L1/L2 Self-Assessment Is Now the Only Path — And It Was Never the Lesser One

For six years, "self-assessment" has been treated as the consolation prize of CMMC.

It was the thing you did if you weren't big enough for the real thing. The budget option. The path for contractors who couldn't afford a proper audit. Half the compliance industry built its pitch on the idea that a self-assessment was a placeholder — something you'd do until you were serious enough to hire an assessor.

On July 13, 2026, the Department of War suspended CMMC Phase II. The third-party certification pathway — the C3PAO assessment that was scheduled to start gating contract awards on November 10 — is off the table for the duration of the review.

Which means self-assessment isn't the budget option anymore. It's the assessment path.

That deserves a moment of precision, because most of the coverage has skipped straight past it. This piece is about what Phase I actually required, what Phase II would have added, why the third-party model was structurally broken for small business long before anyone suspended it — and what a self-assessment has to contain to be worth the paper it's printed on.

Phase I vs. Phase II: What Was Suspended, Exactly

The single most consequential detail in the July 13 announcement is a structural one, and it's the reason the "CMMC is dead" reading falls apart on contact.

Phase I and Phase II were never the same requirement at different sizes. They were different mechanisms. Phase I was the self-assessment phase. Phase II was the phase that would have introduced third-party certification as a condition of award. Only one of those two was suspended.

Read the left column carefully, because there is a sentence hiding in it that changes the entire picture for anyone handling Controlled Unclassified Information: Phase I required self-assessments under both Level 1 and Level 2.

Phase II is what would have forced Level 2 through a third-party assessor. Phase II is what got suspended. Level 2 self-assessment is still live.

We'll come back to that, because it's the most under-reported consequence of the entire announcement. First, the reason none of this should be a surprise.

The Third-Party Model Was Never Going to Work at This Scale

The suspension is being read as a policy reversal. It's better understood as an arithmetic problem finally getting acknowledged out loud.

Those are not numbers that resolve themselves with better scheduling. They describe a queue with no exit. A small contractor doing $400,000 a year in defense work was being asked to compete for a scarce assessor slot against firms a hundred times its size, on a fixed deadline, with an award on the line.

And the cost picture underneath the queue was just as difficult. SBA's own analysis put total compliance costs — remediation, tooling, platform migration, documentation, internal labor, and the assessment itself — at figures that can reach roughly $593,800 for firms requiring a third-party assessment and roughly $388,600 for firms eligible for self-assessment. Those are upper bounds, not typical invoices, and they are not audit fees. But the gap between them is instructive: even at the extremes, the assessor was never where most of the money went.

Which is exactly why removing the third party doesn't make compliance cheap. It makes compliance reachable — and puts the remaining cost squarely where it always was: labor, rework, and the price of figuring it out without a map.

Self-Assessment Was Never Second-Tier. Now It's the Standard.

Here is the thing the industry got wrong for six years, and it's worth stating plainly.

A self-assessment is not a weaker version of a real assessment. It's the same standard, verified by a different party. The controls don't change. NIST SP 800-171 doesn't have a discount edition. What changes is who signs off — and under Phase I, that signature belongs to a senior official at your company, submitted to SPRS, with the False Claims Act sitting quietly in the background.

That is not a lower bar. In some ways it's a lonelier one. When a C3PAO walks your evidence, there's a professional in the room whose job is partly to tell you what's missing. In a self-assessment, nobody tells you. You either built something defensible or you didn't, and you find out which when someone asks.

This matters more now, not less, because the Department explicitly retained select government-led assessments during the interim. Assessment didn't disappear on July 13. The third party disappeared. If you're selected, there's no consultant beside you and no assessor walking you through the binder — your documentation is the only thing in the room.

What a Real Self-Assessment Actually Contains

Most "completed" self-assessments we see are a spreadsheet of yes/no answers with nothing behind them. Someone read the 15 Level 1 practices, decided the company probably does most of them, typed a score into SPRS, and moved on.

That's not a self-assessment. That's an opinion with a number attached.

A defensible one has three layers, and each one answers a different question:

An assessor — government-led or otherwise — doesn't ask "do you have an access control policy?" They ask to see your last four access reviews. One of those questions is answered by a document. The other is answered by a habit.

If You Handle CUI: Level 2 Self-Assessment Is Still Live

This is the part almost every piece of coverage missed, and it's the one with real money attached.

Because Phase I covered self-assessments at both Level 1 and Level 2, and Phase II was the mechanism that would have pushed Level 2 through a C3PAO, contractors handling CUI are now in a position that would have seemed implausible three weeks ago: the most expensive obstacle on their compliance path was removed, and the achievable part stayed exactly where it was.

That doesn't mean Level 2 got easier. 110 practices is 110 practices. It means the barrier that was pricing small CUI handlers out of defense work entirely — a six-figure certification cycle they had no way to budget and no assessor slot to book — is not currently in front of them.

A right-sized Level 2 self-assessment for a small business with a limited CUI footprint looks like this: a dedicated CUI enclave built on Google Workspace for Government or Microsoft 365 GCC High, running on dedicated CUI-only devices, with a documented boundary that keeps the rest of your business out of scope. No Active Directory. No SIEM. No security operations center. No full-time IT staff.

What it does require is documentation discipline: a System Security Plan, a POAM, a Risk Register, and evidence that the controls in the SSP actually run.

The Two Paths, Side by Side

Here's what each path takes, and what we deliver against it.

Handling both FCI and CUI? The combined L1 + L2 stack is $5,990/year.

Who This Fits — and Who It Doesn't

We'd rather lose a sale than sell into the wrong scope, so here it is plainly.

This fits you if:

• You're a small defense contractor handling FCI, CUI, or both, and your CUI footprint is limited and definable
• You're willing to do the implementation work with guidance, on your own schedule
• You want documentation and evidence that would survive somebody reading it, not a checklist
• You're on — or willing to move to — Microsoft 365 or Google Workspace, including the government tiers for Level 2

This isn't for you if:

• Your program requires a C3PAO. Our L2 package is scoped for self-assessment-eligible programs. If a third party has to certify you, you need a different provider.
• You want someone else to do it. We provide the templates, the configuration guides, and the consulting. You implement. We don't log into your tenant, we don't ship hardware, and we don't set up your enclave for you.
• Your CUI is diffuse across the whole business. The enclave model works because it draws a boundary. If CUI touches every system you own, you're looking at an enterprise engagement, not a right-sized one.
• You want a certificate without the work. There isn't one. There never was.

The Bottom Line

The pathway that was breaking small defense contractors — the six-figure certification cycle, the assessor queue with no exit, the $7 billion annual bill — is suspended pending review. The pathway that remains is the one small businesses were always capable of walking.

That's not a downgrade. It's the removal of an obstacle that had nothing to do with cybersecurity in the first place. The controls are the same. The standard is the same. What's gone is the toll booth.

And to be honest about the uncertainty: nobody knows what the Task Force will recommend. Officials have not ruled out cancelling the program outright, and they haven't promised it's coming back either. Everything is fluid until roughly mid-September.

None of which changes what you should do this quarter. DFARS 252.204-7012 still binds you. NIST SP 800-171 Rev 2 is being enforced during the interim. Your prime's flow-downs didn't change. Phase I self-assessments remain firmly in place. A defensible self-assessment is the right move in every version of what happens next.

We've been building for this path for years, back when the industry called it the budget option. It turns out it was just the one that worked.