Self-Reported vs. DIBCAC Assessed Score: What Actually Differs — and Why the Gap Is Dangerous

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance

Last verified: July 16, 2026 · Evaluation depth: primary-source regulatory synthesis, current clause verification, and public DOJ settlement analysis

Evaluation depth: primary-source regulatory synthesis, current clause verification, and public DOJ settlement analysis

A self-reported vs DIBCAC assessed scoreruns on the same NIST SP 800-171 scoring methodology — but the two are not simply one assessment graded twice. A self-reported score is the number you calculate and submit yourself. A DIBCAC assessed score is a government-led assessment of the same requirements. What changes between them is who assesses, how deeply they verify, the confidence the government places in the result, which record takes precedence, and what happens next.

That last stretch is where a routine paperwork item quietly turns into a legal problem. Here’s the fast version, then the part almost every other page gets wrong.

Bottom line up front. If you posted a score to the Supplier Performance Risk System (SPRS) — the Department of Defense database where contractors report cybersecurity assessment scores — that number is a self-assessment. It’s a formal representation the government can hold you to, but it’s your own math. When the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) assesses you, DoD posts the result and that number takes precedence. You have 14 business daysto respond. The difference between those two numbers has already produced a $507,144 DOJ settlement — for a gap of 280 points.

Which record is which — the 15-second version

A quick word on picking help — and a safety line

The right CMMC provider isn’t the same for every contractor. The category you need — a C3PAO, an RPO/RP, an MSSP, a GRC platform, or a CUI enclave— depends on your level, scope, IT environment, and exactly which type of score problem you have. The categories are explained under What kind of help fits a score gap? below. The fastest way to map your situation to the right one is our routing tool.

One honest admission, up front.We can’t tell you whether yourspecific score is safe. No article can, and no online tool can — including ours. A reported 110 can be perfectly defensible, or it can be a low-confidence number that collapses under a government evidence review. What we cando is show you exactly which record you’re holding, why the two numbers diverge, what the government can do about it, and what to do next without making your situation worse.

Self-reported vs DIBCAC assessed score: what’s the difference?

The difference is who grades the assessment and how much the government trusts the result. A self-reported score is produced by the contractor using the DoD Assessment Methodology, its own System Security Plan, and its own read of its environment — a self-generated number that, under the legacy framework, carries “Low” confidence. A DIBCAC assessed score is a government-led Medium or High assessment. When both records exist for the same contractor, the government-conducted result takes precedence.

Under the codified NIST SP 800-171 DoD Assessment Methodology, there are three assessment types, and their entire purpose is to signal how much verification stands behind the number.

A version note: NIST has superseded SP 800-171 Rev. 2 with Rev. 3 for its general publication series, but CMMC Level 2 continues to incorporate Rev. 2unless DoD changes the governing rule or clause. Everything on this page uses Rev. 2 for that reason.

Which “self-reported score” do you actually have in 2026?

“Self-reported” now points to more than one record, and the difference matters. It can mean a legacy Basic NIST assessment under the former DFARS 252.204-7019/7020 framework, or a current CMMC Level 2 (Self) assessment under 32 CFR Part 170 and DFARS 252.204-7021. These are different objects with different obligations.

Effective February 1, 2026, class deviation 2026-O0025 directs contracting officers to use DFARS Part 240 — including DFARS 252.240-7997— for covered procurements. For covered procurements, this effectively drops the standalone 252.204-7019 provision, and the assessment mechanics from 252.204-7020 move into 252.240-7997. The codified text still exists in the eCFR and can remain relevant to historical records and existing contracts.

When a contract or solicitation includes DFARS 252.204-7021 and requires CMMC Level 2 (Self), 32 CFR 170.16 requires you to conduct the Level 2 self-assessment, submit the results to SPRS, and complete the annual affirmation of continuous compliance. Those obligations didn’t change.

