CMMC Level 2 Assessment: How a C3PAO Certifies You

By Shaheer Malik · Updated Oct 22, 2026

A CMMC Level 2 certification assessment is an evaluation of the systems that handle your Controlled Unclassified Information, carried out by an authorized or accredited C3PAO against the 110 requirements of NIST SP 800-171 Rev. 2. The C3PAO enters the result into eMASS, it flows to SPRS, and the status lasts three years with an affirmation every year.^[1][2]

Self-assessment or certification?

The contract decides. Level 2 (Self) is done by your own team; Level 2 (C3PAO) is done by an outside assessor. A Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self) for the same scope.^[1] See self-assessment vs C3PAO.

What gets assessed

The CMMC Assessment Scope is the set of assets the requirements apply to. The rule sorts them into categories: CUI Assets (anything that processes, stores or transmits CUI), Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets.^[1] Keeping CUI in a smaller enclave shrinks what has to be assessed.

If you use a cloud service for CUI, it must be FedRAMP Authorized at Moderate or higher, or meet equivalent requirements.^[1]

How it is scored

Every requirement is found Met, Not Met or Not Applicable, based on evidence in final form; drafts and working papers do not count.^[1] The maximum score equals the number of requirements. Each Not Met requirement subtracts 1, 3 or 5 points depending on its weight, so a score can go negative.^[1]

Conditional and Final status

You receive a Conditional Level 2 (C3PAO) status only if all of these hold: your score is at least 80 percent of the maximum; every open item on your Plan of Action and Milestones is a 1-point requirement (FIPS-validated encryption is the one 3-point exception); and none of six named requirements, including the System Security Plan, is open.^[1] You then have 180 days to fix the open items and pass a close-out assessment by the C3PAO; if you miss it, the Conditional status expires.^[1] Meet every requirement and the status is Final.

Evidence and records

You hash the artifacts used as evidence with a NIST-approved algorithm, give the C3PAO the list of names and hashes for upload into eMASS, and keep the artifacts for six years.^[1]

After the assessment

A senior Affirming Official affirms continued compliance at the assessment and every year after; the next certification assessment is due within three years.^[1]

Before you book

Most companies run a readiness or gap assessment first, in-house or with a CMMC consultant, then book a firm from the C3PAO list. DoD estimates the assessment itself at about $101,752 for a small business.^[3]

FAQ

Who can perform a CMMC Level 2 certification assessment?

Only an authorized or accredited C3PAO (CMMC Third-Party Assessment Organization). RPOs and consultants can help you prepare but cannot certify you.

What score do I need to pass CMMC Level 2?

A Final status needs every requirement Met. A Conditional status needs at least 80 percent of the maximum score with only allowed items open, closed out within 180 days.

How long is a CMMC Level 2 certification valid?

Three years from the status date, with an affirmation of continued compliance every year.

What happens if I fail the POA&M close-out?

If the open items are not closed out within 180 days of the Conditional status date, the Conditional status expires.

Sources

1. 32 CFR part 170, CMMC Program (eCFR, text current as of Aug 17, 2026) (checked Oct 22, 2026)
2. NIST SP 800-171 Revision 2: Protecting Controlled Unclassified Information in Nonfederal Systems (checked Oct 22, 2026)
3. Cybersecurity Maturity Model Certification (CMMC) Program, 32 CFR part 170, 89 FR 83092 (Oct 15, 2024) (checked Oct 16, 2026)