How to do a NIST SP 800-171 self-assessment for CMMC Level 2

A CMMC Level 2 self-assessment is your own assessment of the systems that handle controlled unclassified information (CUI) against the 110 security requirements of NIST SP 800-171 Revision 2, using the 320 assessment objectives of NIST SP 800-171A and the scoring method in 32 CFR 170.24. The result, a score out of 110, goes into SPRS with an affirmation by your Affirming Official. You repeat the self-assessment every three years and the affirmation every year.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What is a CMMC Level 2 self-assessment?

32 CFR 170.4 defines it as "the activity performed by an OSA to evaluate its own information system when seeking a CMMC Status of Level 2 (Self)"; the OSA is the Organization Seeking Assessment, your company. Under 32 CFR 170.14(c)(3), "The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2."

32 CFR 170.16(c)(1) sets the procedure: the OSA "must conduct a Level 2 self-assessment in accordance with NIST SP 800-171A Jun2018" and the Level 2 scoping requirements of 170.19, the assessment "must be scored in accordance with the CMMC Scoring Methodology described in § 170.24 and the OSA must upload the results into SPRS."

Since July 13, 2026, Level 1 (Self) and Level 2 (Self) are the only CMMC statuses that may be named in new Department of War requirements (CMMC Phase II is suspended: what still applies); the self-assessment itself did not change. The steps below follow the regulation's order.

Step 1: set the CMMC Assessment Scope

Under 32 CFR 170.19(a)(1), "The CMMC Assessment Scope must be specified prior to assessment" and is "the set of all assets in the OSA's environment that will be assessed against CMMC security requirements." Table 3 to 170.19(c)(1) sorts assets into five categories:

• CUI Assets, which "process, store, or transmit CUI": "Assess against all Level 2 security requirements."
• Security Protection Assets, which provide security functions to the scope: assessed against the requirements "relevant to the capabilities provided".
• Contractor Risk Managed Assets, which "can, but are not intended to" handle CUI: the assessor reviews the SSP and, "If sufficiently documented", does not assess them against other requirements, except for a limited check if the documentation raises questions.
• Specialized Assets (IoT, operational technology, government furnished equipment, restricted systems, test equipment): documented, not assessed against other requirements.
• Out-of-Scope Assets, which "cannot process, store, or transmit CUI; and do not provide security protections for CUI Assets": "Prepare to justify" why.

For every in-scope category the table says to "Document in the asset inventory", document asset treatment in the SSP and "Document in the network diagram of the CMMC Assessment Scope". Under Table 4 to 170.19(c)(2)(i), a cloud provider that handles CUI "shall meet the FedRAMP requirements in 48 CFR 252.204-7012", and a non-cloud provider's CUI services "are in the OSA's assessment scope and shall be assessed as part of the OSA's assessment."

Step 2: have the system security plan in place

Under 32 CFR 170.24(c)(2)(i)(B)(5), OSAs "must have a System Security Plan (SSP) (CMMC security requirement CA.L2-3.12.4) in place at the time of assessment to describe each information system within the CMMC Assessment Scope." Without one, the finding is that "an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012." The SSP is also one of six requirements that can never be on a plan of action. What it has to describe is in What goes in a system security plan (SSP) for NIST SP 800-171.

Step 3: what are the NIST SP 800-171A assessment objectives?

32 CFR 170.4 defines an assessment objective as "a set of determination statements that, taken together, expresses the desired outcome for the assessment of a security requirement", and adds: "Successful implementation of the corresponding CMMC security requirement requires meeting all applicable assessment objectives defined in NIST SP 800-171A Jun2018".

NIST SP 800-171A (June 2018) breaks each of the 110 requirements into those objectives, 320 in all; 3.1.1 has six, 3.4.4 has one. NIST withdrew the June 2018 edition on May 14, 2024, but 32 CFR 170.2 incorporates that edition by reference, so it is the one a CMMC self-assessment uses. Every requirement's objectives are on its family's page under Requirements, with its points and how to meet it: 3.1 Access Control, for example, holds 22 of the 110.

Each requirement ends in one of the three findings in 32 CFR 170.24(b):

• Met. "All applicable objectives for the security requirement are satisfied based on evidence. All evidence must be in final form and not draft. Unacceptable forms of evidence include but are not limited to working papers, drafts, and unofficial or unapproved policies." Enduring exceptions described in the SSP with their mitigations, and temporary deficiencies "appropriately addressed in operational plans of action", are assessed as MET.
• Not Met. "One or more applicable objectives for the security requirement is not satisfied."
• Not Applicable. The requirement or objective "does not apply at the time of the CMMC assessment"; the example given is 3.13.5 "if there are no publicly accessible systems within the CMMC Assessment Scope." An objective assessed as N/A "is equivalent to the same assessment objective being assessed as MET."

