Self-assessed does not mean unexamined
Most of CMMC Level 2 is self-assessed, and that makes you the only person who examined the score you affirm. Since Phase 1 opened on 10 November 2025 you post your own score in SPRS and affirm it every year. The move to third party assessment was suspended in July 2026 with no replacement date set.
What you are signing#
The affirmation is a legal instrument.
When you post a score you are making a representation, in writing, to a government, about the state of a system you control and they do not.
Aerojet Rocketdyne paid $9M in 2022 to settle allegations it misrepresented its cybersecurity compliance. The case was brought by a whistleblower, the company's own former senior cybersecurity official, and settled on the second day of trial.
The asymmetry#
A score is a number, and producing one takes an afternoon if you are willing to be generous with yourself. The number looks identical either way: a score arrived at carefully and the same score arrived at optimistically are the same digits in SPRS.
What differs is the evidence behind the digits, and it gets examined at the worst moment: when a prime's security annex asks you to substantiate a control, when a customer's questionnaire asks something the number does not answer, or when somebody asks whether the representation was true.
Build the evidence. The score follows from it.
What counts as evidence#
"Evidence" is a word compliance tooling has flattened into "a screenshot in a folder". What a prime, a regulator, or a court would want is narrower and harder:
- Which control, in the standard's own words. Level 2 is the 110 controls of NIST SP 800-171 Rev 2, and the wording carries the obligation.
- What implements it in your environment. A configuration, a process, or a person with a name. "We have a policy" is not an implementation.
- How you know it is still true. A control verified in March and not looked at since is a claim about March.
- Where it does not apply, and why. Scope carries more weight than the other three, because it decides which controls you answer for at all.
Scope is where a self-assessment quietly inflates#
The failure mode that matters most is a company answering for a system it does not operate.
A space company that flies nothing and runs a ground station has a smaller control set than one flying a constellation.
But generic tooling does not know that, so it asks every question, and the honest engineer filling it in starts inventing plausible answers about systems that do not exist. The score goes up. The evidence behind it goes to nothing.
Scoping by payload class, bus model, and orbital layer decides whether the document survives the first substantive question. Ground segment controls apply to the ground segment. You should not be answering for a constellation you do not fly.
What to do before someone asks#
Three things, in order, and none of them require an assessor.
First, write down your scope and the reason for it. If you cannot say in a paragraph which systems are in, which are out, and why, the score is not meaningful yet.
Second, for each control in that scope, name the thing that implements it and the date you last confirmed it. The gaps will show.
Third, order the gaps by what closing them costs and how much else depends on them. Our findings run in a stricter order, graded U1 to U5, with irrecoverable breaches first.
You sign the number. Make sure you would be comfortable showing what sits behind it.
More on what a prime's flow-down requires on the CMMC page, or tell us what your customer asked for.