How to do a CMMC Level 2 self-assessment when a contract requires it
A Level 2 (Self) assessment is performed and owned by your organization, not by a consultant or an outside assessor. You score your environment against the 110 requirements of NIST SP 800-171 Rev. 2, using the assessment objectives in NIST SP 800-171A (June 2018) and the scoping and scoring rules in 32 CFR 170.19 and 170.24. Each requirement is MET only when every applicable objective is satisfied with evidence in final form, so a draft policy or an unapproved procedure does not count. The result is then entered in SPRS with the scope, every CAGE code in scope, the overall score and any POA&M usage, and an affirming official signs the affirmation that DoD verifies in SPRS. Before you start, confirm which systems actually process CUI, because scope drives both the score and the work. The score determines what you can claim. Under 32 CFR 170.21(a)(2), a Level 2 assessment earns Conditional status only at 88 or more of 110 points, and every POA&M item is worth one point. Six requirements cannot sit on the POA&M at all: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. Treat those six as must-meet before submission. The DoW CMMC FAQ (July 2026) also states that marking CA.L2-3.12.4 NOT MET produces a No Score result in SPRS. Any POA&M item must be closed through a closeout assessment within 180 days of the Conditional status date, and that closeout checks only the NOT MET requirements listed on the POA&M. Costs split between one-time preparation and recurring obligations. The DoD's 2024 final rule estimated a Level 2 self-assessment plus initial affirmation at $43,403 per assessment for an other-than-small entity and $34,277 for a small entity, with the three-year totals of $48,827 and $37,196 covering one assessment cycle and two annual affirmations. Those estimates are per assessment and do not include remediation of your environment. Phase II, which would have required C3PAO certification, was suspended on 13 July 2026, but Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. Confirm the current contract requirement with the contracting officer. DeployOpen prepares systems, controls and evidence for your assessment, but it does not issue scores, SPRS entries or affirmations. A missing or incomplete System Security Plan changes the outcome: without a current SSP that describes your controls, you cannot credibly score the requirements that depend on it.
What are the steps to run a Level 2 self-assessment?
The sequence moves from fixing the CUI boundary to submitting an affirmation, and each phase leaves a specific record that a later assessor or DoD reviewer can check. The organization owns every step, and an outside party can help prepare it, but the contractor performs and records the self-assessment itself.
Confirm scope and the CUI boundary
Start by deciding which systems, people, facilities and external service providers handle CUI or security protection data, using the scoping rules in 32 CFR 170.19. Leadership or the compliance lead signs off on the boundary, and the team lists every CAGE code that falls inside it. The step is done when a written scope statement names the in-scope assets, the out-of-scope assets with reasons, and the external providers whose systems are in scope. Specialized assets such as OT or test equipment need an explicit decision here, because they affect what the SSP must describe.
Build or update the system security plan
Write or revise the system security plan (SSP) so it describes how each in-scope environment meets the 110 Level 2 requirements, which systems and people perform each function, and where any enduring exceptions sit. The compliance owner and system administrators draft it, and the affirming official reviews it. The output is a final-form SSP tied to the scope statement, with a version number and approval date. An SSP that is still a draft cannot support MET determinations, so finalize it before scoring begins.
Assess each requirement against SP 800-171A objectives
For each requirement, check every applicable objective in NIST SP 800-171A (June 2018) and record the evidence used. Assessors use three methods: examine documents and configurations, interview the people who run the control, and test that the control works as described. Mark a requirement MET only when all applicable objectives are satisfied with evidence in final form. The output is a requirement-by-requirement worksheet with the method, evidence reference and determination for every objective, which becomes the audit trail for the score.
Score the assessment under the scoring rules
Apply the scoring methodology in 32 CFR 170.24 to the worksheet, giving credit for each MET requirement and no credit for NOT MET results. Check the special cases before you calculate: CA.L2-3.12.4 must not be marked NOT MET, because the DoW FAQ says that produces a No Score result in SPRS. Also check whether the score reaches the Conditional threshold of 88 out of 110 under 32 CFR 170.21(a)(2). The output is a signed score sheet with the total and the list of NOT MET requirements.
