covered information systems. Both have a three-year validity for Final status, with annual affirmation. The assessment-team composition, evidence rigor, re-evaluation rights, and provider independence rules differ materially.

The operational differences, side by side:

What actually goes into SPRS vs CMMC eMASS

This is the field-level distinction most pages skip:

A note on the C3PAO independence rule, because it is the one that catches well-meaning contractors. Some firms hold both RPO and C3PAO authorizations as a business entity. Under 32 CFR § 170.9 and the Cyber AB requirements grounded in ISO/IEC 17020, a C3PAO must not perform a Level 2 certification assessment for an OSC to which it has provided consulting, implementation, product sales, or services covering that assessment scope within the prior three years. Treat readiness support and the formal C3PAO assessment as separate vendor selections unless the C3PAO can document, in writing, exactly how it satisfies the independence requirement.

Phase 1 reality — what is actually being required right now

Answer capsule.The CMMC phased rollout schedule in 32 CFR § 170.3(e) sets Phase 1 from November 10, 2025 through November 9, 2026, focused primarily on Level 1 (Self) and Level 2 (Self) requirements as conditions of contract award, with DoD discretion to insert Level 2 (C3PAO) when warranted. Phase 2 begins November 10, 2026, when DoD intends to include Level 2 (C3PAO) requirements as a standard condition of award for applicable contracts. Phase 3 (Level 3 DIBCAC) begins November 10, 2027. Phase 4 (full implementation) begins November 10, 2028.

• Contracting officers are inserting CMMC clauses in new solicitations and contracts as conditions of award.
• Most Phase 1 insertions are Level 1 (Self) or Level 2 (Self), but Level 2 (C3PAO) is showing up at program-manager discretion for sensitive programs, exactly as § 170.3(e)(1) permits.
• Some primes are flowing down Level 2 (C3PAO) expectations to subs ahead of Phase 2, because their own program offices will tighten in late 2026 and they want a sub bench ready for re-competes. Subcontractors should confirm the exact flow-down language in writing before scoping or buying an assessment.

The Cyber AB Marketplace, per its public Town Hall recap data in early 2026, listed approximately 103 authorized C3PAOs and 759 CCAs serving a Defense Industrial Base of more than 300,000 contractors. Cumulative Level 2 certifications issued reached roughly 1,000by early 2026, with monthly issuance running approximately 150–200 in the same window.

Translation in plain language: scheduling a C3PAO assessment is not a same-week affair. In the public coverage and provider materials reviewed in early 2026, C3PAO scheduling windows were commonly quoted at 3–9 months out. If your contract window opens in late 2026 or 2027, the queue math matters now — not later.

Scoring, the 88-point threshold, and the six controls you cannot POA&M

Answer capsule.Both Level 2 paths use the DoD scoring methodology in 32 CFR § 170.24. Each NIST SP 800-171 requirement is worth 1, 3, or 5 points and scored subtractively from a maximum of 110. To achieve Conditional Level 2 status (Self or C3PAO), the assessment score must be at least 88 of 110 (80%), only 1-pointrequirements may appear on the POA&M with one narrow exception for SC.L2-3.13.11, and six specific requirements may never appear on a POA&Mregardless of point value. Conditional status converts to Final only if a POA&M closeout is confirmed within 180 days of the Conditional CMMC Status Date.

The six prohibited POA&M controls

These come directly from 32 CFR § 170.21(a)(2)(iii). Even if you score 109 of 110, if your single unmet requirement is one of these six, you do not get Conditional status — the assessment fails:

The SSP (CA.L2-3.12.4)is the most dangerous of the six to miss because it cannot be placed on a POA&M and must be in place and up to date at the time of assessment. An SSP that is “in progress,” “partially drafted,” or “being updated” at the time of the assessment is NOT MET per § 170.24(d)(5), and because the SSP is one of the six prohibited POA&M items, the assessment fails regardless of any other score.

The narrow exception.SC.L2-3.13.11 (FIPS-validated encryption of CUI) is worth 5 points. Per § 170.24, if encryption is employed but not FIPS-validated, 3 pointsare subtracted rather than 5, and the gap may be eligible for POA&M. If encryption is not employed at all, the full 5 points are subtracted and no POA&M is permitted. This is the rule’s one structural relief valve, and even it requires you to have some encryption in place.

POA&M closeout. If you achieve Conditional status, you have 180 daysfrom the Conditional CMMC Status Date to remediate the POA&M items and have closeout confirmed (§ 170.21(b)). On the C3PAO path, a POA&M closeout assessment must be performed by a C3PAO within that 180-day window. Miss the window and the Conditional status for the information system expires.

Artifact retention. Hashed assessment artifacts must be retained for six yearsfrom the CMMC Status Date (§ 170.17(c)(4)). On the C3PAO path, the C3PAO enters artifact names, hash values, and the hashing algorithm into CMMC eMASS. The clock starts at the assessment, not at award.

