What are the CMMC Level 2 certification assessment requirements for DoD contracts?

CMMC Level 2 can be either a self-assessment or a certification assessment by a C3PAO, depending on the contract requirements, and is not always a C3PAO certification. The CMMC Level 2 self-assessment is conducted every three years. The resulting CMMC Status is valid for three years from the CMMC Status Date. Your company needs to check the specific solicitation for the Department of Defense to see what kind of assessment is required for that contract. My shop does mostly state and county work now, because the federal cybersecurity requirements like CMMC are too much for a small firm like mine. We just do not have the staff to dedicate to it, or the margins to pay for it. The cost of compliance for us is too high.