- Phase 1 is in effect. CMMC implementation began November 10, 2025, when the DFARS CMMC acquisition rule took effect.
- Phase II is suspended. On July 13, 2026, the Department of War suspended the Phase II requirements that were scheduled to begin November 10, 2026. During the suspension, solicitations may require only CMMC Level 1 (Self) or Level 2 (Self).
- The underlying rules still apply. DFARS 252.204-7012 and the 110 security requirements of NIST SP 800-171 Revision 2 remain in effect.
- Certification is still available. The Cyber AB has stated that C3PAO Level 2 certification assessments remain operational and available.
- More changes may come. A reform task force is reviewing the program, and no new Phase II date has been announced. We'll update this page as guidance changes.
What a CMMC Level 2 certification assessment is
A CMMC Level 2 certification assessment is an independent check of whether your organization has implemented the 110 security requirements of NIST SP 800-171 Revision 2 on the systems that handle Controlled Unclassified Information (CUI). Under the CMMC Program rule, 32 CFR Part 170, it must be performed by a CMMC Third-Party Assessment Organization (C3PAO) that has been authorized or accredited by the Cyber AB, the program's accreditation body.
Assessors evaluate each requirement against the 320 assessment objectives in NIST SP 800-171A (June 2018). They use three methods: examine documents, records, and configurations; interview the people who do the work; and test that controls actually function. Every assessment team includes at least two CMMC Certified Assessors (CCAs), one of whom serves as the Lead CCA.
The outcome is a CMMC Status of Conditional or Final Level 2 (C3PAO), which the C3PAO records in the CMMC instance of eMASS for transmission to the Supplier Performance Risk System (SPRS). It also satisfies Level 1 (Self) and Level 2 (Self) for the same scope.
Level 2 (Self) vs. Level 2 (C3PAO)
| Level 2 (Self) | Level 2 (C3PAO) | |
|---|---|---|
| Who assesses | Your organization | An Authorized or accredited C3PAO |
| Requirements | 110 NIST SP 800-171 R2 requirements | The same 110 requirements |
| Where results go | You enter them in SPRS | The C3PAO uploads them to CMMC eMASS, which feeds SPRS |
| How often | Every three years, plus annual affirmation | Every three years, plus annual affirmation |
| Open items (POA&M) | Limited; closed out within 180 days | Limited; a C3PAO closeout assessment within 180 days |
| In solicitations today | Yes, where DoD includes it | Not during the Phase II suspension |
Why organizations still pursue C3PAO certification during the pause
With Phase II suspended, a Level 2 (C3PAO) certification is not currently a condition of contract award. Organizations that pursue one now usually have practical reasons:
- An independent check behind your SPRS affirmation. A senior official at your company still affirms compliance in SPRS. An independent assessment against all 320 objectives tests that position before you rely on it.
- Something concrete for customers. Primes and higher-tier contractors decide what they ask of their suppliers. A Certificate of CMMC Status is a clear, verifiable answer.
- Readiness for what comes next. The underlying NIST SP 800-171 requirements haven't changed. Under the current rule, a Final Level 2 (C3PAO) status is valid for three years. How a reformed program will treat existing certifications has not been announced.
In its July 15, 2026 statement, the Cyber AB called a C3PAO Level 2 certification "a compelling calling card for subcontracting viability to primes and the best insurance policy against False Claims Act risk." Whether certifying now makes sense depends on your contracts and customers. We're glad to talk it through.
How the assessment runs: the four CAP phases
C3PAOs follow the CMMC Assessment Process (CAP) v2.0, published by the Cyber AB and approved by the DoD CMMC Program Management Office. It divides every Level 2 certification assessment into four phases.
Before Phase 1: conflicts of interest and the contract
The C3PAO proposes a Lead CCA and checks with you for conflicts of interest. If a conflict can't be mitigated, the assessment doesn't proceed. The engagement is set out in a written contract with a mutual non-disclosure agreement. The CAP also prohibits C3PAOs from guaranteeing results or tying fees to certification.
Phase 1: Conduct the pre-assessment
The Lead CCA reviews your System Security Plan (SSP) for completeness and consistency, then validates your CMMC Assessment Scope under 32 CFR 170.19(c). Any disagreement about scope has to be resolved before the assessment moves on. The C3PAO then submits pre-assessment information into CMMC eMASS.
Phase 2: Assess conformity to security requirements
An in-brief meeting confirms the scope, the schedule, and your right to appeal. The team then examines, interviews, and tests against each requirement, sampling your assets, people, and procedures. If both sides agree, much of the evidence collection can happen virtually, as long as CUI isn't shared outside environments that meet Level 2.
