Terms / Assessment
Self-assessment
An assessment you conduct on your own system. It carries the same requirements as a certification assessment and the same legal weight.
Also called self-assessments, Level 2 self-assessment, Level 1 self-assessment.
Official Source Material
Level 2 self-assessment is the term for the activity performed by an OSA to evaluate its own information system when seeking a CMMC Status of Level 2 (Self).
Source: 32 CFR 170.4, Assessment, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
A self-assessment is cheaper, and it is not easier.
You evaluate your own system against the same 110 requirements and the same assessment objectives a C3PAO would use. Nothing is relaxed. What changes is who performs the work and who pays for it. CA.L2-3.12.4 still requires the plan behind it. The result goes into the Supplier Performance Risk System under your own name, with an affirmation behind it.
The contract decides whether you may self-assess.
DFARS 252.204-7021 names the level, and Level 2 (Self) and Level 2 (C3PAO) are different entries in that blank. You do not choose. Read the clause first, because preparing for the wrong one wastes months.
Your affirmation is what gives a self-assessment its weight.
A senior official signs an annual affirmation of continuing compliance. Misrepresenting a score is a false statement to the Government, and the Department of Justice pursues those under the False Claims Act. The absence of an outside assessor does not lower the standard. It moves the responsibility onto the person who signs.
Score honestly, because a real number is more useful than a flattering one.
An inflated score removes your own visibility of the gaps and creates exposure you cannot easily undo. A low score with a credible plan is a normal position to be in, and it is defensible. A high score that cannot be evidenced is neither.
What falls short
- A self-assessment with no evidence retained. You assessed something, and there is no record of what.
- A score derived from a questionnaire rather than from the objectives. The objectives are the test.
- An affirmation signed by someone without the authority to make it. The rule asks for a senior representative responsible for compliance.
Edge cases
- You hold only Federal Contract Information. Level 1 is a self-assessment every year, and no POA&M is permitted at Level 1 at any time.
- Your self-assessment result is Conditional. A closeout self-assessment follows, performed the same way as the first, within 180 days.
- Your prime asks for a certification assessment though your contract names Level 2 (Self). Ask for the requirement in writing, because the contract governs.
Over-engineering
- Paying for a full mock assessment before a self-assessment. Spend it on the gaps you already know about.
- Treating the self-assessment as a one-week event. The evidence accumulates over months, and the assessment is the point at which you read it.