Before you compare “your score” to “the DIBCAC score,” figure out which of these six records you’re actually looking at:

If you can’t say with certainty which row you’re in, that’s the first thing to fix. Read the actual procurement documents:

1. The solicitation provision— what does it require, and in which clause?
2. The awarded contract clause— 252.204-7012? 252.204-7021? 252.240-7997?
3. Any modification or deviation identifier— is this a Revolutionary FAR Overhaul contract?
4. The SPRS or CMMC record itself— what type, what date, whose name is on it?

For the broader contractual picture — how the 2026 deviation and CMMC clauses fit together — see our companion explainer on how current 252.240-7997 assessments differ from the older 7019/7020 framework.

Does a DIBCAC assessed score mean CMMC Level 3?

No. DIBCAC performs government Medium and High NIST SP 800-171 assessments andis the government assessor for CMMC Level 3 — but those are two separate jobs with different authorities, prerequisites, and outputs. A numerical Medium or High score does not become a CMMC Level 3 status just because DIBCAC produced it. Conflating the two is the single most common misconception on this topic.

DIBCAC wears two hats. Read the label to know which one you’re looking at:

The tell is in the words on the record. A government NIST assessment gives you a number and a confidence level. CMMC gives you a status— Level 1 (Self), Level 2 (Self), Level 2 (C3PAO), or Level 3 — and Levels 2 and 3 can be labeled Conditional or Final. Level 3 can’t even begin until a Final Level 2 (C3PAO) status is in place. So if your paperwork says “Medium Assessment, score of 62,” that is a government NIST assessment. It is not a certification, and it is not Level 3. Precision here isn’t pedantry — it changes who you call and what you’re actually obligated to do.

Can DIBCAC override your self-reported SPRS score — and is a clock running?

Yes on both counts. Under current DFARS 252.240-7997, when DCMA conducts a Medium or High assessment, that result takes precedence over other assessment results, and DoD posts it to SPRS. Before it’s posted, you get an opportunity to respond: a contractor has 14 business daysto provide additional information demonstrating a requirement the team didn’t observe, or to rebut findings in question. Follow the assessment notice for the operative dates and submission steps.

The precedence rule and the rebuttal window both come from the assessment clause and carry forward into the current deviation. DFARS 252.204-7020(e) — now relocated to 252.240-7997 — states that DoD offers “rebuttal and adjudication of assessment summary level scores prior to posting,” and that “upon completion of each assessment, the contractor has 14 business days to provide additional information… or to rebut the findings.” This is real, current, and time-sensitive — the rare deadline on this topic that isn’t manufactured.

Two precision points, because loose phrasing here causes real mistakes:

• Precedence is not deletion.When DCMA conducts the assessment, the government’s result becomes the authoritative number for contracting purposes. Whether SPRS visually overwrites, archives, or retains your earlier entry is a separate interface question. 32 CFR Part 170 gives a subsequent DCMA DIBCAC investigative result precedence over a conflicting pre-existing CMMC status.
• A CMMC C3PAO dispute is a different process. If your disagreement is with a C3PAO’s Level 2 assessment, that runs through a separate re-evaluation and appeals path under 32 CFR 170.17 — don’t assume the 14-business-day government window applies to it.

What does DoD post to SPRS after a Medium or High assessment?

The record is more than a number — it’s a small dossier. For a government Medium or High assessment, DFARS 252.240-7997 (carrying forward the 252.204-7020 posting fields) identifies the standard assessed, the organization that conducted it, the associated CAGE codes, the assessment date and level, the summary-level score, and the date all requirements are expected to be fully implemented based on the associated plan of action. Knowing exactly what’s in that record tells you what to reconstruct and defend.

If a government result just landed, don’t start rewriting your environment. Preserve the record and protect your rights first: the government notice, the resulting assessment report, your SPRS record, the solicitation and contract, your prior score submission, and the SSP and scoring workbook you originally used. A technical fix completed afterthe assessment date doesn’t answer whether the original finding was correct — and it can look worse, not better. For a full breakdown of the six distinct DoD review types and how to identify which one you’re in, see Can DoD audit my CMMC self-assessment?