What it actually costs — Self vs C3PAO, by organization size

Answer capsule. The CMMC Program Final Rule estimated the Level 2 (C3PAO) three-year cycle at approximately $104,670 for a small entity and $117,768 for an other-than-small entity, covering the triennial assessment and two annual affirmations. Those figures are government burden estimates — and they explicitly exclude implementation, remediation, gap assessment, mock assessment, and pre-assessment consulting costs, because the DoD treats those as obligations already adjudicated under DFARS 252.204-7012. Independent market coverage from 2025–2026 commonly shows C3PAO assessment fees alone running roughly $30,000–$150,000 depending on organization size and scope, with the assessment fee representing a minority of total first-cycle compliance cost.

That distinction — what the DoD estimate covers vs what it excludes — is the single biggest reason small contractors experience cost shock. The $104,670 figure is real and is the official three-year burden estimate. It is not the total cost of getting your environment ready. Implementation and remediation usually dwarf the assessment line item.

The cost stack — shared by both paths, except line 6:

1. Scoping and CUI data flow analysis
2. Gap assessment against NIST SP 800-171A
3. SSP and supporting documentation
4. Remediation labor (the biggest variable)
5. Technology and tooling (cloud, enclave, MSSP, GRC, FIPS-validated modules)
6. Assessment fee — C3PAO path only; on Self, the equivalent is your team’s time
7. Annual affirmation and ongoing maintenance

Realistic cost bands, by organization size.DCR editorial budgeting estimates assembled from official DoD figures plus 2025–2026 market coverage in trade press and provider materials. Budgeting guidance, not quotes. Refreshed quarterly.

What competitor coverage usually misses on the cost side:

• The C3PAO fee is not the biggest line item. In the market coverage reviewed, the assessment fee was consistently one of the smaller cost categories. Preparation, remediation, technology, and ongoing operations consumed the larger share.
• Self-assessment is not free.Your time is the budget. A handwave self-assessment that ignores half the requirements does not reduce your legal exposure on the affirmation — it raises it.
• Hidden costs: assessor travel; re-assessment fees if a closeout fails; FIPS-validated module upgrades ahead of the September 21, 2026 transition; CUI enclave subscriptions; engineering hours to retire ad-hoc tooling.
• Allowability and pricing. CMMC cost allowability and how those costs are priced into proposals are contract-specific. Confirm with your contracts officer, accountant, or counsel before assuming costs can be recovered or priced into a proposal.

The Affirming Official — the personal liability nobody warns you about

Answer capsule.Under 32 CFR § 170.22, every CMMC assessment — Self or C3PAO — must be affirmed by a senior Affirming Official from within the OSA at the time of assessment and annually thereafter. The Affirming Official is the senior representative responsible for the OSA’s compliance with CMMC requirements and authorized to affirm continuing compliance. The affirmation is recorded in SPRS, is a federal submission, and is enforceable.

This is the section most competitor pages skip. § 170.22 is short and consequential. The Affirming Official:

• Must be a senior-level representative from within the OSA.
• Must be responsible for the organization’s CMMC compliance.
• Must have the authority to affirm continuing compliance with the specified security requirements.
• Signs the affirmation at the time of each assessment (Self or C3PAO, including POA&M closeout).
• Signs the annual affirmation thereafter.

The affirmation is recorded in SPRS. It is enforceable. And SPRS cybersecurity representations have already been the basis for notable civil False Claims Act enforcement.

Case in point: MORSECORP, $4.6 million

We are not citing MORSECORP to scare you. We are citing it because it is the cleanest, primary-sourced illustration on public record of why the cybersecurity representations a contractor makes to the Government carry weight. It is a major public False Claims Act resolution involving a defense contractor’s cybersecurity-control compliance, NIST SP 800-171 implementation, and SPRS score representations. The relator was an insider, not a regulator.

What this means operationally:

• The Self path has the same affirmation obligation as the C3PAO path. The difference is risk asymmetry: on the C3PAO path, an authorized assessor has reviewed your evidence. On the Self path, there is no C3PAO-reviewed certificate standing between the score and the affirmation.
• The Affirming Official needs the same evidence access whether you are Self or C3PAO. Build the evidence package for assessor-grade scrutiny either way.
• The affirmation is annual. The assessment is not the finish line.
• Document who the Affirming Official is, what they reviewed, and what was true on the date they signed.
• If you are the named Affirming Official and you do not believe the posture you are being asked to attest to, raise it with counsel before you sign.

