How do CMMC Level 2 self-assessments get validated, and what happens if you fail?

Your CMMC Level 2 self-assessment results are submitted to the DoD's Supplier Performance Risk System (SPRS) and are reviewed for completeness, but the government does not validate the technical accuracy of the assessment itself. The self-assessment is conducted every three years, and the resulting CMMC Status is valid for three years from the CMMC Status Date. If your organization fails to meet all the requirements during a self-assessment, it means you do not have a valid CMMC Level 2 certification, which will impact your ability to bid on future DoD contracts requiring that level. The government does not typically provide feedback or a chance to remediate findings outside of the standard assessment process. It is up to your firm to ensure all 110 requirements of NIST SP 800-171 Revision 2 are met before submitting the self-assessment to SPRS. You will need to achieve compliance to be eligible for contracts with the CMMC Level 2 requirement.