Why do DIBCAC-assessed scores come back lower? (Where the points leak)

A lower government score does not automatically prove fraud. Verified scoring gaps usually come from requirements marked “met” without complete objective evidence, an incorrect scope, an SSP that doesn’t match the assessed environment, controls that were planned rather than implemented, or misapplication of the 1-, 3-, and 5-point methodology.

Start with the math. Under the DoD Assessment Methodology, you begin at 110 and subtract 5, 3, or 1 pointfor each of the 110 requirements you haven’t fully met. The weights track security impact — the most critical controls carry five points. Because the weights sum to more than 110, a handful of five-point gaps can push you negative. The floor is −203. That’s by design: you can’t game the score by knocking out cheap one-pointers while ignoring the controls that actually protect CUI.

The following are verified scoring mechanisms and defensible evidence-risk categories — not a claim about which findings are most common across the DIB:

• MFA half-credit. Multi-factor authentication (requirement 3.5.3) costs the full 5 pointsif it’s missing, but only 3if it covers remote and privileged users and not general users. A self-assessment can read “implemented” when only admins actually have it.
• FIPS-validated vs. FIPS-capable.Encryption protecting CUI must be FIPS-validated (requirement 3.13.11). If you encrypt but the module isn’t FIPS 140-validated, that’s 3 pointsoff; if you don’t encrypt where required, 5. “We encrypt” and “our module is validated” are not the same statement.
• Planned is not implemented.A requirement sitting on a Plan of Action and Milestones (POA&M) is still not metand still deducts its full point value. Aspirational controls don’t earn points.
• Template SSPs. A System Security Plan filled in from a generic template describes a generic company. The gap between that template and your real systems is exactly where over-credit hides.
• Shared-responsibility assumptions.Controls checked off as “handled by our cloud provider” without confirming the boundary. Inherited controls have to be verified, not assumed.
• Scope. If the assessed boundary leaves out a CUI repository, remote users, or a connected corporate service, the earlier score was measuring a smaller, friendlier environment than the one a government assessor will examine.
• No current SSP, no completed assessment. Under 32 CFR 170.24(c)(5), the absence of an up-to-date SSP results in a finding that the assessment could not be completed because of incomplete information and noncompliance with DFARS 252.204-7012 — not an automatic 110-point deduction.

A useful way to audit yourself before anyone else does

How big is the typical gap? We found no authoritative public dataset establishing a “typical” self-reported-to-government score gap as of July 16, 2026 — so we won’t hand you an invented average. The two public enforcement cases below are documented examples, not a benchmark.

What the LOGZONE and MORSECORP records show — and what they don’t prove

A large gap between a self-reported score and a later independent or government assessment can become part of a False Claims Act investigation when it’s paired with alleged or admitted contractual noncompliance and claims for payment. In June 2026, defense contractor LOGZONE agreed to pay $507,144 after DIBCAC assessed it at −170 against its self-reported 110. It followed MORSECORP’s $4.6 million settlement, where a self-reported 104 turned out to be −142. Neither record establishes that a numerical score gap alone creates liability.

We pulled both from the primary source — the DOJ press releases and settlement agreements — rather than law-firm summaries, and one column is doing real work here. Notice who found the gap, because it’s not the same story twice:

LOGZONEis the cleanest illustration of this exact query. The company posted a perfect 110 in October 2021. In an assessment dated February 2, 2024, DIBCAC scored its actual implementation at −170 — near the very bottom of the range. The settlement record identifies that 280-point difference and also describes broader alleged failures to implement required NIST SP 800-171 controls while submitting claims for payment on two Navy contracts. DOJ stated the settlement resolved allegations without a determination of liability. Notably, the published DOJ materials do not identify a relator or qui tam action — the government’s own assessment triggered the case, which is what makes it a warning even to contractors no whistleblower is watching.