Record POA&M items for open requirements
For each NOT MET requirement that the rules allow on a plan of action and milestones (POA&M), record the gap, the planned remediation, the owner and the milestone. Confirm that the six requirements that cannot appear on a POA&M (AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5) are not listed there. The output is a POA&M that matches the score sheet line by line. Closing these items later requires a POA&M closeout assessment, which 32 CFR 170.21(b) requires within 180 days of the Conditional status date.
Enter results in SPRS
Enter the results in the Supplier Performance Risk System (SPRS) with the CMMC level, status date, assessment scope, all CAGE codes in scope, the overall score and the POA&M usage and compliance status, as 32 CFR 170.16(a)(1)(i) requires. The affirming official or an authorized delegate performs the entry, and the organization confirms that the posting matches the signed score sheet. The output is an SPRS record that DoD can verify against the SSP and the score sheet.
Submit the affirmation and retain artifacts
Have the affirming official submit the affirmation in SPRS on achieving Conditional status, as 32 CFR 170.22(a)(3) requires, and confirm that the submission is recorded. Then retain every artifact used as evidence for six years from the CMMC status date, as 32 CFR 170.16(c)(4) requires. The output is a closed record set: the final SSP, the worksheet, the score sheet, the POA&M, the SPRS entry and the affirmation, stored so that each one can be produced on request.
How the 110-point score and MET rule work
A Level 2 self-assessment produces a score out of 110, and that score decides whether the contractor can claim Conditional status. Each card below covers one part of the rule set: how a requirement earns MET, how POA&M items count, which requirements can never sit on a POA&M, and what a single NOT MET can do in SPRS.
MET requires every objective
A requirement scores as MET only when every applicable assessment objective in NIST SP 800-171A is satisfied, and the supporting evidence is in final form rather than in draft. Partial coverage of a requirement is still NOT MET, so a control that is configured but not documented, or documented but not demonstrated, does not earn the point. Check each requirement against each objective, not just against the control title.
Score counts toward Conditional status
A Level 2 self-assessment earns Conditional status only when the score reaches at least 88 of 110 points, a ratio of 0.8. The total is built from requirements marked MET, so the margin above 88 is the room a contractor has for open items. Before submitting, recalculate the total from the requirement-level worksheet rather than trusting a summary figure.
POA&M items carry one point
Each requirement placed on a Plan of Action and Milestones is worth 1 point toward the Conditional threshold. The exception is SC.L2-3.13.11, which carries no point when encryption is used but the module is not FIPS-validated. Confirm the cryptographic modules in use before assigning this item's value, because it changes the arithmetic.
Six requirements cannot be deferred
AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5 may not appear on the POA&M. Any of them left unmet blocks Conditional status, so these six need working implementations before the assessment. Ask the team to confirm each one against its objectives, not only that a policy exists.
CA.L2-3.12.4 NOT MET produces No Score
The July 2026 DoW CMMC FAQ states that marking CA.L2-3.12.4 NOT MET in a Level 2 self-assessment produces a No Score result in SPRS. This requirement concerns the system security plan, so a missing or incomplete SSP can wipe out the entire submission rather than cost a single point. Verify the SSP is final and current before posting any score.
What goes into SPRS, Conditional status and POA&M closeout
A Level 2 (Self) result is only useful to a contracting officer once it is entered in SPRS in full, so the first task is to assemble the required fields before anyone submits. Under 32 CFR 170.16(a)(1)(i), the entry must state the CMMC level, the status date, the assessment scope, every CAGE code in scope, the overall score (for example, 105 out of 110), and whether a POA&M was used and what its compliance status is. Check each CAGE code against the systems and facilities named in your SSP, because a code that is missing from the entry leaves part of the scope unassessed on paper. Confirm the scope statement matches the boundary your SSP describes, including any cloud service providers and external service providers that store, process or transmit CUI.
