CMMC certification: how to get certified, step by step

Certificate or self-assessment: the four routes

"CMMC certification" is the phrase everyone searches, but the rule speaks of a CMMC status. A status is what SPRS records after an assessment. Only two of the four statuses come with a certificate, and those are the two that Phase 2 was going to bring in. What the levels themselves cover is in what is CMMC; here they are as routes.

A higher status covers the lower ones for the same scope: a Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self). Which one your contract names is the first thing to read. The CMMC level finder works it out from the data you hold. Because the program is mid-reform, this is the full record of what binds today:

So where a contract carries a CMMC requirement today, the target is a Level 1 (Self) or Level 2 (Self) status in SPRS, Final if you can reach it, built so that a C3PAO could walk in later and find the same evidence. That is how the steps below are written.

Step 1: Scope the data

Everything after this step is measured against the scope, so a scope drawn too wide costs you on every requirement that follows. At Level 1 the scope is every system that processes, stores or transmits federal contract information (FCI). At Level 2 it is built around CUI, and the rule sorts every asset into one of five categories. If you are not sure which kind of data you hold, start with FCI vs CUI.

Two shop-floor points. A CNC controller reads, to us, as operational technology, which the rule lists among Specialized Assets: at Level 2 it goes in the inventory and the SSP, and is not tested against the other requirements. And at Level 1, Specialized Assets are not part of the scope at all. Cloud services follow their own rule: a cloud provider that holds CUI must meet the FedRAMP requirements of DFARS 252.204-7012; one that holds only Security Protection Data (configuration data, logs, vulnerability status, passwords for the in-scope environment) is in your assessment scope as a Security Protection Asset. A provider holding neither is not an ESP.

Step 2: Gap assessment

No rule says "gap assessment", but every assessment, yours or a C3PAO's, is scored against the same assessment objectives in NIST SP 800-171A, so it pays to score yourself first, on the same terms. At Level 1 that means the objectives behind 15 requirements; at Level 2, behind all 110. Each requirement ends up with one of three findings.

At Level 1 the whole set is MET or NOT MET in its entirety. At Level 2 you get a score: the maximum Level 2 score is 110, and each requirement NOT MET subtracts its value (1, 3 or 5 points) from 110, which may result in a negative score. And MET means evidence, not intent:

The site's checklists walk the objectives one by one: the CMMC Level 1 self-assessment checklist for FCI-only shops, the NIST SP 800-171 checklist for Level 2, and the SPRS score calculator to turn the NOT MET list into the number you will eventually post.

Step 3: Write the system security plan

The SSP is the document every other step points at: the scope lives in it, the assessor reads it first, and a POA&M is measured against it. Part 170 makes it a gate. Without an up-to-date SSP (CA.L2-3.12.4) at the time of assessment, the assessment cannot be completed. It is also one of six requirements that can never be parked on a POA&M.

NIST lets you write the SSP and the plan of action "in any chosen format", and says effective plans make extensive use of references to policies and procedures. So a structured plan that points to evidence beats a long one. If a C3PAO ever assesses you, the SSP's name, date and version are recorded in eMASS with the result, so date and version it from the first draft. At Level 1 none of the 15 requirements is an SSP, though writing down your scope in the same shape makes the yearly self-assessment faster.

The SSP template is laid out requirement by requirement, and what is a system security plan explains each section.

Step 4: Fix the gaps, worst points first

This is where the time and money go, and it is not new. DFARS 252.204-7012 required NIST SP 800-171 "as soon as practical, but not later than December 31, 2017", and the version in new contracts names Rev 2. CMMC only checks the work. Even DoD's own cost estimate for CMMC leaves this part out: it is in 2023 dollars and covers the assessment, not implementing the requirements (DoD "did not consider the cost of implementing the security requirements themselves").

The order in which you fix things is set by the POA&M rule in step 5, because some gaps can wait a few months and most cannot:

Cloud is a decision of its own. A cloud service that holds CUI must be FedRAMP Authorized at Moderate or higher in the FedRAMP Marketplace, or meet equivalent requirements; its Customer Responsibility Matrix goes in your SSP. Two routes are compared on this site: Microsoft's government clouds and their smaller rivals in GCC High alternatives, and, if you would rather hand the work to a provider, the MSPs that run CMMC for small shops.

Step 5: Put what is left on a POA&M

A plan of action and milestones lets a Level 2 shop that is close, but not finished, reach a Conditional status and close the rest afterwards. The rule keeps it narrow. At Level 1 there is no POA&M at all: Level 1 is MET or NOT MET in its entirety; no POA&M is permitted for Level 1.

Closing it means a POA&M closeout assessment of only the items that were on it: by you after a self-assessment, by a C3PAO after a C3PAO assessment, by DCMA after a Level 3 one. Pass it and the status becomes Final, keeping the original status date. Miss the 180 days and the Conditional status expires; under a contract, standard contractual remedies apply and you are ineligible for new awards at that level until you hold a new status.

Fig. 02

Step 6: Run the assessment

If the first five steps are done, the assessment is mostly the act of proving it. Who does it depends on the status the contract names, and today that is a self-assessment.

The suspension stops contracts from adding the C3PAO requirement. The Cyber AB said on 2026-07-15 that only the Phase 2 requirements were suspended and that C3PAO Level 2 certification assessments remain available. The class deviation is silent on voluntary assessments, so ask the C3PAO what it is booking now and what status it will enter in eMASS. If you plan to use one, now or later, keep one rule in mind when you hire help now: CMMC Ecosystem members may not take part in a Level 2 certification assessment of an organization they served as a consultant to prepare for any CMMC assessment within 3 years. The CMMC consultants and RPOs compared and what is a C3PAO cover who does which job.

Fig. 03

Step 7: Post the result in SPRS

A status exists only once it is recorded. For a self-assessment you enter it yourself in the Supplier Performance Risk System (SPRS), which you reach through the PIEE portal; after a C3PAO assessment, the C3PAO enters it in the CMMC instance of eMASS, which passes it to SPRS. The rule lists the minimum each record holds:

Once the results are in, SPRS issues a CMMC unique identifier (CMMC UID) for each system. Under the solicitation provision you list those UIDs in your proposal, and the contracting officer checks SPRS for a current status at the required level, for each UID, before award and again before exercising an option or extending the period of performance. The status date is the day the results are submitted, so every later clock in step 8 runs from it.

Step 8: Affirm, and keep it current

The last step is a signature. An Affirming Official, a senior representative of the company, affirms in SPRS after every assessment, after a POA&M closeout, and annually after a Final status. The rule defines that person as a senior representative from within the company, responsible for its CMMC compliance and with the authority to affirm it. In a 20-person shop that points to the owner or the general manager, not an outside IT provider. The affirmation carries the official's name, title and contact details, and this statement:

Note the words "will maintain". The affirmation looks forward, which is why it is repeated every year, and why the contract clause asks a prime to make sure its subcontractors affirm too, before the subcontract is awarded and every year after. From the status date on, these are the clocks that keep the status current (if you need the dates first, the CMMC deadline guide counts every one from your status date):

The path on one sheet

The same eight steps, side by side for the three routes a small shop can meet. Print it and keep it with the SSP.

Questions about CMMC certification

How we read the rules