Article Sections
- Who is responsible for the assessment results?
- Understanding the different assessment services.
- Why consider a CCA or LCCA for a self-assessment?
- What remains mandatory during a self-assessment?
- What happens when self-assessment results are inaccurate?
- Choosing the right assessment approach.
One of the most common misunderstandings about CMMC is that a self-assessment is somehow less demanding than an assessment performed by a Certified Third-Party Assessment Organization (C3PAO).
Some organizations approach self-assessment as an internal checklist exercise, reserving detailed evidence reviews, personnel interviews, and technical testing for formal certification assessments.
That approach can lead to inaccurate compliance determinations.
Under 32 CFR Part 170, CMMC Level 2 self-assessments and third-party certification assessments must evaluate the same 110 security requirements from NIST SP 800-171 Revision 2, using NIST SP 800-171A, the applicable scoping requirements, and the prescribed CMMC scoring methodology.
The primary differences involve who performs the assessment, who reports the results, and who independently validates compliance.
Organizations performing self-assessments also have options beyond relying entirely on internal personnel. They can engage qualified external professionals, including individuals holding the CMMC Certified Assessor (CCA) or Lead CMMC Certified Assessor (LCCA) credentials, to help conduct assessments and evaluate supporting evidence.
This approach can offer much of the assessment expertise available through the CMMC certification ecosystem without requiring a formal C3PAO certification engagement.
The assessment methodology does not change
The requirements for CMMC Level 2 self-assessments are established in 32 CFR § 170.16, while third-party certification assessments are addressed in § 170.17.
Both require assessments to be conducted in accordance with NIST SP 800-171A, June 2018, and the applicable CMMC Level 2 scoping requirements. Both also require the scoring methodology established in § 170.24.
NIST SP 800-171A establishes three primary assessment methods:
- Examine: Reviewing documentation, configurations, records, and other relevant evidence.
- Interview: Gathering information from individuals responsible for implementing or operating security requirements.
- Test: Exercising mechanisms or processes to determine whether they operate as intended.
These methods are used as appropriate to evaluate the applicable assessment objectives and support compliance determinations.
An organization performing a self-assessment cannot disregard assessment objectives simply because no external certification body is involved.
Consider NIST SP 800-171 requirement 3.5.3, which addresses multifactor authentication.
An organization might maintain an approved authentication policy requiring multifactor authentication. However, that policy alone does not necessarily demonstrate that multifactor authentication is implemented across all applicable accounts, systems, and access methods.
An assessor may need to examine authentication configurations, interview administrators, and test representative authentication scenarios to determine whether the applicable assessment objectives have been satisfied.
Those expectations do not change depending on whether the assessment is performed by an internal employee, an external CCA, or a C3PAO assessment team.
Formal certification assessments have additional administrative, quality assurance, and reporting requirements established through the CMMC Assessment Process (CAP). Those obligations govern the certification process rather than establishing a different set of security requirements for the organization.
Who is responsible for the assessment results?
The clearest distinction between self-assessment and certification concerns responsibility for conducting and reporting the evaluation.
During a self-assessment, the Organization Seeking Assessment (OSA) conducts or arranges its assessment and submits the resulting information into the Supplier Performance Risk System (SPRS). That responsibility remains with the organization even when external personnel conduct the assessment.
During formal certification, an authorized or accredited C3PAO independently evaluates the Organization Seeking Certification (OSC). The C3PAO conducts the certification assessment and submits results through the CMMC implementation of eMASS, which transmits the information to SPRS.
The C3PAO assumes responsibility for its independent assessment determinations and associated reporting, but the organization retains responsibility for maintaining its cybersecurity compliance.
| Assessment responsibility | Level 2 Self-Assessment | Level 2 C3PAO Assessment |
| Security requirements | 110 NIST SP 800-171 requirements | Same requirements |
| Assessment methodology | NIST SP 800-171A | NIST SP 800-171A |
| Assessment scope | 32 CFR § 170.19 | Same requirements |
| Scoring methodology | 32 CFR § 170.24 | Same methodology |
| Assessment personnel | Internal staff or qualified external assistance | Authorized/accredited C3PAO assessment team |
| Results reporting | Organization | C3PAO |
| Reporting system | SPRS | CMMC eMASS, transmitted to SPRS |
| Independent certification determination | Not required | Required |
| Annual organizational affirmation | Required | Required |
| Ongoing compliance responsibility | Organization | Organization |
A C3PAO certification does not transfer the organization’s continuing cybersecurity obligations to the assessment company.
Similarly, hiring an external CCA or LCCA to perform a self-assessment does not transfer the organization’s reporting and affirmation responsibilities to that individual.
