The Mismatched Certificate
Meridian Prime (1,100 employees) must flow a CMMC Level 2 requirement down to Rivet Tool & Die, a 60-person subcontractor that will receive CUI drawings on a new Army program. Rivet's president sends a two-page PDF titled 'CMMC Level 2 Certification,' issued by SecurePath Consulting. It states Rivet 'achieved all 110 controls' after a two-week gap assessment and shows a compliance percentage, a consultant's signature, and a logo reading 'CMMC Certified.' There is no C3PAO name, no assessment date, no CMMC unique identification number, and no scope statement. Rivet's president adds that his IT provider told him 'self-certification is fine for companies our size,' and asks Meridian to sign off so work can start Monday. Meridian's contracts manager forwards the PDF to you asking, 'Good enough?'
1. Enumerate the defects in this document as evidence of CMMC status, and describe what a valid Level 2 status actually consists of.
Read the worked answer
Work through the document element by element rather than asking 'does it look official?'
Defects
- Wrong issuer. A Level 2 certification assessment must be conducted by an authorized C3PAO under the CMMC Assessment Process. A consulting firm cannot issue a certification, and a gap assessment is not an assessment at all.
- No scope statement. Every valid result is tied to a defined assessment scope (boundary, in-scope assets). 'All 110 controls' with no boundary is unverifiable - the claim may describe a single enclave or the whole enterprise.
- No CMMC unique ID, no assessment date, no C3PAO identity. These are what allow a prime or contracting officer to verify the result against the authoritative record.
- Misused logo and title. 'CMMC Certified' branding by a non-accredited entity is a red flag on its own.
- Misstated self-assessment rule. A Level 2 self-assessment is permitted only where the contract does not require a certification assessment; where it is used, it carries a senior official's affirmation and is recorded with DoD (SPRS) - it is not a consultant's letter.
Valid status looks like: a documented C3PAO assessment (or a properly affirmed self-assessment where permitted), a defined scope, an issue date, a validity period (three years for a Level 2 certification assessment), and a record verifiable through the program's official channels. Verify particulars against the current 32 CFR Part 170 and program guidance before relying on them.
2. What should Meridian require from Rivet before signing, and what are Meridian's options if Rivet cannot produce it by Monday?
Read the worked answer
What to require
- The CMMC unique ID and the assessment type (C3PAO certification assessment vs. a permitted Level 2 self-assessment with senior-official affirmation).
- The assessor's identity and C3PAO authorization status.
- The assessment scope statement and boundary description, confirming the enclave that will hold Meridian's drawings is inside it.
- Assessment date and expiration.
Separate the artifacts. A SPRS score from a NIST SP 800-171 self-assessment (DFARS 252.204-7019/7020) is not a CMMC certification, and the SecurePath letter is neither. Do not let 'we have a score' substitute for 'we have a status.'
If Rivet cannot produce it
- Do not sign off on the consultant letter - that transfers risk to Meridian without reducing it, and Meridian's own flow-down and 252.204-7012 obligations still apply to CUI it causes to be created or held.
- Escalate to Meridian's contracts/legal team and the contracting officer to confirm what the solicitation actually requires and whether a phase-in, alternate performance period, or a different subcontractor is available.
- If the clause permits something less than certification, document precisely what is being accepted, why, and who approved it. A risk-accepted gap should be a written management decision, not a Monday-morning email.