Many Managed Service Providers (MSPs) hear “self-assessment” and think they can relax.
No third-party assessor
No audit pressure
Just a simple internal review
Pretty manageable… right?
In reality, most CMMC assessments fail long before an assessor even gets involved because they are treated too casually.
Self-assessments do not mean having a low standard for your organization.
It means you are responsible for holding the acceptable standard to pass your actual assessment.
“It’s Just Internal”
It is a dangerous mindset to assume a self-assessment is informal.
You have to approach your self-assessment the same way you would approach your actual assessment:
- same level of detail
- same level of scrutiny
- same level of expectation of evidence
And if your process doesn’t hold up for yourself, it surely will not hold up in front of an assessor.
If You Don’t Start at the Objective Level, You’re Already Behind
Here is where a lot of teams go wrong immediately.
They open up NIST 800-171 and review controls at a high level.
That isn’t enough.
You have to go deeper: all the way down to the 320 assessment objectives in NIST 800-171a.
That means:
- A structured assessment spreadsheet
- Every control broken into objectives
- Clear “Met” and “Not Met” tracking
- A place to document findings and evidence
If you aren’t working at that level, you aren’t doing a real self-assessment…
You’re treading water.
Stop Reinventing the Process Every Time
This cannot be emphasized enough:
Create predefined test procedures.
Without them, every assessment turns into:
- “How do we test this again?”
- “Where do we look?”
- “What counts as evidence?”
This isn’t scalable and it’s not reliable.
Instead, you need to define:
- What evidence is required
- Where to find it
- How to validate it
So now, instead of guesswork each time, your process becomes:
Open→ Follow predefined procedures→ Validate→ Document→ Done
No more inconsistency.
Time: Friend or Foe?
Let’s talk reality.
Some control families (ex. Access Control) are a grind.
We’re talking about:
- Deep technical validation
- Documentation review
- Cross-system checks
It is not unusual for a single domain to take hours to assess properly.
Now multiply that by all control families and all clients.
This is where MSPs start feeling the weight.
Because self-assessments are not quick. They are heavy.
So, setting the appropriate amount of time aside is crucial to your success.
The Requirement People Forget
Self-assessments are not optional.
They are built directly into controls.
You are required to:
- Assess security controls at least annually
- Validate effectiveness
- Document the results
And it doesn’t stop there…
You also have to:
- Affirm compliance every year
- Maintain records in SPRS
- Be ready to show your history for up to six years
The Six Year Saga
Here is the fun part:
You must retain self-assessment records for six years.
That means:
- Evidence
- Findings
- Assessment results
- Historical documentation
All of it.
So, when an assessor asks you:
“What did your environment look like 4 years ago?”
You need hardcopy evidence of an answer. Not just a guess.
Mind The Gap
You will find “Not Met” controls in your first self-assessment.
That’s expected and a good thing.
What matters is what you do next.
These gaps go into:
- Plans of action
- Tracked remediation efforts
- Ongoing fixes
But here’s the catch:
A POA&M is not a shortcut to compliance.
You cannot rush a self-assessment just to produce one.
You earn it by:
- Actually preforming the assessment
- Identifying real deficiencies
- Working to resolve them
Anything else misses the point.
No SSP? You’re Done Before You Begin
This can hit hard, but it’s true.
If you do not have a system security plan (SSP), nothing else matters.
You can have antivirus, logging, and access controls all day.
But without an SSP, how does the assessor know the controls exist?
As far as they see… they don’t.
Self-Assessments Are a Discipline Problem
At the end of the day, self-assessments aren’t easier than third-party assessments.
They just remove the supervision.
Which means your success comes from:
- Structure
- Consistency
- Documentation
- Accountability
No shortcuts.
No guessing.
No “close enough”.
Because in CMMC, there is no such thing as “just internal”.
If you are navigating your own CMMC journey as an MSP and want deeper insight to what it really takes, listen to our podcast, Climbing Mount CMMC. Or feel free to reach out to us. We’d love to talk.