1) Executive Summary
Most contracts involving CUI expect CMMC Level 2 with a third‑party assessment (C3PAO).
A Level 2 self‑assessment only works when the solicitation explicitly allows it—and it’s usually temporary or narrow in scope.
The fastest, lowest‑risk path is to plan for C3PAO while keeping SPRS and documentation current.
CEO takeaway: Treat L2 self‑assessment as the exception. If CUI is in scope, assume third‑party review and protect revenue accordingly.
2) What is a Level 2 Assessment?
What it covers: The safeguards needed to protect Controlled Unclassified Information (CUI).
What it looks like: Policies, technical controls, and records that map to the Level 2 requirements; results recorded in SPRS.
Who checks: A C3PAO (third‑party assessor) validates that your controls exist and are operating.
3) Can You Use a Self‑Assessment?
Only if the RFP/contract says so. If it doesn’t, assume third‑party review.
If self‑assessment is allowed, you still need:
Current SPRS entry (type, score, date).
A short scope/boundary statement for systems/users that touch CUI.
Evidence ready to show (policy + record + screenshot) for key controls.
Risks of relying on self‑assessment:
The allowance can be revoked on future options or recompetes.
Inconsistent partner posture can undermine your claim.
False comfort: you may pass a paper review but fail when a third party checks.
4) Decision Guide (1‑Minute)
Does the RFP mention CUI?
No → Level 1 may apply; confirm.
Yes → Continue.
Does the RFP permit L2 self‑assessment?
Yes → You may self‑assess now, but plan for C3PAO within 3–6 months.
No → C3PAO required.
Do subs/vendors touch CUI?
Yes → They must meet the same level or be truly out of scope.
5) The C3PAO Path (what to do and when)
Week 0–1 — Stand‑up
Name a single owner (contracts/security) + exec sponsor.
Confirm required level and Gantt a C3PAO target window.
Week 1–3 — Gap & Stabilize
Run a gap assessment against L2; fix high‑impact items (MFA everywhere, logging, backups, admin separation).
Build a Readiness Pack: 5–7 pages covering SPRS, boundary, partners, and evidence index.
Week 3–6 — Book the assessor
Shortlist C3PAOs; hold a readiness call; lock dates; agree on scope and artifacts.
Week 6–10 — Evidence & Dry Run
Stage policy + record + screenshot for top controls; conduct a mock interview with your leads.
Assessment window
Expect document review + interviews; close minor findings quickly; track any time‑boxed remediations in a POA&M if allowed.
After assessment
Update SPRS, finalize evidence, and adopt a monthly compliance rhythm.
6) Budget & Timeline
Timeline to “assessment‑ready”: 6–12 weeks for well‑run SMBs; longer with larger scope or legacy issues.
Direct costs: Prep support, tooling gaps (MFA, logging, backup), and C3PAO fees.
Hidden costs: Proposal delays, emergency consulting, lost options if you slip the calendar.
Rule of thumb: A short, focused sprint now is cheaper than a scramble during award.
7) What COs Expect to See for Level 2
Level match clearly stated in your offer.
SPRS shows current type/score/date for Level 2.
A one‑paragraph boundary statement naming systems/users that touch CUI.
Partner alignment (list subs/vendors touching CUI + their status).
Light evidence that your controls run day‑to‑day (not just policy docs).
8) Partner Readiness (don’t let them sink your bid)
Identify any sub/vendor that touches CUI.
Request a 1‑page attestation (level, assessment type/date, contact).
If they cannot meet Level 2, remove them from the data flow or replace.
9) Red Flags That Kill Level 2 Quickly
Out‑of‑date SPRS or score/date that don’t match your story.
Unclear scope (no boundary; everyone is “in”).
No MFA on admin or remote access.
Flat networks with CUI intermingled across the environment.
Partners with unknown or unproven posture.
10) Your 10‑Item Checklist
RFP level confirmed; CUI in scope?
Self‑assessment allowed? If yes, plan C3PAO anyway.
SPRS updated (type/score/date) + screenshot saved.
Boundary statement written (Appendix A template).
Partners inventoried; attestations in folder.
Gap assessment complete; top fixes scheduled.
Readiness Pack (5–7 pages) assembled.
C3PAO shortlisted; date penciled.
Mock interviews done; evidence staged.
Monthly compliance cadence defined.
11) Need a CMMC Level 2 Free Assessment?
What you get for Level 2:
Readiness in weeks, not quarters: gap assessment → remediation plan → evidence pack → C3PAO coordination.
Partner assurance: quick checks and attestations for vendors/subs that touch CUI.
Proposal support: boundary statement, SPRS tune‑up, and bid‑day sanity check.
Led by practitioners. CEO Horacio Maysonet, a U.S. Air Force veteran, and a cross‑functional team (compliance, engineering, onboarding, ops) focused on making compliance practical.