CMMC Self-Assessment vs. Third-Party Assessment

What CMMC Actually Requires at Each Level

CMMC 2.0 has three levels, and each one comes with a different assessment requirement. The level assigned to your contract depends on the type of controlled information your organization handles.

Level 1: Annual Self-Assessment

Level 1 covers the 17 foundational cybersecurity practices from FAR 52.204-21 and is designed for contractors that handle Federal Contract Information (FCI). At this level, you’re required to conduct an annual CMMC self-assessment, document your results, and have a senior company official affirm the accuracy of that submission in the Supplier Performance Risk System (SPRS). It’s the most accessible path, but “accessible” doesn’t mean informal. You still need documented evidence that your practices are actually in place.

Level 2: Where It Gets More Complex

Level 2 aligns with NIST 800-171 and covers 110 security practices for organizations that handle Controlled Unclassified Information (CUI). This is where most contractors get tripped up. Some Level 2 contracts allow self-attestation, but contracts involving critical national security information require a third-party assessment conducted by a Certified Third-Party Assessment Organization, known as a C3PAO. Your contracting officer’s requirements documentation will specify which applies to your program. If it’s not clear, assume you need a C3PAO and verify before acting otherwise.

Level 3: Government-Led Assessment

Level 3 is reserved for the most sensitive programs and requires a formal government-led assessment conducted by the Defense Contract Management Agency (DCMA). If your contract requires Level 3, a self-assessment isn’t on the table.

What a CMMC Self-Assessment Actually Involves

A self-assessment sounds straightforward, but contractors often underestimate what a credible one requires. Submitting a score to SPRS without the documentation to back it up is a serious risk, not a shortcut.

Your System Security Plan Is the Foundation

Before you score a single control, you need a complete and current System Security Plan (SSP). The SSP documents how your organization meets each of the required NIST 800-171 controls, what systems are in scope, and how your security practices actually function day to day. Without a solid SSP, your self-assessment score has no foundation. If your program is ever audited or you’re awarded a contract that triggers a higher-level review, a weak or missing SSP is the first thing that creates problems.

SPRS Submission and the False Claims Act

Your self-assessment score gets submitted to SPRS, the DoD’s database for tracking contractor performance risk. What many contractors don’t realize is that knowingly submitting an inaccurate score carries legal exposure under the False Claims Act. This isn’t a technicality. The Department of Justice has pursued cases against contractors who submitted inflated SPRS scores. A CMMC self-assessment is a formal attestation, and it should be treated as one.

Plans of Action and Milestones

If your organization doesn’t fully meet all required controls at the time of assessment, you can document the gaps in a Plan of Action and Milestones (POA&M). A POA&M identifies what’s missing, what you’re doing to fix it, and your timeline for doing so. Having a POA&M doesn’t disqualify you, but it does signal to contracting officers that your program is a work in progress.

What Third-Party Assessment Looks Like

When your contract requires a C3PAO, you’re entering a more structured and more rigorous CMMC certification process. Understanding what that looks like before you start helps you prepare effectively and avoid costly surprises.

Finding and Working With a C3PAO

C3PAOs are certified through the CMMC Accreditation Body, also known as the Cyber AB. You can search the Cyber AB marketplace to find authorized assessors. One important distinction to keep in mind: your compliance consultant and your C3PAO are not the same thing. A consultant helps you prepare for assessment. The C3PAO conducts the official assessment and issues your certification. Mixing up these roles can lead contractors to believe they’re further along in the process than they actually are.

What the Assessment Covers

A third-party assessment evaluates your implementation of all applicable NIST 800-171 controls against your documented SSP. The C3PAO will review your documentation, interview personnel, and test your technical controls. The result is either a certification, a conditional certification with documented POA&Ms, or a finding that you’re not yet ready. The CMMC gap analysis work you’ve done beforehand directly determines how that assessment goes.

Choosing the wrong assessment path, or submitting a self-attestation that doesn’t hold up, puts your contract and your reputation at risk. BL King Consulting has helped defense contractors navigate CMMC compliance requirements at every level since before the framework existed.

Why a Gap Analysis Comes Before Either Path

Whether you’re heading toward self-attestation or a C3PAO assessment, the smartest first move is a CMMC gap analysis. A gap analysis maps your current security posture against the controls required at your level, identifies exactly where you’re compliant and where you’re not, and gives you a prioritized remediation roadmap before you commit to anything.

What You Learn From a Gap Analysis

A thorough gap analysis tells you your realistic SPRS score before you submit it, which controls you’ll need to address to avoid POA&Ms, and whether your current posture could support a third-party assessment or needs more work first. It also gives you a credible SSP foundation to build from. BL King’s compliance team has identified more than $50,000 in potential cost savings for clients going through CMMC Level 2 compliance by catching inefficiencies and redundant spending early in the process.

Avoiding the Compliance Cost Trap

One of the most common mistakes contractors make is investing in remediation before they understand what actually needs to be fixed. Without a gap analysis, you’re guessing. And in CMMC compliance requirements, an expensive guess in the wrong direction means spending money on controls you didn’t need while leaving gaps that could fail your assessment. The gap analysis is how you spend that budget where it counts.

The Risk of Getting Your Assessment Path Wrong

Picking the wrong path isn’t just an administrative error. The consequences are practical and, in some cases, legal.

Choosing Self-Attestation When a C3PAO Is Required

If your contract requires a third-party assessment and you submit a self-attestation instead, you’re out of compliance before the work even starts. Contracting officers are paying closer attention to CMMC compliance requirements as enforcement ramps up, and a contractor that skips the required assessment process won’t pass the award requirements for new contracts.

Over-Attesting on Your Self-Assessment Score

Submitting a self-assessment score that overstates your actual posture might feel like a low-risk shortcut in the moment. But if a subsequent audit or contract review surfaces the discrepancy, you’re looking at contract termination, potential debarment, and the False Claims Act exposure mentioned earlier. The self-attestation process is only as valuable as the integrity behind it.

Work With a Team That Knows the Framework Backward and Forward

The difference between a CMMC self-assessment that holds up and one that creates liability often comes down to preparation. The same is true for third-party assessments. Contractors who go in without a current SSP, without a completed gap analysis, and without a clear understanding of their actual control posture tend to come out with POA&Ms, delays, and unplanned remediation costs.

BL King Consulting has been in the CMMC certification process since before the framework existed. Our team has guided defense contractors through Level 1, Level 2, and Level 3 engagements, and has been navigating DFARS 252.204-7012 compliance requirements since 2013. If you’re not sure which assessment path your contract requires, or you want to know where your posture actually stands before committing to either, reach out, and let’s work through it together.