A CMMC Level 2 self-assessment is how your company checks itself against all 110 practices, enters its score in SPRS and has a senior official affirm compliance every year. While Phase 2 is suspended, Level 2 (Self) is the highest level a new requirement may call for, and the only form of Level 2 you can be asked for right now. Below are the four steps, how to keep the result current and where to find help.
Why Level 2 (Self) is what new contracts can require now
Phase 2 of CMMC is on hold. The Department of War (DoW, formerly DoD) suspended the move into it on July 13, 2026, and for now a new requirement can ask for Level 1 (Self) or Level 2 (Self), but nothing higher.
The security rules underneath did not go away. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 still apply, and the DoW may carry out select government-led assessments. Self-assessments and affirmations are still how the DoW checks compliance during the suspension.
Preparation is not wasted, either. The work that gets a company ready for any assessment (scoping, an SSP and evidence) is the same work that backs a Level 2 self-assessment. For what changed and what to watch, see Galaxy's explainer, CMMC Phase 2 Is Suspended.
Step 1: Confirm your clauses and where CUI lives
CMMC Level 2 applies to DoD contractors that handle Controlled Unclassified Information (CUI). CUI is information the U.S. Government creates or possesses that needs safeguarding or dissemination controls under law, regulation or government-wide policy, but is not classified.
Start with your contracts. If a DoD contract includes a DFARS 252.204-7012 clause or references NIST SP 800-171 compliance, you almost certainly need CMMC Level 2. Look at every active contract and subcontract, not just the newest one. If you are not sure whether some information counts as CUI, ask the contracting officer or the prime contractor that sent it. The Who Needs CMMC Level 2? section of Galaxy's Level 2 page goes into more detail.
Then map your scope. Where does CUI live in your company? Write down the systems that store or send it, the people who use those systems and the locations where that work happens. That boundary is what your self-assessment, your SSP and your evidence will describe.
Step 2: Run a readiness review of all 110 practices
Under Level 2 (Self), you assess all 110 practices. A readiness review is your first honest pass through every one of them, done before you settle on a score.
For each practice, ask two questions:
- Is it really in place on every system in scope?
- Can we show it, with documents, settings or records?
Bring in the people who run your IT and the people who handle CUI day to day, because each group tends to spot different gaps. Note where the proof for each practice lives. You will need it later: a score you cannot back up with documentation is a federal compliance risk. The CMMC resources and reference materials page groups the Level 2 practices by domain and links to the official references, NIST SP 800-171 Rev 2 among them.
Step 3: Write or update your SSP and POA&M
Two documents sit at the center of Level 2:
- System Security Plan (SSP). The SSP is a mandatory artifact for CMMC Level 2. It documents your system boundaries, your operating environments, the people responsible for security and how each of the 110 practices is implemented.
- Plan of Action and Milestones (POA&M). A POA&M records deficiencies that are not yet fully fixed and the corrective actions you plan, with the people responsible and target completion dates.
Write the SSP to describe what is in place today, not what you hope to have later. Where the readiness review found gaps, the POA&M is where you record them and your plan to close them. Keep the two documents consistent with each other and with your evidence. An SSP that matches reality is what lets you stand behind your score.
Step 4: Enter your score in SPRS and affirm
Once the review and the documents are done, your score goes into SPRS, and a senior official affirms compliance. Under Level 2 (Self), that affirmation comes every year.
This step belongs to your company. Your own senior official enters and affirms the score in SPRS. An adviser can help you prepare and package the evidence, but the affirmation is yours. Before anyone signs, compare the score with your SSP, your POA&M and your evidence one more time. If they disagree, fix that before the affirmation, not after.
Keeping it current: assess every three years, affirm every year
Level 2 (Self) is not a one-time project. Under 32 CFR 170.16, it runs on two clocks: one for the full self-assessment, due every three years, and one for the affirmation, due every year.
A few habits make that rhythm easier:
- Put the next affirmation and the next full self-assessment on the calendar now.
- Update the SSP when your systems, contracts or staff change, so the next review starts from an accurate picture.
- Work through your POA&M and close items as the fixes land.
- Before each yearly affirmation, check the score against your evidence again.
Where to get help
You can run a Level 2 (Self) assessment with your own staff. If you want outside help, Galaxy Consulting, a service-disabled veteran-owned small business (SDVOSB), helps contractors prepare for the Level 2 self-assessment and package the evidence, while your own senior official enters and affirms the score in SPRS. The CMMC services page describes that support under Self-Assessment & SPRS Affirmation, and the CMMC FAQ answers common Level 2 questions.
To talk through your contracts and scope, contact Galaxy Consulting for a free initial consultation. It helps to have your contracts, a rough list of systems and any SSP or POA&M you already have on hand for that first conversation.