- Phase 1 is in effect. CMMC implementation began November 10, 2025, when the DFARS CMMC acquisition rule took effect.
- Phase II is suspended. On July 13, 2026, the Department of War suspended the Phase II requirements that were scheduled to begin November 10, 2026. During the suspension, solicitations may require only CMMC Level 1 (Self) or Level 2 (Self).
- The underlying rules still apply. DFARS 252.204-7012 and the 110 security requirements of NIST SP 800-171 Revision 2 remain in effect.
- C3PAO assessments remain available. Voluntary Level 2 (C3PAO) certification assessments are still operational through Authorized C3PAOs.
- Self-assessment is the default contractual path today. Level 2 (C3PAO) remains available as a voluntary certification assessment.
CMMC Level 2 now shows up in two different status flavors: Level 2 (Self) and Level 2 (C3PAO). Same control set. Different assessors, different submission paths, and—during the Phase II suspension—very different roles in DoD solicitations.
What each status means
Level 2 (Self) means your organization assessed its own implementation of the 110 NIST SP 800-171 Revision 2 requirements for the defined CMMC Assessment Scope, scored the results under 32 CFR §170.24, entered them in SPRS, and affirmed compliance. It is still a formal CMMC Status under 32 CFR §170.16—not an informal checklist.
Level 2 (C3PAO) means an Authorized or Accredited C3PAO performed the Level 2 certification assessment. Results go to the CMMC instance of eMASS and then to SPRS. The OSC still submits affirmations in SPRS. Final Level 2 (C3PAO) requires all in-scope requirements MET; Conditional status is possible under the POA&M rules in 32 CFR §170.21.
For a deeper walkthrough of how a certification assessment is run, scoped, and scored, see what an Authorized C3PAO actually does.
Side-by-side: Level 2 (Self) vs Level 2 (C3PAO)
| Level 2 (Self) | Level 2 (C3PAO) | |
|---|---|---|
| Who assesses | The Organization Seeking Assessment | Authorized/Accredited C3PAO |
| Requirements | 110 NIST SP 800-171 R2 | Same 110 requirements |
| Methods | NIST SP 800-171A + CMMC scoring | Same methods; CAP process for C3PAOs |
| Results path | OSA enters results in SPRS | C3PAO → CMMC eMASS → SPRS |
| Affirmation | At assessment + annually in SPRS | At assessment + annually in SPRS |
| In solicitations today | Yes, where DoD includes it | Not during the Phase II suspension |
| Satisfies lower statuses | Level 2 (Self) for that scope | Also satisfies Level 1 (Self) and Level 2 (Self) for that scope |
| Validity cadence | Reassess every 3 years + annual affirmation | 3-year status cycle + annual affirmation |
What the Phase II pause changed—and what it did not
On July 13, 2026, the Department of War suspended Phase II. Program managers may not designate Level 2 (C3PAO) or Level 3 (DIBCAC) during the suspension. That is a contracting instruction change, not a repeal of CMMC or of DFARS 252.204-7012.
What did not pause:
- Protecting CUI under DFARS 252.204-7012 / NIST SP 800-171 Revision 2.
- Level 1 (Self) and Level 2 (Self) when a solicitation or contract includes them.
- SPRS obligations tied to those self-assessment and affirmation requirements (see also DFARS 252.204-7019 / 252.204-7020 for NIST SP 800-171 assessment reporting where those clauses apply).
- The ability to obtain a voluntary Level 2 (C3PAO) certification assessment from an Authorized C3PAO.
In other words: the market still runs on self-assessment for many awards, while third-party certification remains a strategic option rather than the default award gate.
If you are deciding between polishing a self-assessment and scheduling a C3PAO assessment, a Spot Check can clarify readiness without a full engagement.
Get My Complimentary CMMC Readiness Spot CheckWhat contracting officers see in SPRS
SPRS is where DoD looks for supplier risk data, including CMMC-related assessment information. For Level 2 (Self), your team is responsible for posting accurate results and keeping affirmations current. For Level 2 (C3PAO), the C3PAO's eMASS submission feeds SPRS, and your affirming official still completes affirmations.