MORSECORPadds the twist that should keep affirming officials up at night. MORSE self-reported 104 in January 2021. A third-party consultant told the company in July 2022 that the real number was −142. MORSE didn’t correct its SPRS entry until June 2023 — three months after the government served a subpoena. DOJ included that delayed update among the facts MORSE admitted. A former employee filed the qui tam complaint and received an $851,000 relator share.

Be clear-eyed about what these cases do — and don’t — establish. They show that dramatic, documented gaps between self-reported and independently assessed scores can anchor an expensive False Claims Act resolution when combined with alleged or admitted noncompliance. They do notprove that every 110 is inflated, that DIBCAC reduces scores by some predictable amount, or that a score gap alone caused either settlement. We say “the settlement record states,” not “the company was convicted.”

If your real worry is what your company represented— in a proposal, an award, an invoice, or an annual affirmation — that’s a legal question, not just a technical one. Read our companion piece on the difference between a contractor-entered and DIBCAC-assessed score, and what inaccurate SPRS representations can mean, and involve qualified counsel.

What did the July 13, 2026 CMMC Phase II suspension change?

It suspended the Phase II transition — not your safeguarding duties. On July 13, 2026, the Department of War suspended the CMMC Phase II transition and the designation of Level 2 (C3PAO) and Level 3 assessment requirements in procurement documents during a review. But self-assessments still stand, select government-led assessments may continue, DFARS 252.204-7012 is unchanged, and the Justice Department is still bringing False Claims Act cases. The suspension paused the scheduled third-party expansion. It did not pause DIBCAC or your liability.

Here’s the practical map, matched to the implementation direction:

The original schedule placed Phase I from November 10, 2025 through November 9, 2026 and Phase II at November 10, 2026; the July 13 action suspended that transition while keeping Phase I self-assessment requirements in place.

What the suspension does notmean: that NIST SP 800-171 stopped mattering, that the cyber clauses vanished, that an unsupported historical score is now safe, or that Phase II has a confirmed new start date. The review could lead to significant changes to the program, and officials have not committed to keeping it in its current form — but permanent amendments to codified 32 CFR or DFARS text require the applicable rulemaking process. Because this section is time-sensitive, verify the official program page before relying on it for a contract decision.

If anything, the suspension raises the stakes on the self-vs-DIBCAC question. With the third-party transition paused, contractor self-assessments and select government-led assessments remain directly relevant, and the suspension does not suspend the False Claims Act or erase the existing cybersecurity clauses.

What should you do if your self-reported score might not hold up?

Preserve the original record before you change anything, then figure out what kind of problem you actually have. Identify the exact clause, record type, date, CAGE scope, SSP version, and evidence behind the number. Then classify the mismatch — scope, documentation, scoring method, evidence, implementation, timing, or a legal representation issue — because that classification decides whether you need a readiness consultant, an implementation team, an evidence platform, or an attorney.

Work it in this order:

1. Freeze and preserve. Save the submitted score, the submission date, who submitted it, the CAGE scope, the SSP (name, version, date), the scoring workbook, the evidence index, and the relevant contract clauses and approvals. Never conceal, destroy, rewrite, or backdate anything.
2. Identify the record and authority. Use the six-record table above. A legacy Basic score and a CMMC Level 2 (Self) status are not the same object.
3. Reconstruct the score as of the assessment date. Separate what existed then, what was merely planned then, what you remediated later, and what you simply can’t substantiate.
4. Map every claimed requirement to evidence.For each control: who owns it, which system, the implementation statement, the test objective, the artifact that proves it, and the artifact’s date. A policy saying something should happen is not proof it did.
5. Classify the mismatch before correcting it (see the triage table below).
6. Separate remediation from legal response. A cybersecurity consultant can tell you whether controls and evidence support a score. That does not make them the right advisor on disclosure duties, privilege, or litigation risk tied to prior representations.
7. Make only supportable, traceable corrections. “Lower the number immediately” is not automatically right — the correct action depends on the record, the contract, any government notice, and possible legal implications.

