Terms / Certification
Final certification
The status you hold when every requirement is met. It lasts one year at Level 1 and three years at Level 2 and Level 3.
Also called Final CMMC Status, final status.
Official Source Material
The OSA has achieved the CMMC Status of Final Level 2 (Self) if the Level 2 self-assessment results in a passing score as defined in § 170.24. This score may be achieved upon initial self-assessment or as the result of a POA&M closeout self-assessment, as applicable.
Source: 32 CFR 170.16(a)(1)(iii), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
A final status means nothing is outstanding, and it is reached two ways.
Either your assessment passed outright, or you held a conditional certification and closed the items within 180 days. Section 170.16(a)(1)(iii) sets this out for a self-assessment and 170.17(a)(1)(iii) for a certification assessment. Both routes end in the same place. The route you took does not appear in what the contract requires of you afterwards.
A final status is not permanent, and two clocks run at once.
DFARS 252.204-7021 defines current as not older than one year for Final Level 1 (Self), and not older than three years for Final Level 2 and Level 3. Behind each of those sits an affirmation not older than one year. The annual one falls due first, and it is the one that lapses.
Closing out does not reset your status date.
The date of the conditional status remains the status date after a successful closeout. That is deliberate, and it shortens the runway to your next assessment. Count from the conditional date when you plan the reassessment, not from the day you closed the last item.
Maintaining the status is a contract obligation, not a good practice.
The clause requires you to have and maintain a current status for the duration of the contract. A status that lapses mid-performance puts you out of compliance while you are still delivering. Build the calendar on the day you achieve it.
What falls short
- An affirmation missed a year after the assessment. The status depends on it, whatever the three year cycle says.
- A reassessment planned from the closeout date. The status date is the conditional date.
- A status held for one system while the work moved to another. The status attaches to the system in your scope.
Edge cases
- Your environment changes materially. The affirming official, the senior representative responsible for your compliance, must consider it, because the affirmation asserts continuing compliance.
- The Government assesses you afterwards and disagrees. An assessment by the Defense Industrial Base Cybersecurity Assessment Center takes precedence over a pre-existing status.
- You achieve Level 2 (Self) for a scope. That also satisfies Level 1 (Self) for the same scope.