On this page
The short answer
Level 2 does not automatically mean one assessment type. Some Level 2 contracts require a self-assessment. Others require a C3PAO certification assessment. The solicitation or contract requirement decides which path applies.
That distinction matters because buyers often ask for certification help before they know whether their solicitation requires Level 2 (Self) or Level 2 (C3PAO).
How the assessment paths differ
| Path | Who performs it | Where results go | When it is used |
|---|---|---|---|
| Level 1 Self | The organization | SPRS | FCI-only requirements |
| Level 2 Self | The organization | SPRS | Certain Level 2 solicitations and contracts |
| Level 2 C3PAO | An authorized or accredited C3PAO | CMMC eMASS / associated DoD processes | Future or contract-specific certification path; the general Phase II rollout is suspended |
| Level 3 DIBCAC | DCMA DIBCAC | DoD process | Future or government-directed path; verify current contract-specific direction |
What Phase 1 means in practice
On July 13, 2026, the Department suspended Phase II implementation requirements and paused CMMC in Phase I. The current official page says Phase I may require Level 1 and Level 2 self-assessments; the former Phase II C3PAO rollout date is no longer current.
Contractors should continue protecting CUI, maintain the applicable self-assessment and affirmation posture, and verify any different assessment language directly in the solicitation, contract, or contracting-officer guidance.
Conditional status vs final status
For Level 2, the rules allow conditional status when the assessment results include an allowable POA&M and the company otherwise meets the required scoring threshold and conditions. That conditional status only stays current for up to 180 days, and the POA&M closeout has to happen inside that window.
Final status is what companies should be aiming for operationally, even if a conditional path exists. A conditional status is not free extra time. It is a short, regulated closeout period with real consequences if the items are not remediated.
What readiness support should promise
A readiness provider should help the client understand the applicable path, prepare the scope, remediate gaps, organize evidence, and coordinate the right next step. It should not say it will certify the client. Formal Level 2 certification assessments are performed by authorized or accredited C3PAOs, not by advisory firms selling readiness work.
That distinction helps both trust and compliance. Velocity CMMC supports readiness, implementation, documentation, and managed compliance without presenting advisory work as a formal certification assessment.
How to decide what to do next
- Read the solicitation or subcontract language carefully. Do not guess the assessment type.
- Confirm whether the relevant information is FCI, CUI, or both.
- Define the assessment scope before scheduling anything external.
- Build a readiness package that stands up whether the contract ends up requiring a self-assessment or a C3PAO assessment.
- Track annual affirmations and current-status dates just as closely as the technical controls.
Frequently asked questions
Who performs a Level 2 self-assessment?
The organization seeking assessment performs its own Level 2 self-assessment and uploads results to SPRS.
Who performs a Level 2 certification assessment?
An authorized or accredited C3PAO performs the Level 2 certification assessment.
Do we get to choose self-assessment or C3PAO?
Not by preference alone. The solicitation or contract requirement determines which Level 2 assessment path applies.
What does the Phase II suspension mean for C3PAO requirements?
The July 13, 2026 update suspended Phase II implementation requirements and says CMMC is paused in Phase I, which may require Level 1 and Level 2 self-assessments. Verify any different contract-specific direction with the contracting officer.
What is conditional Level 2 status?
Conditional status is the temporary Level 2 status available when an allowable POA&M exists and the assessment otherwise meets the applicable conditions. It must be closed out within 180 days.
What is final Level 2 status?
Final status means the company has achieved a passing result without any remaining allowable POA&M items, whether on the initial assessment or after closeout.
Can a readiness consultant certify us?
No. Readiness firms can support scoping, remediation, documentation, and preparation. Formal Level 2 certification assessments are performed by C3PAOs.
Why should we prepare like a C3PAO assessment even if we think we only need self-assessment?
Because strong scoping, evidence, and control implementation shorten the path either way, and contract requirements can tighten over time.
Related articles
Official sources reviewed
Use this guide to plan readiness and communicate clearly with buyers, primes, and internal stakeholders. Contract language, current regulations, and assessor guidance control.
Want help turning this into a real readiness plan?
Velocity CMMC can scope the environment, map CUI flows, organize the documentation package, support remediation, and help your team prepare for the right assessment path without pretending to be the certifier.