Conditional status depends on the score rather than on a pass or fail of individual items. Under 32 CFR 170.21(a)(2), you need at least 88 of 110 points, with every POA&M item worth one point, and six requirements may not sit on the POA&M at all: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. Mark CA.L2-3.12.4 NOT MET and the DoW CMMC FAQ says SPRS will record a No Score result, so the practical rule is to finish the SSP and its plan of action before you self-assess. Once you reach Conditional status, you must enter an affirmation in SPRS under 32 CFR 170.22(a)(3). Make sure the Affirming Official understands that the affirmation is a personal statement of compliance and that the affirmation date starts the clock for the closeout.
The POA&M closeout is the step most often underestimated. Under 32 CFR 170.21(b), the closeout assessment covers only the requirements that are NOT MET on your POA&M, and it must be completed within 180 days of the Conditional status date. For Level 2 (Self), you perform the closeout yourself, and it does not need a C3PAO. Build a closeout plan now: list each open item, name the owner, record the evidence that will show it is MET, and schedule internal testing well before day 180. After the closeout, enter the updated results and a final affirmation in SPRS. Because the rule changes and the Phase II suspension are still moving, confirm the current closeout timing against the eCFR text and your contracting officer's instructions before you rely on a date.
What evidence you keep and what happens if the SSP is missing
A Level 2 self-assessment is only as defensible as the artifacts behind each score. The cards below cover how long you keep evidence, why it must be final, and how a missing or stale system security plan changes what you can score as MET. Confirm the SSP baseline with your own assessor or counsel before you enter a score in SPRS.
Six-year evidence retention
The artifacts you use as evidence for a Level 2 self-assessment must be kept for six years from the CMMC status date, not from the date the assessment was run. That means policies, configuration exports, scan reports, access review records and training logs all need a retention plan with named owners. Check whether your backup and archive tooling can hold these records unaltered for the full period and whether anyone can retrieve them on request.
Final-form evidence only
A requirement is MET only when every applicable NIST SP 800-171A objective is satisfied with evidence in final form. Draft procedures, unsigned policies and screenshots from a test environment do not count, even when the control works in production. Before scoring, walk each objective and confirm the artifact is approved, dated and tied to the systems in scope.
The SSP is itself assessed
The system security plan is not just a supporting document. Requirement CA.L2-3.12.4 covers developing and maintaining the SSP, and assessors examine it against the other requirements it describes. A plan that omits a system boundary, misstates a control or lists a deprecated tool will undermine the scoring of every requirement that depends on it.
A missing SSP cannot score MET
Without a current SSP, you cannot show how each requirement is implemented, so the objectives tied to that documentation cannot be satisfied. The practical result is lower points, and if the missing item falls in the requirements that Conditional status excludes from the POA&M, the assessment can fail to earn Conditional status at all. CA.L2-3.12.4 marked NOT MET produces a No Score result in SPRS.
Outdated SSPs lower the score
An SSP written for last year's environment can be as damaging as no SSP, because the score reflects what the document says you do. Recheck the plan after changes to scope, CAGE codes, cloud tenants, remote access or third-party services. Confirm with your assessor which changes trigger an SSP update and who signs off on each revision.
Who does what in a self-assessment
The executive owns the consequences of the result. The affirmation is made by an Affirming Official, a senior person with authority to bind the organization, and it is entered in SPRS, where DoD verifies that it was submitted. That person is accountable for the accuracy of the score and for the budget that pays for remediation, tooling and outside help. The executive does not need to perform the assessment, but must be able to explain the scope and the open items.
- Affirmation ownership: Confirm who is the Affirming Official and that this person has read the SSP, the score and the POA&M before signing.
- Funding decisions: Approve budget for remediation, tooling and any implementation partner work, based on a written scope.
- Scope decisions: Decide which systems, CAGE codes and enclaves are in scope, since these determine the score.