Understanding the different assessment approaches
Organizations may encounter several assessment services when preparing for or demonstrating CMMC compliance. Although these services frequently evaluate the same requirements, their purposes and outcomes differ.
Internal self-assessments
An internal self-assessment is conducted by personnel working within the organization. This approach offers direct access to individuals who understand the organization’s systems, policies, and operational processes. It may also reduce assessment costs when the organization already employs qualified personnel.
However, internal personnel may have limited assessment experience or may be evaluating systems they designed or implemented themselves.
That familiarity can introduce assumptions that might not withstand independent scrutiny.
A credible internal self-assessment should include suitable expertise, objective evaluation methods, and sufficient evidence to support each determination.
Gap assessments
A gap assessment evaluates an organization’s existing implementation against applicable requirements to identify deficiencies and opportunities for improvement. Gap assessments may be conducted internally, externally, or through a combination of external consultants and internal personnel.
Unlike a formal C3PAO certification assessment, a gap assessment can include recommendations for corrective actions. For example, an assessor identifying weaknesses in audit log review practices can recommend improvements to documented procedures, alerting configurations, or assignment of responsibilities.
A gap assessment may cover the complete CMMC Level 2 methodology. When the assessment satisfies the applicable regulatory requirements, the organization may use those findings as the basis for its Level 2 self-assessment submission.
However, a limited readiness review that does not evaluate the required scope and objectives should not be represented as a completed CMMC self-assessment.
Mock assessments
A mock assessment typically attempts to reproduce the structure and experience of a formal C3PAO certification assessment. These engagements are commonly performed by C3PAOs using procedures similar to those employed during official certification.
A mock assessment may include assessment planning, evidence collection, interviews, testing, and structured reporting. Unlike a gap assessment, its primary purpose is to evaluate whether the organization can demonstrate compliance under conditions resembling a formal certification assessment.
A mock assessment does not result in an official CMMC certification.
To preserve impartiality, a C3PAO intending to perform a subsequent certification assessment must avoid providing remediation consulting or implementation assistance that would create a conflict of interest.
Formal C3PAO assessments
A formal Level 2 certification assessment is conducted by an authorized or accredited C3PAO under 32 CFR § 170.17. The C3PAO independently determines whether the applicable security requirements have been satisfied and reports the results through the prescribed certification process.
Successful completion can result in Final Level 2 (C3PAO) status or, when the limited POA&M conditions are met, Conditional Level 2 (C3PAO) status.
A formal certification assessment is distinct from readiness, gap, and mock assessments because it produces an official CMMC assessment status through the authorized certification process.
Why consider a CCA or LCCA for a self-assessment?
An organization does not need to hire a C3PAO to obtain the services of personnel with formal CMMC assessment credentials.
Individuals holding active CCA or LCCA credentials can provide independent self-assessment and readiness services outside the formal C3PAO certification process.
This offers an alternative for organizations that want qualified assessment personnel but do not require a C3PAO certification assessment under their applicable contracts.
The qualifications associated with these credentials are particularly relevant because CMMC assessments require more than general cybersecurity knowledge.
Specialized training and professional experience
A CCA must meet qualification requirements established under 32 CFR § 170.11. These include a minimum of three years of cybersecurity experience, at least one year of assessment or audit experience, and a qualifying professional certification aligned with the DoD Cyberspace Workforce Framework’s Security Control Assessor work role.
Candidates must also complete the applicable CMMC training and certification examination requirements.
An LCCA must meet additional experience requirements, including five years of cybersecurity experience, five years of management experience, and three years of assessment or audit experience, along with the applicable advanced professional qualification requirements.
These requirements distinguish CCA and LCCA credentials from general cybersecurity certifications that may not specifically address assessment methodology.
A qualified cybersecurity engineer might understand how to implement a security requirement but have limited experience determining whether assessment evidence is sufficient to demonstrate compliance.
An experienced CCA or LCCA brings assessment-specific knowledge to that evaluation.
Familiarity with the CMMC assessment process
CCA training and examination requirements address areas directly relevant to CMMC Level 2 assessments, including:
- Assessment scope and asset categorization.
- NIST SP 800-171A assessment procedures.
- Examination, interview, and testing methods.
- Evidence evaluation and findings determination.
- CMMC scoring and reporting requirements.
- The CMMC Assessment Process.
This training can be particularly valuable when organizations have technically capable security teams but limited experience conducting formal compliance assessments.
For example, an IT administrator may demonstrate that a security configuration has been implemented.
