When is a CMMC Level 2 self-assessment due and how long is its validity period?

Question

My company is bidding on a federal Department of Defense [Request for Proposal (RFP)](https://govcon.forum/glossary/rfp/) for IT services, NAICS 541519, and the solicitation requires CMMC Level 2. We've been reviewing the CMMC Program rule and trying to nail down the compliance timeline. We understand that a CMMC Level 2 self-assessment is required for this contract. What I'm trying to figure out is the exact frequency for conducting a CMMC Level 2 self-assessment. Is it an annual requirement, or is there a different cycle? Also, once we complete the self-assessment and achieve CMMC Status, how long is that status valid? The deadline for proposals is coming up, and I want to make sure we have our ducks in a row.

Marcus T. · Answer

A CMMC Level 2 self-assessment is conducted every three years, and the resulting CMMC Status is valid for three years from the CMMC Status Date. The Department of Defense published the CMMC Program rule in October 2024, which took effect in December 2024. The CMMC acquisition rule in the DFARS was published in September 2025 and took effect in November 2025. All Phase 1 self-assessment requirements remain in place as of July 2026. This means if your company needs CMMC Level 2, you must complete the self-assessment and maintain that status for the three-year validity period.

When is a CMMC Level 2 self-assessment due and how long is its validity period?

1 answer

Your answer

When is a CMMC Level 2 self-assessment due and how long is its validity period?

1 answer

Your answer

Related questions