So the work is objective by objective: for each of the 320, decide met, not met or not applicable, and record where the evidence is. One objective not met makes the whole requirement NOT MET.

Step 4: score it under 32 CFR 170.24

The score starts at 110 and, under 170.24(c)(2), "For each requirement NOT MET, the associated value of the security requirement is subtracted from the maximum score, which may result in a negative score." Each requirement is worth 5, 3 or 1 points; only 3.5.3 (multifactor authentication) and 3.13.11 (FIPS-validated cryptography) earn partial credit, costing 3 instead of 5 when partly in place. Requirements not implemented, "whether described in a POA&M or not", are NOT MET. The point values are in SPRS score explained, and the free SPRS score calculator works the score out from your answers.

Step 5: Final or Conditional, and the POA&M

Under 32 CFR 170.16(a)(1), the OSA "must complete and achieve a MET result for all security requirements" to reach Level 2 (Self); 170.16(a)(1)(iii) calls that Final Level 2 (Self). If the self-assessment "results in a POA&M and the POA&M meets all the CMMC Level 2 POA&M requirements listed in § 170.21(a)(2)", the status is Conditional Level 2 (Self). In short: a score of at least 88, only 1-point requirements on the plan (3.13.11 at 3 points), and none of six named requirements on it.

Under 170.16(a)(1)(ii)(B), the OSA "must remediate any NOT MET requirements, must perform a POA&M closeout self-assessment, and must post compliance results to SPRS within 180 days of the CMMC Status Date associated with the Conditional Level 2 (Self)", or the Conditional status "will expire". The full rules are in POA&M rules for CMMC Level 2.

Step 6: enter the result in SPRS

32 CFR 170.16(a)(1)(i) lists what the SPRS entry must include "at minimum": CMMC Level, CMMC Status Date, CMMC Assessment Scope, "All industry CAGE code(s) associated with the information system(s)", the "Overall Level 2 self-assessment score (e.g., 105 out of 110)", and "POA&M usage and compliance status, if applicable." The CMMC Status Date is, under 170.4, "the date that the CMMC Status results are submitted to SPRS"; the three-year and 180-day clocks run from it.

SPRS "only stores the results of NIST SP 800-171 Assessments", and a "SPRS Cyber Vendor User" role "is required for companies to enter/edit basic self-assessment information". The entry steps are in SPRS score explained. Under 170.16(b), before award of any contract or subcontract that names Level 2 (Self), the OSA must hold Conditional or Final Level 2 (Self) and have submitted an affirmation in SPRS.

Who is the affirming official?

Under 32 CFR 170.22(a)(1), "The Affirming Official is the senior level representative from within each Organization Seeking Assessment (OSA) who is responsible for ensuring the OSA's compliance with the CMMC Program requirements and has the authority to affirm the OSA's continuing compliance with the specified security requirements for their respective organizations." The duty applies to each OSA "whether a prime or subcontractor".

Each affirmation, entered in SPRS, carries the official's "Name, title, and contact information" and a statement "attesting that the OSA has implemented and will maintain implementation of all applicable CMMC security requirements" (170.22(a)(2)). For a Level 2 self-assessment, 170.22(b)(2) requires it "At the completion of a Level 2 self-assessment and annually following a Final CMMC Status Date", and again "at the completion of a POA&M closeout self-assessment".

DFARS 252.204-7021 (NOV 2025) carries the duty into the contract: under (d)(3) the contractor must "Complete on an annual basis, and maintain as current, an affirmation, by the affirming official" in SPRS. The clause calls a Final Level 2 (Self) status "Current" only when "Not older than 3 years" with an affirmation "not older than 1 year".

How often is a CMMC Level 2 self-assessment required?

A Level 2 (Self) status "also satisfies the requirements for a CMMC Status of Level 1 (Self)" for the same scope (170.16(a)), so a company holding both FCI and CUI needs one assessment, not two.

Where Tiermark fits

With Supplier Pro, the self-assessment workspace in the Tiermark supplier console lists each requirement's NIST SP 800-171A objectives so you can mark each one met, not met or not applicable, with the requirement's status following from them as 32 CFR 170.24 has it, and keeps an implementation statement, an owner, a plan of action and an evidence register per requirement. The score comes from the same rules as the free SPRS score calculator, and Compliance dates works out when the next self-assessment, affirmation and POA&M closeout are due. Tiermark does not assess what you enter, and it posts and affirms nothing in SPRS.

The terms used here, from OSA and Affirming Official to POA&M closeout, are defined in the glossary.

Sources

• 32 CFR 170.4, 170.14, 170.16, 170.19, 170.21, 170.22 and 170.24
• NIST SP 800-171A, Assessing Security Requirements for Controlled Unclassified Information (June 2018) and NIST SP 800-171 Rev. 2
• DFARS 252.204-7021 (NOV 2025)
• SPRS: NIST SP 800-171 Assessments