CMMC Assessment Process: Self, C3PAO, and DIBCAC

Assessment by Level

Typical Level 2 Flow

1. Scope and SSP baseline
2. Implement / remediate against 110 requirements
3. Pre-assessment evidence packing (objectives, artifacts, interviews)
4. Self-assessment scoring into SPRS or C3PAO engagement when designated
5. Conditional status only if allowed — minimum score 88 of 110 (80%) plus critical requirements MET per §170.21; POA&M closeout in 180 days
6. Annual affirmation between assessments

How CyberSilo Helps

• CSA readiness tracking against requirement IDs
• ThreatHawk evidence for AU/SI sampling
• We are not a C3PAO; we prepare OSCs for whoever assesses them

Frequently Asked Questions

Who assesses Level 3?

DCMA DIBCAC. Level 3 requires a prior Level 2 C3PAO assessment and adds 24 selected NIST SP 800-172 (Feb 2021) requirements.

Can Level 1 use a POA&M?

No. POA&M is not allowed for Level 1.

How often is Level 2 reassessed?

Assessment results are on a 3-year cycle with annual affirmation, with results/affirmations submitted in SPRS.

Related CMMC Resources

CMMC hub · Level 2 · Level 3 · POA&M · Checklist