- Annual obligations: Assign ownership for the annual affirmation and for any POA&M closeout affirmation.
- Risk acceptance: Understand which requirements are NOT MET and whether the organization accepts the business risk while they remain open.
Check that the Affirming Official can name the score, the scope and the open POA&M items without referring to notes.
The compliance lead runs the self-assessment against the objectives in NIST SP 800-171A (June 2018), applying the scoping rules and the scoring methodology in the CMMC rule. This role decides whether each requirement is MET or NOT MET, records the evidence, and prepares the SPRS entry. The lead must judge whether evidence is in final form, because drafts do not satisfy an objective. Interviews and examinations must be backed by artifacts that a reviewer can inspect.
- Objective-level scoring: Work through each requirement's applicable objectives and mark a requirement MET only when every applicable objective is satisfied.
- Evidence review: Confirm that each artifact is final, dated and attributable to the system in scope.
- SPRS entry: Prepare the CMMC level, status date, scope, CAGE codes, overall score and POA&M usage.
- POA&M control: Track NOT MET requirements, owners and closeout dates, and confirm which items are eligible for the POA&M.
- Evidence retention: Maintain artifacts for six years from the CMMC status date.
Verify that the lead can explain the scope boundary and show how each MET decision traces to a specific artifact.
An implementation partner such as DeployOpen prepares systems, configurations and evidence for the organization to review. Its work is paid for under a written scope and typically covers hardening self-hosted platforms, documenting configurations, producing logs and records, and organizing artifacts. The partner cannot mark requirements MET on the organization's behalf, sign the affirmation, or submit the SPRS entry. Those decisions and actions remain with the organization.
- System preparation: Configure and harden in-scope systems to the requirements, inside the client's own infrastructure.
- Evidence production: Generate configuration records, access reviews, audit log samples and scan outputs that the organization can examine.
- SSP drafting support: Help draft the System Security Plan, which the organization must review and approve before it is final.
- Gap remediation: Close technical gaps identified in the organization's own review, with change records.
- Knowledge transfer: Document procedures so the organization can operate and re-evidence the controls after the engagement.
Ask the partner to state in writing which tasks it performs and which remain with your staff.
The independence boundary determines who may issue a result. For a Level 2 (Self) assessment, no outside party issues the outcome. The organization performs the assessment, determines the score and submits the result in SPRS. For a Level 2 (C3PAO) certification, only a C3PAO authorized or accredited by The Cyber AB can perform the assessment and issue the certification. An implementation partner may help prepare for either path but cannot stand in for the assessor.
- Self-assessment outcome: The organization owns the MET and NOT MET decisions and the resulting score.
- Certification outcome: Only a C3PAO issues a Level 2 (C3PAO) certification, subject to the rules in force at the time.
- Conflict of roles: Avoid having the same party both prepare evidence and act as the assessor for that evidence.
- Program status: Check the current status of CMMC phases with the Department of War before planning, since schedules have changed.
- Contract requirements: Confirm with the contracting officer which level and assessment type the contract requires.
Confirm the assessment path in your contract and the current program status before committing budget.
What a Level 2 self-assessment costs and who gets paid
This table lists each cost component of a Level 2 self-assessment, who is paid for it, whether it is one-time or recurring, and what drives it up. Use it to check a quote line by line, since the DoD estimate is a per-assessment figure that does not split the work between your staff and outside firms.