The table below is The Defense Compliance Report’s editorial decision framework, based on the verified assessment-role and scoping rules above. It is not a regulatory classification, a provider ranking, or a compliance determination.

What kind of help fits a score gap?

Match the provider category to the problem, not the panic. Use an RP/RPO for scope, methodology, and readiness; an MSP/MSSP for technical implementation and ongoing operations; a GRC platform for evidence workflow; and a CUI-enclave specialist when architecture and scope isolation are the core issue.

• RP/RPO — when the problem is scope, methodology, or readiness. Best for reconstructing scope, reviewing the SSP and scoring logic, mapping evidence, and sequencing remediation. Not a substitute for a formal C3PAO assessment or for legal advice.
• MSP/MSSP — when the problem is implementation. Best for identity and access, endpoint management, logging and monitoring, configuration enforcement, and incident response. Verify genuine CUI-environment competence and a clear responsibility matrix before signing.
• GRC / evidence platform — when the problem is repeatability. Best for requirement ownership, evidence indexing, version history, and recurring collection. The honest limitation: software organizes unsupported claims just as efficiently as supported ones. Its value shows up after scope and control interpretation are sound.
• CUI enclave — when architecture drives the problem.A properly designed and documented enclave can reduce your CMMC assessment scope by isolating where CUI is processed, stored, and transmitted. It does not automatically place connected assets, security-protection assets, or external services out of scope — buying or naming an “enclave” isn’t the same as reducing scope.
• C3PAO — only when you’re ready for a formal Level 2 assessment. Not the default remediation category, and bound by independence rules. Under 32 CFR 170.8, a CMMC ecosystem member may not participate in your Level 2 certification assessment if it served as a consultant preparing your organization within the prior three years. Note, too, that new C3PAO designations are paused during the current review.
• Federal-contracts counsel — when prior representations are implicated. Bid representations, award-eligibility statements, invoices, certifications, affirmations, or a government inquiry all point here.

That routing logic has a name. The CMMC Path Frameworkmaps a contractor’s required CMMC level, FCI-versus-CUI handling, assessment type, IT and cloud environment, and contract timeline to the provider category most likely to fit. It routes to a category, not a named provider, and it is not a score, a ranking, or compliance advice. See the full explanation at CMMC provider categories.

What we actually verified

We built this page from primary sources and dated our work, because on a topic this consequential, that’s the difference between an authority and an aggregator.

Verified directly (July 16, 2026):

• The three assessment tiers, the “Low” confidence label for a contractor self-assessment, and the Medium/High evidence distinctions — DFARS 252.204-7020 and the DoD Assessment Methodology v1.2.1.
• The precedence rule “when conducted by DCMA,” the 14-business-dayrebuttal window, and the exact SPRS posting fields — DFARS 252.204-7020(e)/(d), carried into 252.240-7997.
• The February 1, 2026 posture: 252.204-7019 dropped for covered procurements, 252.204-7020 mechanics moved into 252.240-7997, codified text remains in the eCFR — class deviation 2026-O0025.
• The separate CMMC status paths, the eMASS posting path, and the Conditional 180-day POA&M window (Levels 2 and 3 only) — 32 CFR 170.16–170.18, 32 CFR 170.9, and DFARS 252.204-7021.
• The July 13, 2026 CMMC Phase II suspension and the implementation direction limiting current designations to Level 1 (Self) and Level 2 (Self).
• LOGZONE’s 110 self-report, its −170 DIBCAC assessment (Feb. 2, 2024), the $507,144 settlement, $253,572 restitution, and the no-determination-of-liability qualifier — DOJ.
• MORSECORP’s 104 self-report, −142 actual, $4.6M settlement, and $851,000 relator share — DOJ.

