Self-Assessment Has Limits — Know Your Path Before You Submit

This tool generates a NIST SP 800-171 Basic Assessment score using the official DoD Assessment Methodology v1.2.1: start at 110 points, deduct 1, 3, or 5 points per unmet control. That score is required in SPRS under DFARS 252.204-7019 / 7020 for every contractor handling CUI.

Self-assessment is NOT the same as CMMC Level 2 Certification. Under CMMC 2.0, the majority of contracts handling CUI require a C3PAO-conducted certification assessment, not self-assessment. Self-assessment is permitted only for a limited subset of L2 contracts. Verify your required assessment type in your contract, DD-254, or with your contracting officer before relying on a self-assessed score for compliance.

POA&M caveats at L2:

• Not every control is POA&M-eligible. Controls weighted at 5 points (the highest tier) are generally NOT eligible and must be fully implemented before submission.
• For CMMC 2.0 conditional certification, POA&M items must be closed within 180 days or the certification lapses.
• Partial implementation takes the full point deduction under the DoD Assessment Methodology.

Annual senior official affirmation in SPRS is required regardless of whether you self-assess or certify via a C3PAO. Submitting a false or inflated score creates False Claims Act liability. Score each control honestly based on what is actually implemented.