Your contract decides whether you need Level 2 (Self) or Level 2 (C3PAO). Both require every Level 2 requirement to be MET, both use SP 800-171A procedures and both need an affirmation in SPRS. The difference is who does the assessment, how results are recorded and what the program requires.
Who decides
The regulation says program managers or requiring activities choose the CMMC status based on the type of information involved. You do not pick. Look for the required level in the solicitation and in the contract clause.
How Level 2 (Self) works
You assess yourself under NIST SP 800-171A from June 2018, using the scoping rules in 170.19, and score the result. Results go into SPRS with the level, status date, scope, CAGE codes, overall score and POA&M status. An example in the text is 105 out of 110.
You affirm at the time of each self-assessment and annually. You repeat the assessment every three years. Evidence must be kept for six years from the status date.
How Level 2 (C3PAO) works
An authorized or accredited C3PAO performs the assessment with the same procedures and scoping. The assessor uploads results to the CMMC instance of eMASS, and you receive a findings report. The assessment must be completed within three years of the status date tied to the conditional status. Affirmation applies for every certification assessment and annually afterward. Hashed evidence artifacts are kept for six years.
A NOT MET requirement may be re-evaluated during the assessment and for 10 business days afterward, under the conditions in the rule.
What is the same
- All security requirements in 170.14(c)(3) must be MET for a final status.
- A POA&M is possible only under 170.21, with the 180 day closeout.
- A senior Affirming Official signs, stating that the organization has implemented and will maintain the requirements for in-scope systems.
How to prepare for either
Build as if a third party will test you. Self-assessments that cannot survive outside review create risk, and the affirmation is a formal statement. Keep the system security plan, asset inventory and network diagram current, and gather evidence continuously.
Safeguard's compliance and evidence automation helps collect and organize that evidence. It is not an assessor and does not confer a status.
Quick check
Who chooses between Self and C3PAO?
The requiring activity or program manager, based on the information type, as stated in the contract.
How long is evidence retained?
Six years from the CMMC status date, for both paths.
Sources
Last reviewed: 19 October 2026.