| Cost component | Who is paid or who bears it | One-time or recurring | What drives the cost |
|---|---|---|---|
| Internal staff time | Your own employees (no external invoice) | Mostly one-time, repeats each cycle | Size of the boundary, number of systems and how many people must review evidence |
| SSP and evidence preparation | Your staff, or an implementation partner under a written scope | One-time, then updated as the system changes | Number of assets in scope, how documented existing practices already are, and the number of CAGE codes |
| Technical remediation and tooling | Internal IT, licensed vendors, or a partner for configuration work | One-time for fixes; licenses and tools recur | Gaps against the 110 requirements, cloud or on-premises hosting, and whether tools are open source or licensed |
| Implementation partner scoped work | Partner firm, under a fixed scope with written deliverables | One-time per engagement; optional retainers recur | Scope boundary, number of systems, and whether the partner prepares evidence only or also remediates |
| Independent consultant review | An outside reviewer you choose, if you choose one | Optional, usually one-time before submission | Depth of review and whether the reviewer also prepared your evidence, which can affect independence in your own review |
| Affirmation | Your Affirming Official's time, plus SPRS entry | Initial affirmation, then annual affirmations | Internal governance time; the affirmation itself carries no separate fee in the supplied facts |
| POA&M closeout assessment | You perform it for Level 2 (Self), within 180 days of Conditional status | One-time, only if you reach Conditional status | Number of NOT MET items on the POA&M and how much rework is needed |
| Evidence retention storage | Your IT team, or your cloud or storage provider | Recurring for six years from the status date | Volume of artifacts, log retention settings and whether evidence is kept in final form |
| DoD estimate (per assessment) | Reference figure only, from the DoD Regulatory Impact Analysis in the CMMC final rule (15 October 2024) | The DoD estimated $43,403 per assessment for other-than-small entities and $34,277 for small entities, including initial affirmation | Three-year totals of $48,827 and $37,196 cover one assessment cycle with two annual affirmations; ask your quote to itemize against the components above |
What makes a self-assessment cost more or take longer
A Level 2 self-assessment takes longer when the boundary is large, the environment is spread out, and the evidence is still in draft. The cards below cover the variables that move effort most, so you can size the work before you ask for a quote.
Scope size and CUI boundary
The number of systems that store, process or transmit CUI sets the size of every requirement you must test. A narrow boundary with clear enclave edges lets the assessor sample a small set of components, while a boundary that pulls in shared email, file shares and admin workstations multiplies the objectives to examine. Before you start, draw the boundary and confirm with your sponsor which systems are truly in scope.
Enclaves and CAGE codes
Each enclave, and each CAGE code whose facilities or entities fall within scope, adds a set of configurations, access reviews and policy records that must be shown separately. The overall score in SPRS must list every CAGE code in scope, so an unplanned code discovered late forces rework on the scope statement. Ask whether any subsidiary or site shares CUI systems with you, and document that answer early.
System count and inventory accuracy
The more systems in scope, the more asset records, baselines and patch histories an assessor will check. Inventory gaps are a common source of delay, because a server or SaaS tenant missing from the asset list can invalidate sampled evidence. Reconcile your inventory against cloud accounts, identity directories and network scans before the assessment window opens.
Locations and alternate work sites
Each physical site that houses in-scope systems adds visitor logs, badge records, camera retention checks and physical access reviews. Remote staff who handle CUI from home or travel add alternate work site controls and device checks for each location type. List every site and work arrangement in the scope statement so the sampling plan covers them.
Third-party and cloud dependencies
When a cloud provider, managed service or subcontractor stores or processes CUI, its responsibilities must be shown in your System Security Plan and supported by the contract terms and inherited control evidence you hold. Missing shared responsibility matrices or unsigned flowdown terms can stall a review. Collect those documents from each provider before testing begins, and confirm which controls they inherit and which you still own.
Evidence maturity and NOT MET items
Final-form evidence that already exists is far faster to assess than policies in draft or screenshots gathered on the day. Each NOT MET item must be checked against the POA&M rules, and CA.L2-3.12.4 marked NOT MET produces a No Score result in SPRS. Count your NOT MET items early, because every one either needs a fix before scoring or a POA&M entry with a closeout plan.
Does the July 2026 Phase II suspension change the self-assessment?
The suspension does not remove the self-assessment obligation. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start on 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. It also suspended later implementation milestones and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and the DFARS 252.204-7012 obligations remain in place. If your contracts require Level 2 (Self), the work described on this page still applies, and the SPRS score, the Conditional status rules and the POA&M closeout deadline do not pause while the review runs.
