The preparation steps
- Confirm the contract designation. Read the level and assessment type in DFARS 252.204-7021; see who needs CMMC.
- Define scope. Identify FCI/CUI systems and asset categories under 32 CFR 170.19; use CUI boundary guidance and the enclave guide.
- Document the SSP. Requirement 3.12.4 in NIST SP 800-171 Rev. 2 calls for a System Security Plan; use the SSP outline.
- Implement and self-assess. Work through the applicable objectives in the DoD Level 2 Assessment Guide and compliance checklist. Keep evidence of implementation, not only written plans.
- Calculate the score. Apply 32 CFR 170.24 and review SPRS scoring. A local estimate is not an SPRS submission.
- Check every POA&M item. Apply 32 CFR 170.21 using the POA&M rules and template.
- Complete the applicable assessment. Level 2 (C3PAO) uses an authorized C3PAO (170.17); Level 3 uses DCMA DIBCAC (170.18). Check current designations before scheduling.
- Affirm and maintain the status. Follow the applicable assessment and annual affirmation requirements in 170.15–170.18.
POA&M is a narrow path, not permission to defer everything
Level 1 permits no assessment POA&M. Level 2 Conditional CMMC Status requires a score of at least 88, only eligible 1-point items plus the narrow 3.13.11 encryption-used-but-not-FIPS-validated exception, and no prohibited items. Closeout is within 180 days of the Conditional CMMC Status Date (32 CFR 170.21). See the full eligibility rules.
How long does it take and what does it cost?
It depends on your starting point, scope, current implementation, and missing evidence. A small boundary with working controls is different from an environment needing system changes. Do not treat a generic duration or quote as an assessment commitment. See cost and timeline factors and the published readiness service offer; certification-assessment pricing is set by the assessment organization.
Check the current assessment path first
The July 13, 2026 suspension memo limits current designations to Level 1 (Self) and Level 2 (Self). It does not erase the underlying security requirements. Check current CMMC status and your contract before booking a third-party assessment.
Example: turn an unknown into a documented gap
If MFA is partly deployed, do not mark the whole requirement met because a policy exists. Compare the implementation with the objectives, record the uncovered accounts, and keep evidence of the correction. Use Quick Score for a self-reported starting point and consulting support when you need help organizing the work. Athena prepares you; it does not certify you.