Not every defense contractor needs to hire a C3PAO. The CMMC program includes both self-assessment and third-party assessment pathways, and understanding which one applies matters, because the DoD estimates the two paths differently (a Level 2 self-assessment at $37,196 for a small entity versus $104,670 for a C3PAO certification assessment over three years, 89 FR 83092).
Your assessment path is set by the solicitation or contract, which names the CMMC level and, at Level 2, whether the assessment is Self or C3PAO. This guide sets out the rules so you can plan and budget.
CMMC Level 1: self-assessment only
If your contracts involve only Federal Contract Information (FCI) and you need CMMC Level 1, the path is straightforward: self-assessment. You evaluate your compliance against the 15 basic safeguarding requirements of FAR 52.204-21, enter the results in the Supplier Performance Risk System (SPRS), and repeat the self-assessment and the affirmation annually (32 CFR 170.15, 170.22).
No C3PAO is involved and no third-party assessment fee applies. Your cost is implementing and maintaining those practices and running the annual self-assessment.
The affirmation matters. Your Affirming Official, the senior representative responsible for your CMMC compliance, attests to continuing compliance with all Level 1 requirements (32 CFR 170.22(b)(1)). Because that affirmation is a formal statement to the federal government, treat it as a commitment and review it with your counsel.
CMMC Level 2: two assessment types
Level 2 has two assessment types, and the solicitation names which one applies (32 CFR 170.16, 170.17). The phased implementation in 32 CFR 170.3 was to add Level 2 (C3PAO) requirements to applicable solicitations from Phase 2. On July 13, 2026 the Department of War suspended that schedule, including the November 2026 Phase 2 transition. While the suspension lasts, requiring activities may designate only Level 1 (Self) or Level 2 (Self), and existing Level 2 (C3PAO) requirements are to be removed by solicitation amendment or contract modification (DoW CMMC Procedures memo, Attachment 1, July 13, 2026).
Level 2 (Self)
You evaluate your compliance against all 110 NIST SP 800-171 Rev. 2 requirements, enter your score in SPRS, and your Affirming Official submits an affirmation, similar to Level 1 but against the full 110-requirement standard. The self-assessment is repeated every three years, and the affirmation annually after a Final status (32 CFR 170.16, 170.22).
Level 2 (C3PAO)
An authorized or accredited C3PAO assesses your compliance against the same 110 requirements and submits the results, which are transmitted to SPRS (32 CFR 170.17). This is the assessment type the suspension has taken out of new designations for now.
Whichever path you are on, the standard is the same 110 controls. A free 10-question gap check gives you a directional self-assessment (not an official SPRS score) so you know where you stand before you commit to a path.
Run the free gap check →How to determine your path
Your path is specified in your contract. Check the solicitation for the DFARS CMMC clause (confirm the current clause number against DoD rulemaking), which specifies the required level and, for Level 2, whether a self-assessment or C3PAO assessment is required.
If you are a subcontractor, the prime is required to flow down the CMMC requirements, including the assessment type; a subcontractor handling CUI under a prime contract that requires Level 2 (C3PAO) needs Level 2 (C3PAO) itself (32 CFR 170.23(a)). If the flow-down is ambiguous, clarify with the prime before investing in the wrong path. When in doubt, prepare as if a C3PAO assessment is required: preparing for a C3PAO and discovering you only needed a self-assessment wastes some money but keeps you eligible, while the reverse can be disqualifying.
The self-assessment rigor gap
The mistake to avoid: treating self-assessment as a lightweight exercise because no third party is checking the work. That is dangerous for two reasons.
First, the affirmation is a formal statement to the federal government, made by a named Affirming Official (32 CFR 170.22). In the final rule, DoD noted that it cannot change the False Claims Act, a Federal law that imposes liability on persons and companies who knowingly submit false claims to the government (89 FR 83109). This is general information, not legal advice; confirm your situation with qualified counsel. Second, your self-assessment score is entered in SPRS (32 CFR 170.16(a)(1)(i)), and DoD reserves the right to conduct a DCMA DIBCAC assessment whose results take precedence over your self-assessed status (32 CFR 170.16(a)(1)(iv)). A score that does not reflect reality can be exposed that way, or by a later C3PAO assessment.
The smart approach: treat every self-assessment with the same rigor as a C3PAO assessment. Score honestly, document thoroughly, and implement controls fully. The only difference should be who signs the finding, not the standard you are measured against.
Cost comparison: self-assessment vs C3PAO
The figures below are three-year totals from the DoD's cost estimates in the CMMC final rule. They assume the NIST SP 800-171 requirements are already implemented, so neither path's figure includes the cost of implementing them.
| Path (3-year total) | Small entity | Other than small entity |
|---|---|---|
| Level 2 self-assessment | $37,196 | $48,827 |
| Level 2 certification (C3PAO) | $104,670 | $117,768 |
| C3PAO assessor engagement (within the total above) | $31,234 | $52,056 |
A C3PAO assessment adds the third-party fee and gives you an independent finding in place of your own. For the full breakdown, see our CMMC Level 2 certification cost guide.
Source: CMMC Program final rule, 89 FR 83092 (Oct. 15, 2024), regulatory impact analysis cost summaries at 83182-83186.
How AaaS serves both paths
Whether you need a self-assessment or a C3PAO assessment, an Agent-as-a-Service (AaaS) provider provides the same foundational value: scheduled evaluation of your compliance posture against the NIST SP 800-171 requirements, measured where a connected source can observe them and answered from your evidence where it cannot. Your Affirming Official, not the platform, decides what is affirmed.
For self-assessment, AaaS records what was measured, when, and what your team substantiated, so your senior official decides whether to affirm from a documented record rather than memory. Where no connected source can observe a requirement, the record shows it as answered from your team's evidence, and a requirement with no evidence on file is scored not met. For C3PAO preparation, the same record shows where you stand on each requirement, and on what basis, before the assessors arrive, so you can work your gaps first.
To plan the right path, the free gap check gives a free first read, and the $999 CMMC Level 2 Readiness Snapshot, a one-time purchase, maps your posture from your intake and any source you connect. If you start a Level 2 subscription with the same billing email within 30 days of receiving its PDF, the $999 is credited against your first Level 2 subscription payment, and any amount above that payment carries to the invoices after it (see the Refund Policy).