August 6, 2025
Self-assessments in the phased rollout
With the imminent publication of the updated 48 CFR rule putting the CMMC clause into contracts, I've heard some people talking about entering their self-assessment and affirmation into SPRS as soon as possible. I have one thing to say:
WAIT!
There are two very important things you need to understand about the self-assessment process.
(1) It has to be a real, honest-to-god assessment of every AO with evidence. Yes, for both L1 and L2, you are expected to self-assess every assessment objective (AO) and remember, a control is not met unless every AO for that control has been met.
Furthermore, "The artifacts used as evidence for the assessment must be retained by the OSA for six (6) years from the CMMC Status Date." That's a quote from 32 CFR 170 (the CMMC Program Rule) and it applies to both L1 and L2. So you have to actually collect and store evidence proving you are meeting every AO. That's quite an undertaking, even for L1, so plan to allocate resources accordingly.
(2)For L2, don't enter a less-than-perfect self-assessment until you have to. Remember these key points:
- the minimum passing score is 88
- there are distinct limitations on which controls you can put on the POAM to make up the 22 missing points
- you only have 180 days to correct those deficiencies and re-assess a perfect 110
So if you jump the gun and enter a less-than-perfect self-assessment score for L2, you have set the 180-day clock ticking to achieve perfection.(Note: Read more about POAMs in CMMC here and here.)
Finally, even though it's technically a self-assessment, you don't actually have to do it yourself! There's no reason you can't engage a qualified consultant, preferably a CCA (like me!), to help you. You want to make sure you do it right, eh? And if you have any doubts, you will find a wealth of information available in my upcoming workshops.
Summer Series Virtual Workshops Continue!
Hope to "see" you there!
Use code "CMMCUpdate" to get 20% off tickets for all my workshops.
August 12 | Scoping Your CMMC L2 Environment |
August 26 | Are You Really Ready for a CMMC Assessment? |
September 9 | Top 10 Ways to Fail a CMMC L2 Assessment |
Sincerely,
Glenda R. Snodgrass, CCP/CCA/Lead CCA
grs@theneteffect.com
The Net Effect, LLC
www.theneteffect.com
251-433-0196 x107