Accuracy matters either way. An inflated self-assessment score does not become safer because Phase II is paused—False Claims Act exposure and prime flow-downs still attach to representations you make. For the mechanics of scoring and posting, see how SPRS scores work.
Why organizations still pursue Level 2 (C3PAO)
- Prime and customer expectations. Some primes keep third-party certification in supplier requirements even when the government solicitation only cites self-assessment.
- One status that covers more. Level 2 (C3PAO) also satisfies Level 1 (Self) and Level 2 (Self) for the same scope.
- Independent evidence. An Authorized C3PAO assessment creates an outside record against the 320 assessment objectives.
- Readiness for a future Phase II restart. No new date has been announced, but organizations that already hold Final Level 2 (C3PAO) are not starting from zero if third-party requirements return.
Role separation still applies: your RPO or implementation partner remediates; 123 CMMC assesses. 123 CMMC does not provide implementation consulting to organizations we assess. We do not provide implementation consulting to organizations we assess.
Choosing a path without over-promising
Start from the written requirement in your solicitation, contract, or prime flow-down—not from a blog timeline. If it says Level 2 (Self), plan a defensible self-assessment and affirmation cadence. If a customer asks for C3PAO certification, plan scope and evidence for a certification assessment. Many teams do both: keep SPRS current for awards now, and schedule a C3PAO assessment when the evidence pack is ready.
123 CMMC can help with a Complimentary CMMC Readiness Spot Check, an independent pre-SPRS review, a Detailed Mock Assessment, or a formal Level 2 certification assessment—always as an assessor, not as your implementer.
Conditional status, closeouts, and affirmations
Both Level 2 (Self) and Level 2 (C3PAO) can land in Conditional status when the scoring and POA&M rules in 32 CFR §170.21 are met. Conditional is not a casual to-do list. Only certain NOT MET items may appear on a POA&M, a minimum score threshold applies, and the closeout clock is 180 days from the Conditional CMMC Status Date. If closeout fails in time, Conditional status expires.
For Level 2 (Self), your organization performs the POA&M closeout self-assessment and updates SPRS. For Level 2 (C3PAO), a C3PAO performs the closeout assessment. Mixing those closeout paths is a common planning error—budget time and budget the right assessor type before you accept Conditional status as a bridge.
Affirmations are the other recurring obligation. CMMC Status is not a one-and-done PDF on a share drive. Affirming officials must affirm at assessment time and annually thereafter in SPRS. Teams that treat affirmation as a clerical afterthought are the ones who discover a lapsed status during an option exercise.
Scoping is shared DNA
Self and C3PAO paths both live or die on scope. If CUI lives in email, in a shop-floor system, and in a cloud productivity tenant, your Assessment Scope has to reflect that reality. Shrinking scope on paper to inflate a self-assessment score creates a brittle SPRS record and a painful C3PAO assessment later. Expand scope consciously, document Out-of-Scope and Contractor Risk Managed Assets under 32 CFR §170.19, and keep the SSP synchronized with how people actually work.
When primes ask for proof, they rarely ask for a blog post. They ask what status you hold, for which CAGE / system, as of which date, with which affirmation. Build toward that artifact set whether your near-term requirement is Self or C3PAO.
A simple decision frame
Use this as a conversation starter with leadership—not as legal advice:
- If the written DoD requirement is Level 2 (Self), prioritize a defensible self-assessment, SPRS posting, and affirmation calendar.
- If a prime or customer requires Level 2 (C3PAO), plan certification scope even while Phase II is suspended.
- If you only have a verbal rumor that “CMMC is canceled,” re-read DFARS 252.204-7012 and your latest solicitation language before you pause control work.
- If you want optional assurance without waiting for a Phase II restart date, schedule a C3PAO assessment once evidence is stable.
123 CMMC can meet you on the assessment side of any of those branches. Bring your solicitation excerpt to a scoping call; we will tell you plainly whether a Spot Check, pre-SPRS review, mock assessment, or certification assessment is the honest next step.