Updated September 30, 2026
You heard CMMC was paused and hoped the self-assessment went with it. It didn't. The pause delayed outside certification. It left the self-assessment in place, and made it the version contracting offices are most likely to ask for.
Some background, in plain terms. CMMC is the Defense Department's program for checking that suppliers protect the sensitive drawings and technical data they handle, which the government calls CUI (controlled unclassified information). Level 2 is the tier for anyone who holds CUI. It comes in two versions: a certificate from a C3PAO (an accredited outside assessment firm), or a self-assessment, where you score yourself and post the result. Starting November 10, 2026, certificates were supposed to become the normal requirement. On July 13, DoD suspended that step: while the suspension lasts, DoD's new contracts may ask only for Level 1 (Self) or Level 2 (Self). The current contracting instruction, class deviation 2026-O0025, Revision 3 (September 3), tells contracting officers to put that into effect (deviation memo, page 2). The pause, explained in full
The stakes are simple. If a solicitation asks for Level 2 (Self), usually through the contract clause DFARS 252.204-7021, the contracting officer "shall not award" it to a company without that status (DFARS 204.7502). No posted self-assessment, no contract. A prime can't give you the subcontract either, because the CMMC clause makes it check your status before award. That check is also the most the government lets a prime demand of you during the pause: a self-assessment at the level that fits what it sends you. A certificate on top is owed only if it's in a subcontract you signed or in the prime's own DoD contract; otherwise it's a request, and you can answer it in writing. What a prime can require during the pause →
Your old SPRS score probably isn't it
SPRS, the Supplier Performance Risk System, is the DoD website where your scores live. Many shops already have a number there, a "NIST SP 800-171 Basic" score posted for an older contract with the clauses DFARS 7019 or 7020. That's a separate record.
A Level 2 (Self) entry is filed under a different rule, 32 CFR 170.16, and it comes with an annual affirmation: a named senior official at your company signs, every year, that you still meet the requirements (32 CFR 170.16). You can't relabel the Basic score. And if that Basic score covered your whole office network three years ago while CUI now lives on a few engineering laptops, it describes the wrong place anyway.
The entry itself is short. Whoever files it signs in through PIEE, the DoD login portal that leads to SPRS, and fills in at least these fields:
| Field | What goes in it |
|---|---|
| CMMC level | Level 2 (Self) |
| Status date | The day you finished the assessment |
| Assessment scope | The systems you assessed, named the way your security plan names them |
| CAGE codes | Every CAGE code (the five-character ID the government gives each business location) whose work runs on those systems |
| Score | Out of 110, for example 104 |
| POA&M | Whether you have an open fix list, and its status |
If you can't fill in the scope and CAGE rows without guessing, stop there and work out your scope first. How to scope a small contractor
The score, and the line at 88
You start at 110, one point per requirement, and subtract for each one you haven't met. Big items cost 5 points, medium ones 3, small ones 1. A score of 110 gives you Final status. From 88 to 109 you can file Conditional status, which means you owe a POA&M (plan of action and milestones: a written list of what's unfinished and when it will be done), and you have 180 days to finish every item and post the close-out in SPRS. Miss the 180 days and Conditional status expires. Below 88 you have no Level 2 status at all, which means no award on a contract that requires it. How the scoring works in detail
Not everything is allowed on that fix list. For the person filling it in, the rules in 32 CFR 170.21 and the scoring in 170.24 come down to this: only 1-point requirements can go on the POA&M, plus encryption (3.13.11) when you encrypt with a product that isn't FIPS-validated, meaning government-tested. Six requirements can never go on it: 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5, and 3.12.4. Multi-factor login (3.5.3) and that same encryption item can earn partial credit.
The most expensive mistake here is optimism. A company scores a requirement as met because the policy says so, the official signs, and a later DoD assessment finds the setting was never turned on. A score in SPRS is a statement to the government. An affirmation you can't back up falls under the False Claims Act, the federal fraud law that allows triple damages plus a penalty per false claim. If there's any doubt about a requirement, score it not met and put it on the plan. When an unsupported score becomes legal risk
Doing it in a month
A ten-person shop can finish a real self-assessment in about four weeks if one person owns it.
Week one is scope: the people, laptops, and cloud services that store, process, or send CUI, plus the systems that protect them, such as the admin accounts and the antivirus console. Weeks two and three go through the 110 requirements, grouped into 14 families, starting with Access Control. Each requirement breaks into smaller checks called objectives, listed in NIST SP 800-171A. Check each one against an export or a setting screen, not a sentence in a policy. Week four, score it, walk the signing official through everything that's not met, and enter it in SPRS using DoD's Level 2 Self entry guide.
If you'd rather know the number before that month starts, Garde1's mock assessment scores all 110 requirements against evidence pulled from your own tools, and turns every unmet item into a fix, with the ones that block your status first and the points each is worth.