Many defense contractors are misreading Cybersecurity Maturity Model Certification (CMMC) self-attestation as a simple checkbox exercise. That misunderstanding creates serious risk.
With 48 Code of Federal Regulations (CFR) now live and CMMC requirements appearing in active Department of Defense (DoD) (also known as the Department of War) solicitations, the stakes are real. Self-attestation is a formal, evidence-based process with legal consequences for getting it wrong.
Dig deeper below to learn what your organization needs to understand before submitting anything.
Phase 1 of CMMC enforcement runs from November 2025 through November 2026 and requires most contractors to complete a self-assessment and affirmation rather than a third-party assessment. That distinction is creating dangerous confusion.
Contractors are hearing "self-attestation" and assuming it means a streamlined, low-effort process. That assumption carries significant legal and financial risk.
Self-attestation carries the same compliance obligations as a third-party assessment. You are simply the one doing the validating, and if your validation is wrong, the legal consequences are the same.
If your organization handles only FCI, you must implement all 15 basic safeguarding requirements under Federal Acquisition Regulation (FAR) 52.204-21. Every control must be met. No Plans of Action and Milestones (POA&Ms) are permitted at Level 1.
Most DoD contractors handle CUI, which means you must demonstrate compliance with all 110 security controls from National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev. 2, spanning 320 assessment objectives. This is a rigorous self-evaluation against a defined methodology, not a survey.
Before submitting anything to the government, your organization must have built and maintained the following:
Building a compliant SSP and properly scoring against all 110 controls can take three to twelve or more months depending on your environment and current posture. This is not a weekend project.
All submissions flow through SPRS, the DoD's centralized platform for tracking contractor cybersecurity posture.
The Department of Justice's (DoJ) Civil Cyber-Fraud Initiative uses the False Claims Act (FCA) to pursue contractors who misrepresent cybersecurity compliance. In 2025 alone, the DoJ settled seven cybersecurity-related FCA cases.
FCA violations carry treble damages, meaning triple the government's losses, plus per-claim penalties. Willful ignorance is not a defense. The executive signing the SPRS affirmation is personally accountable. CMMC compliance is not just a cybersecurity issue, it is a business imperative.
Exposure can come from submitting an inflated SPRS score, signing affirmations without verifying controls, or allowing POA&M items to go unresolved while continuing to certify readiness.
Phase 1 does not guarantee you will avoid a third-party assessment. DoD Program Managers have discretion to require Certified Third-Party Assessment Organization (C3PAO) certification even during Phase 1. Primes are already flowing that requirement down to subcontractors ahead of the formal timeline. Know what your contracts and partners require.
Self-attestation is not a shortcut. It is the same compliance work, executed internally, with the same legal accountability attached.
Build your SSP. Score honestly. Remediate your gaps. Document everything. And make sure the executive signing that affirmation knows exactly what they are certifying.
No. Self-attestation is a formal, evidence-based process. It requires a complete SSP, an accurate SPRS score, and an executive affirmation with legal accountability under the False Claims Act.
A senior company executive, designated as the Affirming Official, must sign the affirmation in SPRS. This cannot be delegated to IT and carries personal legal accountability.
Not necessarily. DoD program managers can require a third-party C3PAO assessment even during Phase 1. Prime contractors are also validating subcontractor compliance ahead of the formal timeline.
Depending on your environment and current posture, building a compliant SSP and scoring against all 110 controls can take three to 12 months. Starting early is critical.