Self-attestation under CMMC Level 2 is quickly becoming one of the most misunderstood (and potentially dangerous) areas of compliance for defense contractors. On a recent episode of Climbing Mount CMMC, we unpack why self-attestation isn’t just a paperwork exercise, but a serious legal and operational responsibility that organizations need to treat with care.
At its core, self-attestation requires an organization to formally state that it meets all applicable CMMC Level 2 requirements. While that may sound simple, the expectations behind that statement have changed dramatically.
The Evolution of Self-Assessment Expectations
The days of informal self-assessments and “best effort” compliance are fading fast. The Department of Defense is raising the bar, and contractors are expected to fully understand, and accurately represent their security posture. Self-attestation now requires discipline, and a clear understanding of what compliance actually means. Organizations that haven’t evolved their self-assessment practices risk falling behind the new reality of CMMC enforcement.
The Real Risk of Misrepresentation
One of the most significant dangers discussed is misrepresentation. Whether intentional or accidental, claiming compliance without having the required controls in place can expose an organization to serious consequences. This extends beyond contract loss to potential False Claims Act exposure, audits, and long-term legal risk.
Another often-overlooked risk is whistleblower exposure. Employees, contractors, or partners who believe an organization has misrepresented its compliance status are protected under federal law. Internal shortcuts or rushed attestations can quickly become external investigations. Once allegations arise, the burden shifts to the organization to prove its claims.
And in today’s environment, “we thought we were compliant” is not a defense.
Evidence Matters More Than Intent
Good intentions do not replace evidence. Organizations must be able to demonstrate compliance through documented policies, procedures, configurations, logs, and records. If compliance cannot be proven, it effectively does not exist. This is one of the most common failure points in self-attestation, and one of the easiest to avoid with proper preparation. Because when you go to log your SPRS score, you are affirming that your organization is compliant to ALL 110 security controls. The Whistleblower Factor
Leadership Accountability Cannot Be Delegated
Self-attestation is not just an IT responsibility. Senior leadership is ultimately accountable for the accuracy of compliance claims. Treating self-attestation as an administrative task increases the likelihood of mistakes. And mistakes in this space can be costly. Which is why leadership engagement is essential to ensure compliance is real, documented, and defensible.
Understanding CMMC Is Everyone’s Responsibility
The transition from self-attestation to third-party assessments is coming. Organizations that cut corners now will face greater challenges later. Preparing early and well ahead of contract deadlines allows time to identify gaps, remediate issues, and strengthen documentation. Self-attestation should be treated as a steppingstone, not a shortcut.
Your CMMC compliance is not limited to one department. Leadership, compliance teams, IT, and contracting staff all need a shared understanding of what is required and why it matters.
When everyone understands the rules, self-attestation becomes more than a requirement…it becomes a safeguard. Have questions? Feel free to reach out. Or check out our podcast channel.