Deliberately not claimed:a “typical” DIBCAC score reduction; that every 110 is unsupported; that a negative score is an automatic disqualification; that a government result visually deletes an earlier SPRS entry; that a score gap alone caused either settlement; that a Medium or High result is CMMC Level 3; that Phase II has a confirmed new start date; or that any provider can guarantee a score or a certification outcome.

Frequently asked questions

Is a self-reported SPRS score "official"?

A contractor-entered score can be an official submission in SPRS, but "officially submitted" and "independently government-assessed" are different things. A legacy Basic self-assessment carries Low confidence because it is contractor-generated; a CMMC Level 2 (Self) submission is a separate CMMC status record with its own scope, affirmation, and recurrence rules. Don't apply the legacy Low-confidence label to a Level 2 (Self) status.

Can DIBCAC enter a different SPRS score than the one I posted?

Yes. When DCMA completes a Medium or High assessment, that result takes precedence and DoD posts it to SPRS. We won't overstate whether your earlier entry is deleted or archived — the point is that the government's higher-confidence number becomes the score of record for contracting purposes.

Is a DIBCAC Medium assessment the same as CMMC Level 3?

No. A Medium assessment is a government NIST SP 800-171 assessment with Medium confidence. CMMC Level 3 is a separate status path with its own prerequisites (a Final Level 2 C3PAO status first) and 24 selected NIST SP 800-172 requirements under 32 CFR 170.18.

Is a government High assessment always on-site?

Don't reduce it to a location label. A High assessment adds government verification, examination, and demonstration that controls are implemented as described — the logistics come from the notice and current authority, not a rule of thumb.

How long do I have to challenge a DIBCAC result?

14 business days after the assessment to submit additional information or rebut findings, under DFARS 252.204-7020(e), carried into 252.240-7997. A dispute with a C3PAO's Level 2 assessment is different: a NOT MET requirement can be re-evaluated during the assessment and for a short window afterward (10 business days) under 32 CFR 170.17, before the Assessment Findings Report is delivered — with appeals to the Accreditation Body beyond that. Don't mix the two timelines.

Did DFARS 252.240-7997 replace 252.204-7020 everywhere?

For covered procurements, class deviation 2026-O0025 directs contracting officers to use 252.240-7997 in place of the codified framework as of February 1, 2026. The codified 252.204-7020 text still exists in the eCFR and can remain relevant to historical records and existing contracts — so check your actual procurement documents.

Does a negative SPRS score automatically make us ineligible?

There's no universal rule. The effect depends on the solicitation, the contract, the applicable clauses, the responsibility and award decisions, and any required assessment status. A negative score is a serious signal, but eligibility is contract-specific.

We can't support our score — should we just lower it right now?

Preserve the original record and identify the governing procedure first. A technical correction, a contractual notice, a legal disclosure, a government rebuttal, and a CMMC affirmation are different actions. Where prior representations may carry legal significance, involve qualified counsel before you act.

What's the minimum score for CMMC Level 2 (Self)?

To be eligible for Conditional status with a POA&M, the score divided by the 110 Level 2 requirements must be at least 0.8 — 88 points — and the POA&M must satisfy the point-value and requirement-specific exclusions in 32 CFR 170.21(a)(2). A Conditional Level 2 status must then be closed out within 180 days.

Did the Phase II suspension eliminate CMMC or NIST SP 800-171 obligations?

No. Phase I self-assessments remain, select government-led assessments continue, and DFARS 252.204-7012 safeguarding duties are unchanged. The suspension paused the third-party transition, not the underlying requirements.

Can a GRC platform validate our score for us?

It can organize requirements, evidence, SSP content, POA&Ms, ownership, and version history. It cannot independently turn an unsupported implementation claim into a verified control, and it cannot issue an official SPRS or CMMC result.