Subcontractors and flow-down — what to ask your prime before you spend

Answer capsule.Under 32 CFR § 170.23 and DFARS 252.204-7021, primes are responsible for flowing CMMC requirements down to subcontractors at the level appropriate for the data the sub will handle. If a sub will only handle FCI, the prime may require Level 1 (Self). If a sub will handle CUI, the sub must hold at least Level 2 (Self or C3PAO) matching the prime’s obligation. If a prime holds a Level 3 (DIBCAC) obligation and is flowing CUI down to a sub, the sub must hold at least Level 2 (C3PAO).

If you are a sub, the worst thing you can do is guess. The second-worst is build to your prime’s marketing language instead of contract language.

Five questions to send your prime in writing before you sign anything:

1. What CMMC level is in the prime contract you hold with DoD? This sets the ceiling.
2. What CMMC status will you require from us at the flow-down — Level 2 (Self) or Level 2 (C3PAO)? Get the exact status named.
3. What CUI category will be flowed to us, and how will it be marked? CTI, NNPI, DCRIT, PSI, DCNI, or other.
4. What is your timeline expectation? Status required at subcontract award, at option exercise, or by a specific milestone.
5. What documentation will you accept as proof of status before subcontract award?

Ask in writing. Document responses. Keep them with the subcontract file. If a prime cannot answer these questions, they are not ready to flow the requirement down — and you are not in a position to scope your assessment.

How cloud, enclave, MSP/MSSP, and ESP choices change the picture

Answer capsule.Your cloud and managed-services choices do not change the CMMC level your contract requires, but they materially change scope, evidence, inheritance, cost, and timeline. 32 CFR Part 170 includes specific scoping categories and requirements for Cloud Service Providers (CSPs) and External Service Providers (ESPs) that process, store, or transmit CUI or security protection data — including FedRAMP Moderate (or equivalent) for in-scope CSP environments handling CUI under DFARS 252.204-7012.

Four common environment decisions, and what they actually do:

• Stay on-premises with a tightened CUI boundary. Maximum operational control; maximum implementation burden; the biggest documentation lift. Works for organizations with the in-house IT muscle to do it right.
• Move CUI to a compliant cloud environment— verified for the specific CUI use case (such as a FedRAMP Moderate or equivalent offering with the correct Customer Responsibility Matrix and CMMC scope documentation). Do not assume a product name alone makes the environment compliant; verify the exact package, configuration, and inheritance.
• Use a CUI enclave. A purpose-built compliant environment that boxes CUI into a small, scopable footprint. Often attractive for small DIB suppliers because it can reduce assessment scope dramatically.
• Rely on an MSP/MSSP for technical operations.Carefully. Your MSP can enter your assessment scope as an ESP if they handle CUI or security protection data on your behalf — and the rule has specific requirements for ESPs in scope.

CSPs that handle CUI in their environment must meet FedRAMP Moderate baseline or equivalent under DFARS 252.204-7012. ESPs handling CUI or security protection data must be documented in your SSP and reflected in your Customer Responsibility Matrix (CRM). An outsourced control is still your control under your CMMC status. The vendor does not carry your assessment.

Decide your environment before you book the C3PAO. CMMC scope must be specified before the assessment, and scope changes after contracting drive evidence rework, asset re-categorization, and re-assessment exposure.

Realistic timeline — from clause to Final status

Answer capsule. A typical CMMC Level 2 timeline runs 6–18 monthsfrom “we have a clause” to “we hold a Final status.” Scoping and gap analysis take roughly 2–4 months; remediation and documentation 3–9 months; C3PAO scheduling at current capacity 3–9 months; the formal C3PAO assessment 2–10 working days; and POA&M closeout, if Conditional, up to 180 days. A Level 2 self-assessment compresses the scheduling and closeout phases but does not compress the underlying remediation work.

Build your plan backward from the date you need the status — not forward from today. Two timing realities worth pricing in:

• C3PAO queue.With approximately 92–104 authorized C3PAOs (GAO: 92 as of December 2025; Cyber AB Town Hall data: ~103 as of March 2026) and ~750–760 CCAs in the Cyber AB Marketplace in early 2026, readiness — not C3PAO slot availability — is typically the binding constraint. C3PAO scheduling windows can run several months out; book early, but don’t compress remediation to chase a queue. Waiting until your prime asks for proof of status is not a viable plan.
• Phase 2 demand spike. Phase 2 begins November 10, 2026. The expected step-up in Level 2 (C3PAO) inserts at Phase 2 is the moment the queue tightens further. If your status need lands in late 2026 or 2027, the smart move is to scope, remediate, and book the assessment slot well before then.

The most expensive mistakes

Answer capsule.The four highest-cost mistakes contractors make on the CMMC Level 2 path are: (1) treating a self-assessment as if it has easier rules; (2) entering an assessment with an SSP that is incomplete — CA.L2-3.12.4 is one of the six prohibited POA&M items; (3) using encryption that is not FIPS-validated and losing 3 or 5 points on SC.L2-3.13.11; and (4) scoping the CUI boundary too broadly and dragging unnecessary systems into the assessment.

