Self-assessment breaks down when the organization cannot substantiate its SPRS score, documentation, or control implementation. The article notes that executives must attest to accuracy, which creates False Claims Act exposure if the score does not match reality. In practice, weak evidence, incomplete SSPs, and unresolved POA&M items can turn a compliance exercise into a contract, legal, and reputation problem.
Why Self-Assessment Fails Without Evidence
CMMC 2.0 self-assessment is only as credible as the evidence behind it. When contractors cannot tie their SPRS score to test results, screenshots, policies, inventories, and implemented controls, the assessment becomes an assertion instead of proof. That matters because a weak self-attestation can expose the organisation to contract loss, remediation delays, and legal scrutiny if the declared posture does not match reality.
This is also where non-human identity evidence often gets overlooked. If service accounts, API keys, and secrets are not inventoried and governed, the organisation may believe controls are in place while access paths remain unmanaged. NHIMG’s research shows only 5.7% of organisations have full visibility into their service accounts, which helps explain why evidence gaps are so common. For a control-oriented reference point, NIST SP 800-53 Rev 5 Security and Privacy Controls sets the kind of traceability assessors expect.
In practice, many security teams discover the evidence gap only after an audit request, a bid review, or a contractual dispute has already forced them to prove what they had previously only claimed.
What Evidence Has to Prove in Practice
For CMMC 2.0, evidence must show that controls are not just documented but actually operating. A self-assessment should be backed by artifacts that connect policy to implementation and implementation to results. That usually means a current System Security Plan, mapped control statements, dated screenshots or exports, ticket history, logs, exception handling, and clear ownership for remediation.
Strong evidence also needs to be specific enough to survive challenge. Generic policy language rarely proves encryption, access review, asset management, or vulnerability remediation. Assessors want to see how the control works in the environment, not a statement that it exists.
- SPRS scoring should align to the actual state of each implemented practice.
- SSPs should describe scope, system boundaries, and inherited controls accurately.
- POA&Ms should be limited, justified, and actively tracked to closure.
- Identity evidence should include how service accounts, keys, and secrets are issued, rotated, and revoked.
This is where NHI failures become audit failures. NHIMG research on JetBrains GitHub plugin token exposure and Hard-Coded Secrets in VSCode Extensions shows how hidden credentials can undermine the very controls contractors are expected to prove. These controls tend to break down when evidence is scattered across teams and systems because no one can assemble a defensible, point-in-time record.
Common Failure Modes and High-Risk Exceptions
Tighter evidence requirements often increase compliance overhead, requiring organisations to balance speed of self-assessment against the cost of disciplined recordkeeping. That tradeoff becomes sharper in complex environments where inherited controls, subcontractors, and cloud services blur responsibility lines.
There is no universal standard for perfect evidence packaging yet, but current guidance suggests prioritising repeatable, testable artifacts over narrative claims. The biggest failure modes are incomplete SSPs, stale screenshots, unmanaged POA&Ms, and control statements that cannot be tied back to actual systems. This is especially risky when teams rely on annual certification habits instead of continuous proof.
Edge cases matter. A contractor may have technically adequate controls but still fail an assessment if the evidence is not current, internally consistent, or tied to the correct scope. Similarly, a subcontractor’s access or a third-party secrets store can invalidate the story the organisation is trying to tell. NHIMG’s findings that 96% of organisations store secrets outside of secrets managers and 71% do not rotate NHIs within recommended time frames show why hidden operational gaps can quickly become assessment gaps. In practice, self-assessment breaks most often when leadership signs off before the evidence is mature enough to withstand outside review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63, NIST Zero Trust (SP 800-207) and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-03 | Risk decisions require evidence-backed governance, not unsupported self-attestation. |
| NIST SP 800-63 | IAL2 | Identity assurance principles map to proving who or what is actually authorized. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero trust depends on continuously verifying access and control state. |
| OWASP Non-Human Identity Top 10 | NHI-03 | Credential rotation and secret hygiene are often missing from weak CMMC evidence. |
| NIST AI RMF | Governance requires traceable accountability for claims about system and data controls. |
Require current, system-level evidence for boundaries and access enforcement before attesting.
Related resources from NHI Mgmt Group
- What breaks when sensitive personal information is processed without a privacy impact assessment?
- What fails when a CMMC self-assessment is based on outdated evidence?
- What breaks when CMMC readiness is based on self-attestation instead of evidence?
- What breaks when a CMMC self-assessment does not match the real CUI environment?
