Differences between legacy self-assessments (DFARS 252.204-7019) and CMMC Level 2 self-assessments (DFARS 252.204-7021) are leading defense contractors to a rude awakening: they no longer dictate the requirements they can implement or defer during a NIST 800-171 implementation. Identifying the “non-negotiable” requirements dictated by the CMMC program avoids future scenarios where a single missing requirement voids contract award eligibility or exposes the organization to the False Claims Act.
Old vs. New CMMC Level 2 Requirements
Self-assessments performed under the DFARS 252.204-7019 (Notice of NIST SP 800-171 DoD Assessment Requirements) and DFARS 252.204-7020 allowed contractors to report any score, ranging from a "haven't even started" score of -203 to a perfect 110 points, using the DoD Assessment Methodology (DoDAM).
CMMC Level 2 self-assessments are scored using the DOD CMMC scoring methodology, and DFARS 252.204-7997 (which replaces both 252.204-7019 and 252.204-7020 under the DFARS overhaul) now points government DIBCAC assessments at that same methodology.
The real difficulty emerges when you pair CMMC point values with self-assessment requirements from the DFARS 252.204-7021 CMMC clause. Now your CMMC self-assessment has a minimum score that isn't evident in the contract clause language itself.
The New Bare Minimum
Completing a CMMC Level 2 self-assessment uses the same assessment objectives and point values as previous self-assessment procedures, but there are some tough mandates buried in 32 CFR 170.21, which sets the bar for a Conditional Level 2 (Self) status:
Your self-assessment score must be at least 80% of the 110 requirements in the model, or 88
You must implement all requirements worth three (3) or five (5) points
Additionally, a short list of one point requirements must also be implemented
These non-negotiable requirements from NIST 800-171 yield a self-assessment score of 64, and represent 85% of all possible points in the scoring methodology. This means your only real flexibility when achieving CMMC Level 2 is deciding which 24 (of the remaining 46) one-point requirements you'll implement to reach a minimum score of 88 on your first self-assessment submitted to the Department's Supplier Performance Risk System (SPRS).
A Ticking Clock
With 32 CFR 170.21 putting a new floor on minimum compliance, it's important to understand how quickly the "ceiling" approaches because of how "POA&M closeout" works in the CMMC rules. Under CMMC self-assessment requirements, submitting a CMMC Level 2 self-assessment with any unmet requirements kickstarts a 180-day period to close out those remaining items. Failing to complete those items and update CMMC Status in SPRS will cause that Conditional status to expire after 180 days.
Any contractor submitting a less-than-perfect Level 2 self-assessment should be aware of this mechanism, since it causes self-assessments to expire earlier than normal. Don't end up in a situation where your affirming official logs into SPRS to submit their annual affirmation, only to find your self-assessment has expired, silently disqualifying the company for bids they may have submitted during that timeframe.
How Huntress Helps
Some NIST 800-171 requirements call for specialized capabilities—not just written policies—including ongoing system monitoring, security-event logging and review, threat detection, and incident handling. Huntress brings together endpoint and identity detection and response, security-event collection and retention, and 24/7 SOC monitoring to help organizations operationalize requirements across audit and accountability, incident response, security-control monitoring, and system integrity. We also map our products to applicable CMMC controls and provide assessor-ready documentation, but each organization must still configure these capabilities for its environment, integrate them into its response processes, and maintain evidence that each in-scope requirement is met.
Of the 55 requirements currently documented in Huntress CMMC resources: 32 are non-negotiable. Overall, the requirements addressed in the Huntress Shared Responsibility Matrix (SRM) add up to 164 points in the Level 2 scoring methodology, or 52 percent of all possible points.
As we launch new capabilities, expect Huntress to contribute towards more 800-171 requirements and yield more possible points.
Conclusion
When a solicitation or contract requires CMMC Level 2 (Self), a current Level 2 (Self) status and an affirmation in SPRS are a condition of contract award, and that status will require an implementation score of at least 88 with every non-POA&M-able requirement met. Contractors should respond to this heightened requirement quickly, completing NIST 800-171 implementations and submitting new CMMC Level 2 (Self) assessment in SPRS before the lack of an assessment entry costs them a contract award or contract option.
