Not every defense contractor needs to hire a C3PAO. The CMMC program includes both self-assessment and third-party assessment pathways, and understanding which one applies matters, because the DoD estimates the two paths differently (a Level 2 self-assessment at $37,196 for a small entity versus $104,670 for a C3PAO certification over three years).
Your assessment path is determined by your CMMC level and the type of information your contracts involve. This guide clarifies the rules so you can plan and budget correctly.
CMMC Level 1: self-assessment only
If your contracts involve only Federal Contract Information (FCI) and you need CMMC Level 1, the path is straightforward: self-assessment. You evaluate your compliance against the 15 basic safeguarding requirements derived from FAR 52.204-21, submit your score to the Supplier Performance Risk System (SPRS), and affirm compliance annually through a senior leadership affirmation.
No C3PAO is involved and no third-party assessment fee applies. Your cost is limited to implementing and maintaining those practices, which most businesses with basic cybersecurity hygiene already do.
The critical requirement is the senior leadership affirmation. A senior company official attests that the self-assessment is accurate. Because that affirmation is a formal statement to the federal government, contractors should treat it as a binding legal commitment and confirm the current affirmation requirements against published DoD guidance.
CMMC Level 2: the split path
Level 2 is where it gets nuanced. The program divides Level 2 into two tracks based on the sensitivity of the CUI and the acquisition's priority status. The exact rollout of these tracks is governed by DoD phased implementation, so confirm current status before planning.
Self-assessment track (non-prioritized acquisitions)
For contracts handling CUI that are designated non-prioritized acquisitions, self-assessment is permitted. You evaluate your compliance against all 110 NIST SP 800-171 requirements, submit your SPRS score, and provide a senior leadership affirmation, similar to Level 1 but against the full 110-control standard. The contracting officer determines the designation, and the solicitation or contract specifies whether the acquisition is prioritized or non-prioritized.
C3PAO assessment track (prioritized acquisitions)
For contracts designated prioritized acquisitions, a third-party assessment by a C3PAO is required. A C3PAO evaluates your compliance against all 110 controls through documentation review, technical verification, and personnel interviews. Prioritized acquisitions are those where the DoD has determined the CUI sensitivity warrants independent verification.
Whichever path you are on, the standard is the same 110 controls. A free 2-minute gap check gives you a directional self-assessment (not an official SPRS score) so you know where you stand before you commit to a path.
Run the free gap check →How to determine your path
Your path is specified in your contract. Check the solicitation for the DFARS CMMC clause (confirm the current clause number against DoD rulemaking), which specifies the required level and, for Level 2, whether a self-assessment or C3PAO assessment is required.
If you are a subcontractor, the prime should flow down the CMMC requirements, including the assessment type. If the flow-down is ambiguous, clarify with the prime before investing in the wrong path. When in doubt, prepare as if a C3PAO assessment is required: preparing for a C3PAO and discovering you only needed a self-assessment wastes some money but keeps you eligible, while the reverse can be disqualifying.
The self-assessment rigor gap
Many contractors make a costly mistake here: they treat self-assessment as a lightweight exercise because no third party is checking their work. That is dangerous for two reasons.
First, the legal exposure is real. A self-assessment affirmation is a formal statement to the federal government, and contractors should understand the potential legal exposure that can come with an inaccurate affirmation (this is general information, not legal advice, so confirm your situation with qualified counsel) (confirm specifics with qualified counsel). Second, self-assessment quality directly affects your SPRS score, which contracting officers use to evaluate your cybersecurity posture when making award decisions. An inflated score that does not reflect reality will eventually be exposed, whether through an audit, a breach, or a C3PAO assessment when you bid on a prioritized acquisition.
The smart approach: treat every self-assessment with the same rigor as a C3PAO assessment. Score honestly, document thoroughly, and implement controls fully. The only difference should be who signs the finding, not the standard you are measured against.
Cost comparison: self-assessment vs C3PAO
The direct cost difference is significant but not as large as most contractors assume, because self-assessment saves the assessor fee but not the cost of actually implementing the controls. The figures below are three-year totals from the DoD's published Regulatory Impact Analysis.
| Path (3-year total) | Small entity | Larger entity |
|---|---|---|
| Level 2 self-assessment | $37,196 | $48,827 |
| Level 2 certification (C3PAO) | $104,670 | $117,768 |
| C3PAO assessor engagement (within the total above) | $31,234 | $52,056 |
A C3PAO assessment adds the third-party fee but provides independent verification that strengthens your competitive position. A C3PAO certification is a stronger signal to primes and contracting officers than a self-assessed SPRS score. Either way, the bulk of the spend is preparation and documentation, which is the work AI can compress. For the full breakdown, see our CMMC Level 2 certification cost guide.
Source: DoD CMMC Program Regulatory Impact Analysis (DOD-2023-OS-0063-0003), pp. 14, 25-26.
How AaaS serves both paths
Whether you need a self-assessment or a C3PAO assessment, an AI-as-a-Service (AaaS) platform provides the same foundational value: continuous, automated evaluation of your compliance posture against all applicable controls, with the authorizing official approving every output.
For self-assessment, AaaS keeps your self-evaluation accurate and defensible. AI agents assess every control objectively, reducing the optimistic scoring bias that creates legal exposure, so your senior leadership affirmation is backed by data rather than guesswork. For C3PAO preparation, AaaS shows you exactly where you stand before the assessors arrive, so the assessment becomes a validation of what you already know rather than a discovery exercise.
To plan the right path, start with the free gap check, then map your real posture with the $799 CMMC Readiness Snapshot, a one-time purchase that credits 100% to month one if you continue to a readiness subscription within 30 days.