CMMC Level 2 Self-Assessment: The Practical Path for a Small Defense Contractor

The direct answer: if you are a small defense contractor today, the requirement that is actually enforceable is a self-assessment against the 110 requirements of NIST SP 800-171 Revision 2, with a score posted in SPRS and an annual affirmation from a senior official. Phase 1 of the CMMC rollout went live on July 13, 2026. Phases 2 through 4, including the expansion of third-party C3PAO assessment as a condition of award, are on hold. The 110 requirements did not change when the phases were suspended.

That distinction matters more than it sounds. A great deal of published commentary reads the suspension as "CMMC is paused." It is not. The 48 CFR acquisition rule took effect on November 10, 2025, and CMMC obligations flow through contracts now. What is paused is the escalation to third-party assessment, not the obligation itself.

Scope before controls

The single highest-leverage decision is not a control. It is the boundary. Every system that stores, processes, or transmits Controlled Unclassified Information inherits all 110 requirements. Every system that does not, does not.

Small contractors routinely treat the entire company network as in scope by default, then discover that CMMC Level 2 implementation across a general-purpose corporate environment is a far larger project than the contract value justifies. The alternative is to define a deliberate enclave: a bounded environment where CUI lives, with controlled entry and exit, and to keep the rest of the business outside it.

This is a business architecture decision as much as a security one, and it is the point at which outside help pays for itself most clearly. It is also reversible only at significant cost, which is why it belongs first rather than after a year of control work.

Where the 110 usually stall

Across the 14 families, a predictable handful of requirements consume disproportionate effort for organizations under roughly 50 people:

• Multifactor authentication for local and network access to privileged accounts, applied consistently rather than to the obvious systems only.
• Audit and accountability. Generating logs is straightforward. Retaining them, protecting them from modification, and demonstrating that someone reviews them is where small teams fall down.
• Configuration management. Establishing baseline configurations and then showing that deviations are tracked, which presumes an accurate asset inventory that many organizations do not have.
• FIPS-validated cryptography for CUI at rest and in transit. Encryption being present is not the requirement. Validated modules are.
• Incident response. A written plan is necessary and not sufficient. The requirement contemplates a capability that has been exercised.
• Security awareness training tied to role, with records that survive scrutiny.

None of these are conceptually hard. What makes them hard at 15 people is that no one owns them full time, and the evidence trail is what an assessor examines. For a fuller treatment of why documented policy and operating evidence are different things, see Security Control Evidence: Policy vs Implementation.

Self-assessment does not mean unassisted

A self-assessment is an attestation your company makes about its own environment. The score goes into SPRS under your name, and the annual affirmation is signed by a named senior official at your company. That person carries the attestation, so the underlying work needs to hold up.

The failure mode we see most often is a self-assessment scored optimistically against an SSP that describes an intended environment rather than the operating one. That gap is invisible until it is not, and it is precisely what a later third-party assessment surfaces.

Watch November 10, 2026

Phase 2 was scheduled to begin on November 10, 2026 before it was placed on hold. If it resumes on or near that date, contractors whose awards depend on Level 2 will need a C3PAO assessment rather than a self-assessment, and C3PAO capacity is finite. The organizations that fare well in that transition will be the ones whose self-assessment was honest, because the delta between a defensible self-assessment and a third-party assessment is mostly evidence organization rather than new control work.

Related reading: NIST 800-171 vs CMMC: Key Differences Explained, CMMC Level 2 Requirements for Small Business, and CMMC Paused, HIPAA Delayed: The Compliance Floor Is Moving.

How Z Cyber approaches this

Z Cyber works as a cybersecurity operating partner rather than a report vendor. For CMMC engagements that means a named Executive Security Advisor leads the scoping decision, the program state lives in Glance so the SSP reflects the environment as it actually is, and remediation is delivered rather than handed over as a list. We recommend and we implement. The contractor accepts the risk, signs the affirmation, and owns the decision. See Defense and Government and Compliance Advisory.