CMMC 2.0 Self-Assessment Playbook: A Practical Guide to Level 2 Self-Assessment, the SSP, SPRS Scoring, and POA&M Discipline for Small Defense Contractors

The Phase 2 third-party audit requirement was suspended on July 13, 2026. Your compliance was not.

Phase 1 is still in force: self-assessment against all 110 NIST SP 800-171 requirements, a real System Security Plan, a correctly calculated SPRS score, strict POA&M rules, and an annual affirmation signed by a senior official, with False Claims Act risk if you attest to compliance you do not have. This playbook shows a small defense subcontractor how to do it defensibly, step by step, with no scare-selling and no consultant fluff.

Inside:

- What CMMC 2.0 actually requires in November 2026, and what the Phase 2 suspension did and did not change

- Scoping that saves you money: FCI vs. CUI, the four asset categories, and the enclave option

- The self-assessment workflow using the 320 assessment objectives in NIST SP 800-171A

- How to write an SSP that holds up, and SPRS scoring done right, from 110 down by weight

- POA&M rules with no wishful thinking, plus a realistic 90-day starter plan

Do the self-assessment defensibly, before a contract asks for it. Get the playbook.