Current status: CMMC Level 2 includes Self and C3PAO assessment types in the regulatory model, but the Department suspended the Phase II rollout of mandatory Level 2 C3PAO requirements on July 13, 2026. The program is currently paused in Phase 1, where procurements may require Level 1 Self or Level 2 Self. The applicable solicitation, contract, order, or prime flow-down determines the requirement for a specific organization.
Level 2 Self assessment cadence
CMMC Level 2 Self is conducted every three years. An affirmation is submitted after the assessment and annually thereafter. The assessment cycle and affirmation cycle are separate requirements.
What Level 2 Self requires
- Your organization assesses the 110 NIST SP 800-171 Revision 2 security requirements within the Level 2 self-assessment scope.
- The assessment uses the CMMC Level 2 scoring methodology and applicable assessment objectives.
- The result is entered in SPRS.
- An affirming official submits the required affirmation after the assessment and each year thereafter.
- Limited POA&M use is allowed only under the conditions in 32 CFR Part 170, with the required closeout within 180 days for Conditional status.
What Level 2 C3PAO is
Level 2 C3PAO is the certification-assessment path conducted by an authorized CMMC Third-Party Assessment Organization. It remains part of the CMMC regulatory structure. C3PAOs can continue to operate and organizations can prepare for or voluntarily pursue that path when appropriate. The Department's current implementation change is that mandatory Phase II C3PAO requirements are suspended.
How the contract determines the requirement
Review the procurement documents. DFARS 252.204-7021 and the solicitation identify the applicable CMMC requirement. During the current suspension, Department program and requiring activities have been directed to use Level 1 Self or Level 2 Self rather than designate Level 2 C3PAO or Level 3 DIBCAC requirements.
Do not confuse CMMC Level 2 Self with the DFARS Basic Assessment
DFARS 252.204-7019 and 252.204-7020 separately require a current NIST SP 800-171 DoD Assessment in SPRS for applicable contractor information systems. The numeric SPRS score under that methodology uses the same Rev. 2 security baseline, but it is a separate assessment and reporting mechanism from CMMC Level 2 Self.
Preparation activities overlap
Whether the immediate requirement is Level 2 Self, a government-led review, or future C3PAO certification, core preparation activities include defining the CUI boundary, implementing NIST SP 800-171 Rev. 2, maintaining an accurate SSP, remediating gaps, retaining final evidence, and operating the environment as documented.
Scope remains a major cost decision
If CUI is allowed to spread through general business email, file shares, endpoints, and cloud services, the CMMC environment can become larger than necessary. Where operationally appropriate, a secure enclave can concentrate CUI into a smaller protected workflow. PreVeil is one option: it publishes FedRAMP Moderate Equivalency and FIPS 140-3-validated cryptography information and is designed to work alongside Microsoft 365 or Google Workspace. An enclave can help minimize unnecessary scope and cost, but it does not automatically remove every supporting system from the CMMC boundary.
Current interpretation
Do not treat C3PAO certification as the default statement of current Department implementation. Confirm the assessment type in the procurement documents. If Level 2 Self is required, prepare for a three-year self-assessment cycle with annual affirmation. If a future or voluntary C3PAO assessment matters to the business, maintain evidence suitable for independent review without describing that assessment as a current universal award requirement.
CMMC Level 2 Self readiness · Level 2 requirements · CMMC cost · Secure CUI enclave planning