Back to Knowledge Center
Assessment5 min read
Self-Assessment vs. C3PAO Assessment: Which Do You Need?
Level 1 is always self-assessed. Most Level 2 contracts now require a C3PAO. Level 3 is government-led. Here's how to determine which applies to your contracts.
CMMC uses different assessment approaches for each level, and even within Level 2, there is a distinction between prioritized and non-prioritized acquisitions.
| Level | Assessment type | Who conducts it | Frequency |
|---|---|---|---|
| Level 1 | Self-assessment | Contractor | Annual |
| Level 2 (non-prioritized) | Self-assessment | Contractor | Annual |
| Level 2 (prioritized) | Third-party assessment | Accredited C3PAO | Every 3 years + annual affirmation |
| Level 3 | Government-led assessment | DCSA | Every 3 years + annual affirmation |
How to tell if your contract is “prioritized”
The contracting officer specifies the required CMMC level and assessment type in the solicitation. If DFARS 252.204-7021 specifies Level 2 and requires C3PAO assessment, your contract is in the prioritized category. When in doubt, contact your contracting officer.
Cost comparison
- ✓Level 1 self-assessment: primarily staff time (typically 20–80 hours total)
- ✓Level 2 self-assessment: staff time plus documentation costs (50–150 hours)
- ✓Level 2 C3PAO assessment: DoD estimates $105,000–$118,000 in direct assessment fees; additional costs for preparation and remediation
Don't underestimate self-assessment rigor
A Level 1 or Level 2 self-assessment is not a formality. The senior official affirmation carries legal weight under the False Claims Act. Overinflating your SPRS score is fraud.
Ready to start your CMMC journey?
Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.
More in Assessment