Phase 3: Complete and report assessment results
Each requirement is scored MET, NOT MET, or NOT APPLICABLE. A NOT MET requirement can be re-evaluated during the assessment and for up to 10 business days afterward if new evidence shows it is met, the change doesn't weaken other MET requirements, and the findings report hasn't been delivered. A CCA who wasn't on the team performs a quality assurance review before results go to eMASS. You receive a CMMC Assessment Findings Report and can appeal through the C3PAO and, if needed, the Cyber AB.
Phase 4: Issue certificate and close out the POA&M
The C3PAO issues your Certificate of CMMC Status. If you received Conditional status, a POA&M closeout assessment must be completed within 180 days. The same C3PAO or a different one can perform it.
A Complimentary CMMC Readiness Spot Check gives you a C3PAO's view of selected areas before you commit to a mock or certification assessment, at no cost.
What's in scope
Scope drives the effort of an assessment more than anything else. Under 32 CFR 170.19(c), each asset in your environment falls into a category, and each category is treated differently:
- CUI Assets process, store, or transmit CUI. They are assessed against all Level 2 requirements.
- Security Protection Assets provide security functions, such as identity, logging, or boundary protection. They are assessed against the requirements relevant to what they do.
- Contractor Risk Managed Assets can handle CUI but aren't intended to, because of your policies and procedures. They are documented in the SSP and may get a limited check.
- Specialized Assets include IoT and operational technology, government-furnished equipment, and test equipment. They are documented and managed under your risk-based policies.
- Out-of-Scope Assets can't handle CUI and don't protect CUI assets. Be prepared to justify why.
A cloud service provider that handles your CUI must be FedRAMP Moderate authorized or equivalent. Services from other external service providers you rely on are assessed within your scope, and each provider's customer responsibility matrix should be reflected in your SSP.
How results are scored
The maximum Level 2 score is 110, one point per requirement. Each NOT MET requirement subtracts 1, 3, or 5 points depending on its weight, so a score can go negative. A few rules matter more than most:
- Evidence must be final. Drafts, working papers, and unapproved policies don't count.
- You need a current SSP. Without one, the assessment can't be completed.
- A POA&M doesn't make a requirement MET. It only governs which items can stay open under Conditional status.
Conditional vs. Final status and the 180-day POA&M window
You reach Final Level 2 (C3PAO) when every requirement is MET. You can reach Conditional Level 2 (C3PAO) with open items only if all of the following are true:
- Your score is at least 80% of the maximum, which is 88 out of 110.
- Every item on the POA&M is worth 1 point. The one exception is SC.L2-3.13.11 (CUI encryption), when encryption is used but isn't FIPS-validated.
- None of six excluded requirements is on the POA&M. These include the SSP requirement (CA.L2-3.12.4) and several physical-access and external-connection requirements.
A C3PAO must confirm your fixes in a POA&M closeout assessment within 180 days of the Conditional status date, or the Conditional status expires. Once you reach Final status, it is valid for three years, with an affirmation in SPRS every year. You must also keep the hashed evidence artifacts from your assessment for six years.
What assessors look for first
Most assessment time goes into confirming that your documentation matches reality. Organizations that are well prepared usually have these ready before the live sessions start:
- A current SSP that describes every system in scope
- An asset inventory and network and data-flow diagrams that match the SSP
- Approved policies and procedures, plus records showing they are followed
- Customer responsibility matrices from cloud and managed service providers
- Any existing POA&M, with owners and milestones
- A plan for hashing the artifacts you submit as evidence
At 123 CMMC, we ask for applicable evidence about one week before scheduled sessions and start reviewing it early, so live time goes to interviews, demonstrations, and testing. Our certification assessments involve 1–2 days of scheduled interviews; total time to certification depends on your scope, evidence, scheduling, findings, and post-assessment quality review.
Where 123 CMMC fits
123 CMMC is an Authorized C3PAO (verify us on Cyber AB). We assess, and we stay independent. If you work with a consultant, Registered Provider Organization, or managed service provider, they keep doing the implementation work and we coordinate with them. Most organizations move through our four CMMC services in order:
- Complimentary CMMC Readiness Spot Check: a focused, no-cost review of selected areas
- Independent review of your Level 1 or Level 2 self-assessment before SPRS submission
- CMMC Detailed Mock Assessment covering all 320 Level 2 assessment objectives
- Formal CMMC Level 2 C3PAO Certification Assessment
Pricing depends on your scope. A 5 to 15 minute scoping call gets you a written quote. For more short guides, see our CMMC resources.