Skip to content
Compliance DirectoryGet quotes

How to Get CMMC Certified: 9 Steps for 2026

By Shaheer Malik · Updated Oct 28, 2026

To get CMMC certified, confirm the level your contract requires, scope where FCI or CUI lives, close the gaps against the requirements, document them in a System Security Plan, then complete the required assessment (a self-assessment, or a C3PAO for Level 2 certification), enter the result in SPRS and have a senior official affirm it.[1]

The steps

  1. Confirm the level. The solicitation names it through the CMMC clause and notice, DFARS 252.204-7021 and 252.204-7025.[2] See which level do I need.
  2. Scope the environment. Specify the CMMC Assessment Scope before assessment: the assets that process, store or transmit FCI or CUI, plus the security tools and providers that protect them.[1] See CMMC assessment scope.
  3. Run a gap assessment. Check each requirement (15 at Level 1, 110 at Level 2) against the assessment objectives of NIST SP 800-171A.[1]
  4. Remediate and document. Fix what is missing and write the System Security Plan: how each requirement is implemented and how assets are treated.[1]
  5. Score yourself. Use the CMMC scoring method (a maximum of 110 at Level 2, minus each requirement not met) so you know where you stand; self-assessment results go into SPRS. See SPRS score.[1]
  6. Book the assessment. For Level 2 (C3PAO), pick an authorized C3PAO from the Cyber AB Marketplace; only C3PAOs can certify you.[3][1] Compare them in our C3PAO list.
  7. Get assessed. The C3PAO enters results in the CMMC eMASS, which feeds SPRS; self-assessments go straight into SPRS.[1]
  8. Affirm. Your Affirming Official affirms continuing compliance in SPRS after the assessment and every year.[1]
  9. Close any POA&M within 180 days. A Conditional status expires if the open items aren’t closed out in time.[1]

Level 1 is not a certification

At Level 1 you self-assess every year against 15 requirements and affirm; there is no certificate and no POA&M.[1] See Level 1 requirements.

In 2026

Third-party certification is suspended as a routine requirement: since September 3, 2026 contracts may require Level 1 (Self) or Level 2 (Self).[4] Steps 1 to 5 and 7 to 9 still apply to a self-assessment, and companies whose customers ask for a C3PAO certification can still get one.

Want to be certified as a person?

Individuals don’t get CMMC certified; assessors and professionals do. See how to become a CMMC assessor.

Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.

FAQ

How do I get CMMC Level 2 certification?

Scope your CUI environment, meet the 110 NIST SP 800-171 Rev. 2 requirements, document them in an SSP, then hire an authorized C3PAO. It enters the result in eMASS and SPRS; you affirm and close any POA&M within 180 days.

Who issues CMMC certification?

An authorized or accredited C3PAO issues the Certificate of CMMC Status for Level 2; DCMA DIBCAC issues it for Level 3. Level 1 and Level 2 (Self) are self-assessments without a certificate.

Can I get CMMC certified on my own?

You can do all the preparation yourself. The Level 2 certification assessment itself must be done by a C3PAO; Level 1 and Level 2 (Self) you assess yourself.

Sources

  1. 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
  2. Class Deviation 2026-O0025, Revision 3, Attachment 1: revised DFARS part 240 (Sep 3, 2026) (checked Oct 28, 2026)
  3. Cyber AB Marketplace (checked Oct 28, 2026)
  4. Class Deviation 2026-O0025, Revision 3: FAR Overhaul Part 40, DFARS Part 240 (Sep 3, 2026) (checked Oct 28, 2026)

More on getting certified

Get quotes from matching firms

Describe what you need once. It goes to up to 3 matching firms, never published or sold.

Request quotes

Independent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.