The CMMC Level 2 Self-Assessment Is the Whole Ballgame Now

I’ve sat through enough mock assessments to know where good companies bleed points. The firewalls are usually fine. The paper is what bleeds. Documentation loses more points than technology, by roughly 2 to 1 in my experience.

With Phase 2 suspended, the self-assessment stopped being the warm-up and became the event. Here’s how to run one that survives someone else checking your math.

What a Level 2 self-assessment actually is

You’re assessing against NIST SP 800-171A, which breaks the 110 controls into 320 assessment objectives. Each objective gets a determination: Met, Not Met, or Not Applicable. The methodology gives you 3 ways to prove each one: examine artifacts, interview people, test the control.

Scoring runs on the DoD assessment methodology (the same math behind DFARS 252.204-7020): start at 110, subtract weighted deductions of 1, 3, or 5 points per unmet requirement. Scores go as low as minus 203. A perfect environment posts 110.

The 7 steps

1. Scope it. Decide where CUI lives, flows, and gets processed. Small scope, small assessment.
2. Write the SSP to the objectives. Address every lettered objective (3.1.1[a], 3.1.1[b], and so on), because that’s the grain an assessor scores, whether that assessor is you, DIBCAC, or a future C3PAO.
3. Work each objective with the 800-171A methods: examine, interview, test. Honestly.
4. Score it with the DoD methodology. Resist the urge to round up.
5. Put every gap on a POA&M with a real owner and a real date.
6. Post the score to SPRS.
7. Have your senior official sign the annual affirmation. At a small shop, that’s the owner’s name.

The rule that decides your score

A control that’s fully implemented but undocumented still scores Not Met. Whenever an objective says “identified,” “defined,” or “specified,” a document has to exist behind it. Assessors grade what you can show, and you should grade yourself the same way.

Honest and ugly beats pretty and false

I’ve watched a prime accept a customer’s honest score well short of 110 with a thank-you and zero drama. Compare that with MORSECORP, which reported a 104 to the government while its actual score was minus 142, and paid $4.6 million to settle. The gap is what burns you, not the number.

So run the assessment like the audit is real. Because per the suspension memo, government-led assessments are one of the 2 enforcement tools left, and the other one is the Department of Justice.