Self-assessment sounds easy. It is not. A CMMC self-assessment requires the same control implementation, the same documentation, and the same evidence quality as a C3PAO assessment. The only thing missing is the assessor. The executive affirmation that goes into the Supplier Performance Risk System (SPRS) is a formal attestation, signed personally, and the law treats it that way. Here is what self-assessment actually requires, and what gets contractors in trouble. (We provide readiness software; we are not a C3PAO and do not issue certifications.)
When self-assessment is allowed
Level 1, which covers Federal Contract Information, is self-assessment with an annual executive affirmation. Some Level 2 contracts, which involve CUI, permit self-assessment; others require C3PAO certification depending on the sensitivity of the information and the specific contract clause. The phased rollout determines which contracts trigger which path. Read the contract. Do not infer eligibility from the level alone, and confirm the current requirements against published DoD guidance.
What a CMMC self-assessment must produce
Four artifacts. None of them are optional, and none of them are easier because you are doing the assessment yourself.
System Security Plan
An SSP is required at every level above Level 1, where a documented description of FCI safeguards is required instead. The SSP describes the system boundary, the data flows, and how each of the controls is implemented. It is not a checklist. A self-assessment SSP needs to be the document an outside reviewer could use to predict what they would see in your environment.
Evidence for every control
Self-assessment does not mean self-attestation without proof. You still need evidence for yourself, for the executive who is about to sign the affirmation, and for any future review, whether a DoD spot check, a discovery request, or a customer audit. Evidence quality is what separates a self-assessment that holds up from one that does not.
POA&M, where permitted
Some controls can sit on a Plan of Action and Milestones with a closure timeline. Not every control is POA&M-eligible. The list of eligible controls and the closure windows are defined in the CMMC final rule. Treat the POA&M as a debt schedule with a hard due date, not as a parking lot.
Executive affirmation in SPRS
A senior official affirms in SPRS that the self-assessment is accurate. This is a formal attestation, signed by a person with personal accountability. Affirmations are not paperwork. They are decisions.
Before an executive signs anything, get an honest read on your control status. The free 2-minute gap check is a directional self-assessment, not an official SPRS score, but it shows where the gaps are. Run the free gap check →
The five most common self-assessment failures
- Scoring with optimism instead of evidence.
- SSPs that describe a future state rather than the present state.
- MFA gaps on accounts the contractor forgot existed: service accounts, vendor accounts, legacy admin.
- No evidence pipeline, so the answer to "can you show me" is always "give me a week."
- An executive affirmation signed without an honest brief. The person who signs needs to understand what they are signing.
Self-assessment vs C3PAO assessment
A C3PAO assessment is more expensive, slower, and harder to schedule. For perspective, the verified three-year Level 2 self-assessment cost is $37,196 for a small entity and $48,827 for a larger one, while the full C3PAO certification runs $104,670 small and $117,768 larger. Self-assessment costs less and moves faster, but it is harder to defend if something goes wrong, because the only signature on the wall is yours. The right choice depends on the contract requirements, the maturity of your program, and your willingness to put a senior official's name on the attestation. For the full path either way, see our CMMC certification process timeline.
The personal liability question
The executive who signs the SPRS affirmation is personally attesting to the accuracy of the self-assessment. The False Claims Act has been used against defense contractors for cybersecurity misrepresentations. This is not legal advice, and you should talk to your counsel, but no senior official should sign an affirmation they have not personally been walked through. The brief is the discipline that makes self-assessment defensible.
How AI-as-a-Service makes self-assessment defensible
The hardest part of self-assessment is keeping yourself honest. AI-as-a-Service helps, not because the AI judges you, but because it collects and time-stamps the evidence whether or not anyone remembers to. Control mappings stay current. Evidence stays fresh. The SSP reflects observed configuration rather than aspirational architecture. When the executive sits down to sign the affirmation, the brief is real: the controls operate as described, the evidence proves it, and the affirmation is defensible. The executive still owns the decision. The system gives the team the leverage to make it a decision based on facts. If you are not sure yet whether you even qualify for self-assessment, start with the CMMC assessment readiness checklist.