The schedule itself is less settled than the rule text suggests. The DoW CIO About CMMC page stated, as of 17 October 2026, that implementation is paused in Phase 1, which began on 10 November 2025, and that it may only require self-assessments at Levels 1 and 2. The eCFR text of 32 CFR 170.3(e) still contains the original four-phase schedule. Treat the DoW CIO page as the current operating signal, but do not assume the eCFR has been updated. Check the Task Force outcome and any published changes to the rule before you set internal deadlines that depend on the phase dates.
Confirm what your own contracts say before you plan around the suspension. The DFARS clauses that carry CMMC into a solicitation or contract, such as 252.204-7021 and 252.204-7025, determine which level and assessment type applies to you. Ask your contracting officer in writing which level is required, whether a self-assessment or a C3PAO certification is expected, and whether any option periods or subcontract flowdown terms will change. Record the answer with the contract modification or correspondence in your evidence file, so the basis for your SPRS posting can be shown later.
Common questions about running a Level 2 self-assessment
Can our organization run a CMMC Level 2 self-assessment without outside help?
Yes. A Level 2 (Self) assessment is performed by the organization itself, and the organization owns the result, the SPRS entry and the affirmation. Nothing in the rule requires a consultant or assessor for this path. What you need is an internal team that can read the NIST SP 800-171A objectives, map each of the 110 requirements to systems in scope, and collect evidence in final form. Outside help is optional and usually covers gap analysis, evidence preparation or a second reviewer. Confirm the current assessment path with your contracting officer, since the Department of War suspended Phase II in July 2026 and the rules for which level a contract requires are still changing.
How long does a CMMC Level 2 self-assessment take?
No duration is fixed by the rule, so the length depends on what drives the work: the number of systems and CUI enclaves in scope, how many requirements are already met with documented evidence, how many SSP sections need rewriting, and how many people must be interviewed. Organizations with a current SSP and centralized logging usually spend far less time than those starting from scratch. Build a schedule from your own inventory and gap list, and ask any consultant to show the task breakdown behind their estimate before you commit to a date.
What does the work need from our internal staff?
The assessment needs named owners for each requirement family, usually IT, security, HR, facilities and the program manager. Someone must own the System Security Plan, because the assessment cannot be scored without it. Staff must be available to demonstrate controls, answer interview questions and produce artifacts such as access reviews, audit log samples and training records. Expect the security lead to spend significant time reviewing objectives against evidence. Plan for these people to be pulled from operations, and confirm their availability before you set a target date.
Can an outside firm prepare our evidence for the assessment?
An implementation partner can prepare systems, configure logging and access controls, write or revise policies and organize the evidence folder. DeployOpen works this way: it prepares systems, controls and evidence for compliance assessments, but it does not issue audit reports, attestations or certifications. The organization still owns its controls and its SPRS submission, and the Affirming Official must personally affirm the result. Ask any firm to state in writing which tasks it performs, which remain yours, and whether it will sign off on scoring. Get the scope and deliverables agreed before work starts.
What happens if we receive a Conditional status?
A Conditional status is available only when the score is at least 88 of 110 points and the requirements left NOT MET meet the rules for a Plan of Action and Milestones (POA&M). Six requirements cannot appear on the POA&M at all: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. Each POA&M item is worth one point, with one exception for SC.L2-3.13.11 when encryption is used without FIPS validation. The affirmation on a Conditional status is entered in SPRS. A POA&M closeout assessment must be completed within 180 days of the Conditional status date, and it checks only the NOT MET items. For Level 2 (Self), the contractor performs that closeout.
How long must we keep evidence from a self-assessment?
The rule requires contractors to keep the artifacts used as evidence for a Level 2 self-assessment for six years from the CMMC status date. Keep the final-form versions, not drafts, along with the dated records that show each control was operating when assessed. Store them in a location you control, with access restricted and integrity protected, such as hashed files in a versioned repository. Confirm retention with your contracting officer and your records team, because contract and legal holds can extend it.