• The Self path has the same rules. Pretending otherwise creates affirmation risk.
• The SSP must be complete at assessment. Not “in progress.” Not “being updated.” Complete.
• FIPS validation is a discrete check — and the FIPS 140-2 historical transition date is September 21, 2026.
• Scope is the cheapest lever. A smaller, defensible CUI boundary almost always wins.
• Do not let the readiness/assessor independence rule sneak up on you. If a single firm has been advising you for nine months, the same firm is not your C3PAO for this engagement under the 3-year independence rule.

What to do in the next 48 hours

Answer capsule. Before contacting any vendor, complete six contract-side steps: locate the exact CMMC status inserted in your solicitation (look for DFARS 252.204-7025 and the inserted level), confirm the contract clause language (DFARS 252.204-7021), identify the CUI categories at play, map the systems that will process or store those categories, check your current SPRS score and affirmation status, and document any prime flow-down language in writing.

If a new solicitation or prime flow-down just triggered this question, this is the order of operations:

1. Copy the exact CMMC clause language out of your solicitation or contract. Do not paraphrase. The clause is the answer.
2. Identify the inserted status — Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 (DIBCAC).
3. Map the CUI categories that will be flowed to you. Especially CTI.
4. Inventory the systems that will process, store, or transmit that CUI.
5. Check your current SPRS posture — score, date, Affirming Official on file, any open POA&M.
6. Get the prime’s flow-down expectations in writing if you are a sub.

Then decide your provider category — not the specific provider, the category — based on where you actually are:

What we actually verified

For this guide, last verified May 27, 2026, the Defense Compliance Report editorial team read or re-checked:

• 32 CFR Part 170 — particularly §§ 170.3, 170.5, 170.9, 170.14, 170.16, 170.17, 170.19, 170.21, 170.22, 170.23, and 170.24 — on eCFR.
• DFARS Final Rule (DFARS Case 2019-D041) and clauses DFARS 252.204-7012, 252.204-7019, 252.204-7020, 252.204-7021, and 252.204-7025 at Acquisition.gov.
• The DoD Regulatory Impact Analysis table in the Federal Register (DFARS Final Rule, September 10, 2025). DCR ran the 94.6% Year-4 Level 2 (Self) vs Level 2 (Certificate) calculation from DoD’s published 6,759 / 118,289 figures.
• The DoD CMMC Implementation Guidance Memo on assessment-level determination, hosted at the DoD Procurement Toolbox.
• The DoD CMMC Program FAQ for Phase 1 discretionary language and the Defense Organizational Index Grouping nuance.
• The Cyber AB Marketplace and the public Cyber AB Town Hall recaps for current C3PAO, CCA, RPO, and CCP counts.
• NIST SP 800-171 Revision 2 (controls and families) and NIST SP 800-171A (assessment procedures and objectives) at NIST CSRC.
• The U.S. Department of Justice press release (March 26, 2025) and the U.S. Attorney’s Office for the District of Massachusetts release regarding the MORSECORP, Inc. $4.6 million civil False Claims Act settlement.
• The NIST CMVP transition schedule for FIPS 140-2 to FIPS 140-3, including the September 21, 2026 historical transition date for FIPS 140-2 certificates.

What we did not verify: specific C3PAO firm quotes (these are negotiated per engagement), private prime flow-down policies (these are contractual and confidential), and individual SPRS scores (these are private to each contractor).

How often we refresh this page: quarterly for Phase status, Cyber AB Marketplace numbers, and FIPS validation timeline; annually for cost data; ad hoc for any new DoD memo or Federal Register publication affecting Level 2 assessment.

Frequently asked questions

Which provider category fits your situation

• If your contract requires Level 2 (Self), you conduct the assessment yourself — a readiness consultant or Registered Provider Organization (RPO) / Registered Practitioner (RP) can help you scope, document, and prepare, but no third party is required to validate it.
• If your contract requires Level 2 (C3PAO), a C3PAO (CMMC Third-Party Assessor Organization) listed in the Cyber AB Marketplace conducts the official assessment — engage one once you’re assessment-ready.
• If you can’t operate the controls day to day, an MSP/MSSP (Managed Security Service Provider) or a GRC platform can run and evidence the controls either path needs.
• You don’t need a C3PAO yet ifyour award clause points to Level 2 (Self), or you’re not assessment-ready — confirm the DFARS 252.204-7021 clause inserted at award first.

The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. This page is editorial research, not legal, contractual, or compliance advice. We are not affiliated with the Department of Defense, the Cyber AB, NIST, DCMA DIBCAC, or any U.S. government agency. Sources cited inline; full primary-source list in “What we actually verified.”

Byline: The Defense Compliance Report Editorial Team. Last verified: May 27, 2026.