Self-Certify: Can I Do CMMC Alone?
2017 called, it wants its “self-certify” back.
Sorry, DoD said, “No.”
If you’ve been in the Defense Industrial Base (DIB) for a while, you may assume that CMMC is just another regulation that requires the same amount of effort as past cybersecurity initiatives. For many organizations, understanding the pitfalls of self-certification under CMMC is essential to maintaining eligibility for Department of Defense contracts.
The Three Certification Levels
Before we dive into what exactly self-certification entails, let’s go over what the three levels of CMMC look like:
- Level 1: Basic cybersecurity practices based on 17 requirements from NIST SP 800-171.
- Level 2: Advances practices based on 110 NIST SP 800-171 requirements for protecting CUI.
- Level 3: A high-level standard based on a subset of NIST SP 800-171; for the most sensitive projects.
CMMC is a unified standard for implementing cybersecurity controls across the DIB. It was developed to ensure companies protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) adequately and to the government’s standards.
What Does Self-Certify Mean?
CMMC is built to protect CUI across the DIB. That means real cybersecurity controls, real documentation, and eventually, a third-party audit. Telling yourself you’re “close enough” or assuming your IT team has it covered doesn’t cut it anymore.
Self-assessing might feel like it saves time and money now, but what happens when your prime contractor asks for your System Security Plan (SSP), your Plan of Action and Milestones (POA&M), or your evidence of implementation? What happens when audit time comes around?
If your answer is, “we’re working on it” or “we’ll figure it out when the day comes,” those federal contracts might not be yours much longer.
What Does Self-Assessing Look Like?
In order to self-assess with CMMC (which is currently only allowed for OSCs at Level 1 and some of Level 2), an organization must be focused on safeguarding the 17 basic cybersecurity practices aligned with FAR 52.204-21. As aligned in 32 CFR, the company must then conduct an internal assessment to verify that all 17 practices are implemented, document the results, and submit an annual affirmation through the Supplier Performance Risk System (SPRS) (83227).
While self-assessments offer a streamlined path for small and mid-sized businesses, it comes with serious accountability. If something is incorrect or not accurate in your claim, it can result in penalties under the False Claims Act. Importantly, higher CMMC levels (2 and 3) require third-party or government-led assessments when handling CUI. Forgoing a third-party assessment and choosing to self-certify is not always allowed. Actually, most of the time, a CMMC Level Certification will be required. This is done by a Certified Third-Party Organization.
Additionally, if a contractor plans to grow or handle CUI in the future, self-assessing may quickly become obsolete.
The Risks of Self-Assessment Are Too High
- Loss of contract eligibility
- Failure to pass a future C3PAO audit
- Damaged reputation
- Potential legal exposure under False Claims Act
CMMC is more than just an easy, one-time project. It’s a culture of accountability, and the DoD has made it clear: contractors are expected to demonstrate (not just claim) compliance.
Do It Right from the Start
As an MSP supporting companies on the path of CMMC readiness, we don’t just recommend avoiding self-assessments; we strongly advise you bring in a service provider that can share with you their systems and knowledge. That means:
- A real gap assessment
- Documentation that’s already been through an audit
- Tools and systems designed for evidence tracking and compliance posture
- A scalable roadmap to CMMC level 2
This is about protecting your business, your contracts, and ultimately, the government supply chain. There’s no short cut worth the risk.
If you’re serious about federal work, to “self-certify” isn’t a strategy. It’s actually a liability.
Let the Axiom team talk to you about doing CMMC right the first time. Reach out.
If you’re looking to learn more about the CMMC landscape and its entirety, check out our podcast.