What does the self-assessment cost in DoD's estimate?
DoD's CMMC final rule estimated a Level 2 self-assessment plus initial affirmation at $43,403 per assessment for an other-than-small entity and $34,277 for a small entity, as set out in the Regulatory Impact Analysis of the 15 October 2024 Federal Register rule. Its three-year totals, covering one assessment cycle with two annual affirmations, were $48,827 and $37,196. These are government estimates, not quotes. Your actual cost depends on staff time, tooling, remediation of gaps and any outside help, so build your own estimate from the scope you define.
How DeployOpen prepares systems and evidence for a self-assessment
DeployOpen's part in a Level 2 self-assessment starts with a written scope. Before any work begins, the scope should name the systems that store, process or transmit CUI, the CAGE codes in scope, the external service providers involved and the assessment objectives from NIST SP 800-171A (June 2018) that apply to each system. DeployOpen plans, hardens and configures self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, so the boundary is drawn in the client's environment and the client's staff keep control of their own tenancy. Ask for the scope, deliverables and timeline in writing, and check that the document states which requirements are configured by DeployOpen and which remain the client's own operating duties.
Hardening and configuration work covers the technical requirements such as access control, audit logging, configuration baselines, encryption and vulnerability management, mapped to the 110 Level 2 requirements through their CMMC IDs (for example AC.L2-3.1.1). Each change is recorded with its date, its owner and the requirement it supports, so the system security plan describes what is actually running. The organization still decides how each control operates in daily work, who approves changes and how often reviews happen. Where a requirement cannot be met by configuration alone, the team documents the gap so that it can be scored under the POA&M rules in 32 CFR 170.21 rather than hidden in the configuration record.
Evidence preparation is the step most often underestimated. DeployOpen prepares evidence folders organized by requirement, with final-form policies, configuration exports, log samples, access reviews and test results that an assessor can examine without asking for drafts. Under 32 CFR 170.16(c)(4), the artifacts used as evidence must be kept for six years from the CMMC status date, so the folder structure, storage location and retention owner should be agreed before the first assessment. Be clear about the boundary of responsibility: the organization owns its controls and makes the affirmation in SPRS, and DeployOpen does not issue scores, reports or certificates. Any SPRS entry, affirmation or Conditional status is the client's submission, and assessments at Level 2 are carried out by the organization itself or by an assessor the organization engages.
How DeployOpen prepares your CMMC Level 2 self-assessment
DeployOpen prepares the systems, controls and evidence that a Level 2 self-assessment depends on, inside your own infrastructure. Your organization owns its controls and the affirmation, and only the self-assessment results you enter into SPRS carry your name.
How we scope
- Engagements are fixed-scope, with the systems, CUI boundary and CAGE codes agreed in writing before work starts.
- We map in-scope assets against the 110 Level 2 requirements to show which controls apply to each system.
- We confirm the assessment scope and specialized assets so the SSP and SPRS entries match the boundary you define.
How we build
- We configure self-hosted open-source platforms for access control, logging, configuration baselines and vulnerability scanning inside your environment.
- We test each requirement against the NIST SP 800-171A objectives and record gaps that need a POA&M or remediation.
- We produce evidence in final form, such as configuration exports, log samples and scan reports, and retain it for six years.
How we hand over
- We deliver the system security plan, policies, procedures and evidence index written for your assessors to review.
- We document a scoring worksheet that explains how each objective was met, partially met or not met, with supporting artifacts.
- We walk your team through the evidence set so your Affirming Official can sign with a clear understanding of the results.
How we support
- Ongoing support, upgrades and continuous security testing are available as a retainer after handover.
- We can help prepare for a POA&M closeout assessment within the 180-day window if your status is Conditional.
- Your organization decides on affirmations and submissions, and independent assessors issue any certification-level reports.