A CCA may evaluate whether the configuration applies to all relevant assets, whether supporting procedures are consistently followed, and whether the available evidence addresses every applicable assessment objective.
The distinction is between understanding how a security mechanism works and understanding how to evaluate and substantiate its compliance.
Professional ethics and accountability
Another important benefit of engaging a CCA or LCCA is the professional conduct obligations associated with those credentials.
Under 32 CFR § 170.11, CCAs must comply with applicable Accreditation Body policies concerning conflicts of interest, professional conduct, and ethics.
Credential holders are also subject to the professional certification requirements administered by ISACA, the designated CMMC Assessor and Instructor Certification Organization (CAICO).
ISACA’s Code of Professional Ethics addresses matters including professional objectivity, due diligence, confidentiality, adherence to professional standards, and lawful conduct.
These obligations are particularly relevant when assessors evaluate sensitive organizational information.
CMMC assessment activities may expose personnel to system architecture, security configurations, identified vulnerabilities, assessment evidence, and operational procedures.
Although professional ethics requirements do not replace confidentiality agreements or contractual protections, they provide an additional foundation for professional accountability.
Continuing professional education
CMMC program requirements, assessment guidance, and cybersecurity technologies can change over time. ISACA requires CCA credential holders to complete at least 20 continuing professional education hours annually and 120 hours during a three-year reporting period.
The continuing education requirements include learning activities relevant to the certification and CMMC program developments. This supports continued professional competency.
Organizations should still verify that the individual they hire maintains an active credential and has relevant experience with their particular systems and business environment.
Independent evidence evaluation
An external CCA or LCCA can provide a perspective that an organization’s internal implementation team may lack.
Consider a company whose IT department designed and implemented its CUI environment. The team might be confident that the security requirements have been satisfied because personnel understand how the systems were designed and configured.
An external CCA can independently examine whether the actual implementation, supporting documentation, personnel interviews, and operating records provide adequate evidence to support that conclusion. This can identify deficiencies that internal personnel may overlook.
For an organization’s Affirming Official, an independent assessment performed by a qualified professional can provide greater confidence in the completeness and reliability of the assessment results.
Assessment expertise without a formal C3PAO engagement
When an organization is permitted to conduct a Level 2 self-assessment, hiring an external CCA or LCCA can provide access to specialized assessment expertise without requiring a formal C3PAO certification engagement.
The professional can assist with establishing the assessment scope, selecting appropriate assessment methods, reviewing evidence, determining findings, and documenting assessment results.
When the engagement includes gap assessment or readiness services, the CCA or LCCA may also provide recommendations for corrective actions.
This can be particularly useful for small and midsized defense contractors that do not maintain dedicated internal assessment teams.
The organization receives the benefit of specialized assessment experience while retaining responsibility for the self-assessment and SPRS reporting process.
A CCA or LCCA is not independently a C3PAO
Holding a CCA or LCCA credential does not independently authorize an individual to issue an official CMMC Level 2 certification result.
Formal certification assessments must be conducted through an authorized or accredited C3PAO in accordance with the applicable regulatory and certification requirements.
A CCA or LCCA providing services independently may help perform a Level 2 self-assessment, but the resulting activity remains a self-assessment rather than an official certification assessment. Organizations should clearly identify the intended service before selecting an assessment provider.
If formal certification is required, the organization must engage an authorized or accredited C3PAO.
If a Level 2 self-assessment is sufficient under the applicable contract, the organization may use qualified internal personnel or external professionals to conduct the evaluation.
The distinction is not the professional competence of the individual performing the work. It is the authority and process under which the assessment is conducted and reported.
Maintaining impartiality for future certification
Organizations considering future C3PAO certification should understand how earlier assessment and consulting engagements may affect impartiality.
The Cyber AB’s R2002 C3PAO Accreditation Requirements, January 2026, establish restrictions intended to prevent certification organizations from evaluating their own implementation work. Under Section C.4.1.8, a C3PAO cannot conduct a Level 2 certification assessment within three years of providing consulting, implementation, or product sales or services to the organization. The requirements also establish restrictions against providing advice, implementation assistance, or recommendations during a formal certification assessment.
These distinctions matter when choosing between gap assessments and mock assessments.
A CCA or LCCA working as an independent consultant may identify compliance gaps and recommend corrective actions during a readiness engagement. However, that prior involvement must be considered if the same individual or an affiliated C3PAO later participates in formal certification.
Organizations anticipating certification may benefit from separating their readiness and remediation services from their formal certification assessment provider. This allows the organization to receive practical corrective-action assistance while preserving the independence of the subsequent certification assessment.
