| What your system handles | Minimum status | Who assesses it | Rule |
|---|
| FCI only | Level 1 (Self) | You self-assess | 32 CFR 170.23(a)(1) |
| CUI | Level 2 (Self) | You self-assess | 32 CFR 170.23(a)(2) |
| CUI, prime requires Level 2 | Level 2 (C3PAO) | A third-party assessor | 32 CFR 170.23(a)(3) |
| CUI, prime requires Level 3 | Level 2 (C3PAO) | A third-party assessor (Level 2 is enough, not Level 3) | 32 CFR 170.23(a)(4) |
| No FCI | No status needed | Not assessed | 32 CFR 170.19(b)(2)(i) |
Size does not change that answer. CUI means Level 2 is the floor. If you hold CUI and the prime contract names Level 2 or Level 3, you need a third-party assessment. Our CMMC Level 2 cost guide shows the money.
One rule changes what you owe now. Since July 13, 2026, no contract can require a C3PAO assessment during the pause. If you hold only FCI, Level 1 is all you need now. If you hold CUI, Level 2 (Self) is still a condition of award in Phase 1. Only the third-party assessment is paused. Other programs differ, and our cybersecurity compliance frameworks guide compares the main ones. Cloud work has its own track, covered in our FedRAMP authorization cost guide.
What does a CMMC Level 1 self-assessment cost?
These are Department of War planning projections. The CMMC.com FAQ lists them. A compliance software vendor runs that site. They are estimates, not vendor quotes. A Level 1 self-assessment is projected at about $6,000 for a small entity. A Level 2 self-assessment is projected at over $37,000 for a small entity. A Level 2 third-party assessment is projected at roughly $105,000 for a small entity. For a larger entity it is about $118,000.
A Level 1 self-assessment at $6,000 costs about one-sixth of a $37,000 Level 2 self-assessment. It is under 6 percent of a $105,000 Level 2 third-party assessment.
The table pairs each cost with how long the status stays current.
| CMMC status | Small entity | Larger entity | Stays current | Affirmation |
|---|
| Level 1 (Self) | About $6,000 | About $4,000 | Not older than 1 year | Annually |
| Level 2 (Self) | Over $37,000 | Nearly $49,000 | Not older than 3 years | Annually |
| Level 2 (C3PAO) | Roughly $105,000 | About $118,000 | Not older than 3 years | Annually |
A Level 1 status stays valid for one year, so you repeat the work every year. A Level 2 status runs three years.
How do you keep CMMC Level 1 status current in SPRS?
Your company, called the OSA (organization seeking assessment) in the rule, runs a Level 1 self-assessment every year. It submits the results in SPRS. The Affirming Official submits a CMMC affirmation in SPRS at the Final status date. They file it again every year after that. The Affirming Official is a senior person in your company. They answer for CMMC compliance and can attest to it.
DFARS 252.204-7021 defines a current status. A Final Level 1 status is current when three things hold. It is not older than one year. Nothing changed since the Final status date. The affirmation is not older than one year. Conditional statuses last 180 days. Level 2 statuses last three years.
The same clause sets subcontract timing. Each subcontractor must finish its affirmation before subcontract award and keep it current every year. The contractor gives the contracting officer the CMMC UIDs issued by SPRS for every covered system. It reports any UID change.
Before award, you need a Level 1 status and an affirmation in SPRS. It must cover every system in the CMMC Assessment Scope.
Keep your evidence. Rule 32 CFR 170.15(c)(2) requires you to retain assessment artifacts for six years from the CMMC Status Date. At Level 1 that means evidence for each score. Examples are access lists, system inventories, media disposal records, visitor logs and scan reports.
What changed with the July 13, 2026 Phase 2 suspension?
Phases decide when a level becomes a condition of award. Rule 32 CFR 170.3(e) sets the dates:
- December 16, 2024 - 32 CFR 170, the CMMC Program rule, took effect.
- November 10, 2025 - the 48 CFR rule took effect. Phase 1 began, and self-assessment status became a condition of award.
- July 13, 2026 - the Department of War suspended the move to Phase 2 and later milestones. It ordered a 60-day program review. The Department of War release confirms it.
- November 10, 2026 - Phase 2 was scheduled to add Level 2 with a third party. Suspended.
- November 10, 2027 - Phase 3 was scheduled to add Level 3. Put on hold.
- November 10, 2028 - Phase 4 was scheduled for full implementation. Put on hold.
Level 1 and Level 2 self-assessments still apply. As of November 2026, no restart date was public. Treat the November 10, 2026 date as on hold.
What should you do before your next bid?
- List every system that processes, stores or transmits FCI. That list is your scope.
- Check what the list touches. FCI only keeps you at Level 1. CUI moves you to Level 2.
- Score all 15 requirements. Every one must be MET. No POA&M is allowed.
- Submit the self-assessment and the affirmation in SPRS before award.
- Keep your artifacts for six years from the CMMC Status Date.
- Plan for Level 2 (Self) if you hold CUI. A third-party assessment cannot be required during the pause.
Photo: iAmMrRob, Pixabay Content License, via Pixabay (https://pixabay.com/photos/hacking-cyber-blackandwhite-crime-2903156/)
Fazlur Rahman
