Two Different Paths at Level 2
Under the CMMC rule at 32 CFR 170, most Level 2 contracts allow an annual self-assessment, affirmed in SPRS by a senior company official, the same basic mechanism used at Level 1 but scored across all 110 NIST SP 800-171 controls. A smaller set of contracts, generally those involving the most sensitive CUI, require a triennial third-party assessment performed by a Certified Third-Party Assessment Organization (C3PAO).
Which one applies to you comes down to what your specific contract requires, not a choice you get to make freely. Check your contract language and ask your contracting officer directly if it is not stated clearly.
Cost Comparison
| Cost Factor | Self-Assessment | C3PAO Assessment |
|---|---|---|
| Assessment fee | None. You assess your own environment. | Commonly runs from the low five figures into six figures, depending on organization size and scope. |
| Frequency | Annual affirmation | Triennial (every three years), with annual affirmation in between |
| Preparation and remediation | Internal labor, plus any tooling used to track and close gaps | Same remediation work, typically compressed against an assessment date and often involving outside consultants |
| Ongoing tooling | A self-assessment platform like Threshold, priced per organization rather than per assessment | Often still requires internal tracking tools in addition to the C3PAO engagement itself |
The self-assessment path is materially cheaper for a small sub specifically because there is no third-party fee. The real cost is still the internal work of closing gaps, which a self-assessment path does not remove, it just removes the added layer of an outside assessor's fee and scheduling.
What a C3PAO Assessment Actually Involves
A C3PAO engagement is a formal, independent review against all 110 controls, resulting in a certification decision rather than a self-reported score. It typically involves document review, interviews, and technical verification, and the C3PAO itself does not help you remediate gaps beforehand, since that would conflict with their independence as an assessor.
Most organizations preparing for a C3PAO assessment still run their own internal self-assessment first, specifically to walk in with as few open gaps as possible and a shorter, cheaper engagement as a result.
Where This Leaves a Small Sub
If your contract allows self-assessment, that is almost always the right starting point regardless of whether a C3PAO assessment eventually becomes necessary, since the underlying control work is identical either way. If your contract requires third-party certification, doing the self-assessment work first is still the cheapest way to shorten and de-risk that engagement.