What remains mandatory during a self-assessment?
Engaging qualified external personnel does not eliminate the organization’s obligations under 32 CFR Part 170.
The organization remains responsible for ensuring that the assessment addresses the applicable security requirements, scoping expectations, assessment objectives, and scoring methodology.
Evidence retention
Under 32 CFR § 170.16(c)(4), an organization must retain the artifacts used as evidence during its Level 2 self-assessment for six years from the CMMC Status Date.
This applies regardless of whether the assessment is conducted internally or with external assistance.
The organization should maintain sufficient records to substantiate the assessment findings, including which evidence was considered and how compliance determinations were reached.
Scoring and POA&Ms
Both Level 2 assessment approaches use the scoring methodology established in 32 CFR § 170.24.
The organization cannot develop an alternative scoring methodology simply because it performs a self-assessment.
Similarly, the restrictions governing Plans of Action and Milestones (POA&Ms) under § 170.21 apply to both self-assessments and certification assessments.
Conditional Level 2 status is permitted only when the applicable requirements are met. Qualifying deficiencies must be remediated, and the required closeout assessment completed within 180 days.
Reporting and affirmation
The organization is responsible for submitting its Level 2 self-assessment results through SPRS.
Under 32 CFR § 170.22, its Affirming Official must affirm continuing compliance following the assessment and annually thereafter.
This responsibility remains with the organization even when a CCA or LCCA conducts the evaluation.
External professional qualifications may improve confidence in the assessment findings, but they do not transfer the organization’s reporting or affirmation obligations.
What happens when self-assessment results are inaccurate?
An inaccurate self-assessment can create consequences beyond identifying an unmet security requirement.
Under 32 CFR § 170.16, the Department of Defense may conduct a DCMA DIBCAC assessment to evaluate the organization’s compliance.
If the subsequent government assessment demonstrates that the organization has not achieved or maintained the applicable requirements, the government findings can supersede the organization’s existing CMMC Status.
Depending on the circumstances, this may result in loss of eligibility for additional awards requiring the affected status and the availability of applicable contractual remedies.
Organizations must also consider the consequences of knowingly false or materially misleading cybersecurity compliance representations.
In September 2025, Georgia Tech Research Corporation agreed to pay $875,000 to resolve allegations involving cybersecurity obligations under Department of Defense contracts. The allegations included the submission of a cybersecurity assessment score that reportedly did not accurately represent an actual covered contracting system.
Although the matter concerned a DoD cybersecurity assessment rather than a CMMC certification assessment, it illustrates why organizations should ensure that submitted assessment results accurately reflect the systems and implementations being evaluated. The settlement resolved allegations without a judicial finding of liability.
Not every assessment error constitutes fraud. However, organizations should take reasonable measures to verify their assessment determinations and preserve evidence supporting the information they submit.
Using an experienced CCA or LCCA may help reduce the risk of incorrect findings, but it does not eliminate the organization’s legal or contractual responsibilities.
Choosing the right assessment approach
Organizations have several legitimate approaches to demonstrating CMMC Level 2 compliance. An organization with experienced internal security assessment personnel may conduct a thorough self-assessment independently.
Another organization may have capable technical personnel but lack experience applying NIST SP 800-171A assessment procedures. That organization may benefit from engaging an external CCA or LCCA to conduct or support the self-assessment.
When corrective actions are necessary, a gap assessment can provide additional assistance by identifying implementation deficiencies and recommending remediation strategies.
Organizations preparing for formal certification may then choose to conduct a mock assessment before beginning the official C3PAO certification process.
These approaches are not mutually exclusive. For example, an organization might begin with an internal gap assessment, engage an independent CCA for a more detailed readiness evaluation, correct identified deficiencies, and proceed with formal certification when required.
The most appropriate approach depends on the organization’s technical resources, internal assessment experience, contractual requirements, and need for independent validation.
The standard stays the same
CMMC Level 2 self-assessments are legitimate assessments with defined regulatory requirements.
The evaluation criteria do not become less demanding because the organization chooses to perform the assessment itself. What changes is who conducts the evaluation, who independently validates the results through the certification process, and who reports the findings.
Organizations can conduct their own self-assessments, use internal or external gap assessments, or retain qualified personnel holding CCA and LCCA credentials.
These options allow organizations to select an assessment approach appropriate to their resources and contractual obligations without compromising the underlying assessment standard.
Ultimately, a defensible CMMC assessment is measured by the accuracy of its findings, the sufficiency of its supporting evidence, and compliance with the applicable methodology.
A self-assessment does not require a C3PAO, but it still requires the organization to demonstrate compliance.