Skip to content
Talk to an Advisor
Talk to an Advisor
Written by: John Nolan | Vice President of Compliance

Defending Your Self-Assessment Without a C3PAO: An Evidence Checklist

Listen: Defending Your Self-Assessment Without a C3PAO: An Evidence Checklist
7:34

Executive Brief

With the third-party assessment requirement still paused, many contractors are now finishing a Cybersecurity Maturity Model Certification (CMMC) Level 2 self-assessment and moving on to the next project.

Solicitations and prime contractors may still ask for Level 2, and the designation matters. Knowing which status you hold, and which one your next bid requires, decides where you can compete.

  • Know your status. A self-assessment produces a Level 2 (Self) status. Level 2 (C3PAO) requires an independent review by a Certified Third-Party Assessment Organization (C3PAO).
  • The pause is narrow. The Department of Defense (DoD) suspended the C3PAO requirement on July 13, 2026. Self-assessments, Supplier Performance Risk System (SPRS) scores, and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 remain in force. See our blog, CMMC Phase II Is Paused, Not Canceled, for more information.
  • Primes set their own bar. Some prime contractors continue to require Level 2 (C3PAO) through supply chain flow-down clauses.
  • Evidence carries the weight. With no outside assessor, your documentation is the defense of your score.
  • Leadership owns the claim. A senior Affirming Official signs the results, so confirm status and evidence before anyone signs.

Dig deeper below to learn more.

Confirm Which Status You Hold

ISI recently met a contractor whose business unit leader believed a change in compliance partners had started the Level 2 certification process. The organization held no Level 2 status, and a bid the team wanted called for CMMC Level 2. The team then raced a proposal deadline to close the gap.

Three patterns can create this situation:

  • Provider transitions leave status assumptions unverified
  • The label "Level 2" appears in solicitations without the (Self) or (C3PAO) designation
  • Business unit leaders hold optimistic remediation timelines and assume the target status arrives on schedule

Start with this status check:

  • Look up your CMMC status and score in SPRS. Our guide to understanding SPRS scores explains what the number represents.
  • Read the provision in each target solicitation for the exact designation: Level 2 (Self) or Level 2 (C3PAO).
  • Ask each prime in writing which level it requires. Our guide to CMMC requirements for subcontractors covers how flow-down works.
  • If you are already working with a Managed Service Provider (MSP), confirm in writing what your engagement covers, including whether an assessment is in scope.
  • Name one executive owner for CMMC status and share the answer with every unit of your business. See CMMC Is Not a Cyber Problem. It's a Business Risk Issue.

The Evidence Checklist

C3PAO assessors validate against 320 assessment objectives. Build your evidence file to that level of detail, since a prime, a customer, or a government-led reviewer can ask to see it. The checklist below covers seven categories of records that support your self-assessment and SPRS score.

1. Scope

  • Data flow diagram showing where Controlled Unclassified Information (CUI) is created, stored, processed, and transmitted
  • Asset inventory covering CUI assets, security protection assets, and Contractor Risk Managed Assets
  • Dated network diagram that matches the current environment

2. Documentation

  • A System Security Plan (SSP) written at the objective level and limited to what is implemented today
  • Shared Responsibility Matrix naming the controls you own and the controls your MSP and cloud providers own
  • Policies and procedures that match daily practice

3. Implementation Evidence

  • Dated configuration screenshots and system settings for each control
  • Log samples and alert records
  • Training completion records
  • Tickets and change records that show each control operating over time

4. Scoring

  • Worksheet marking each objective MET or NOT MET against National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev. 2
  • SPRS score calculation that ties to the worksheet
  • Reviewer name and review date

5. Plans of Action and Milestones

  • Plans of Action and Milestones (POA&Ms) with an entry for every unmet requirement. A Conditional status requires a minimum score of 88 and allows only 1-point requirements to remain open, with one narrow encryption exception
  • Confirmation that none of the six items that can never be deferred, including the SSP, appears on the list
  • Owner, completion date, and closure evidence for each item, plus a plan to meet the 180-day closeout window after a Conditional status

6. Accountability

7. Retrieval

  • One repository with naming standards and named owners
  • Test: pull evidence for any control in 15 minutes

Pressure-Test Before You Sign

Before the Affirming Official signs, walk through your self-assessment the way an outside reviewer would. A prime, a customer, or a government-led assessor looks for a clear path from each SSP statement to a live system and dated evidence.

These steps surface gaps while there is still time to close them:

  • Compare SSP statements with live configurations
  • Mark any partial or planned control as NOT MET and recalculate the score
  • Hold a short readout with the Affirming Official before submission

ISI Insight: During the pause, C3PAOs or individual CCAs may be available to conduct a mock audit or review of your program to provide an additional set of eyes to your documentation, systems, and processes.

An inaccurate attestation can create False Claims Act exposure, so this review protects the person signing. Our post on why contractors fail CMMC Level 2 assessments lists the patterns to check first.

Plan for Both Paths

  • The CMMC Reform Task Force has not yet published its recommendations so it’s important to treat any change as unconfirmed until it becomes a formal policy.
  • Readiness work completed now applies under any outcome.
  • A voluntary C3PAO assessment remains an option when a prime or customer values independent validation.
  • Match your plan to your contract pipeline and the designations your primes require.

 

 

FAQs

Does a self-assessment make us Level 2 certified?

A self-assessment results in a Level 2 (Self) status recorded in SPRS. Level 2 (C3PAO) certification requires an assessment by a C3PAO. Check which designation each contract requires.

Do we still need to submit an SPRS score during the pause?

Yes. Self-assessment and SPRS score submission requirements remain in effect. The paused item is independent verification by a C3PAO.

Can a prime contractor still require Level 2 (C3PAO) certification?

Yes. Primes can set their own supplier security requirements, including a third-party assessment, independent of the federal timeline. Contract-level C3PAO requirements follow the clauses written into each contract. Confirm the requirement with each prime in writing.

Who signs the self-assessment results?

A senior company official, known as the Affirming Official, personally certifies the results in SPRS. That person should review the evidence behind the score before signing.

Helpful ISI Links

Related Posts