Contractor reviewing CMMC POA&M records

As of July 13, 2026, the DoD paused Phase II of CMMC, but your obligations have not gone away: you still need to implement NIST SP 800-171 controls under DFARS 252.204-7012, complete required self-assessments, record results in SPRS, and submit your annual affirmation. Your next move is simple: confirm your assessment scope and make sure your System Security Plan reflects where you actually stand.

TL;DR:

  • Level 1 covers 15 safeguards and permits no open remediation items; Level 3 adds enhanced controls and requires current Level 2 status before DIBCAC assessment.
  • Level 2 assessments occur every three years and may be self performed or conducted by a third party, depending on contract sensitivity.
  • Certain Level 2 gaps can receive Conditional status, but contractors must close approved plans of action and milestones within 180 days or risk losing eligibility.
  • Assessors expect finalized policies, configurations, and logs; an SSP should define network boundaries and link each implemented control to named evidence.
  • Before subcontractors handle FCI or CUI, verify their CMMC status and UID in SPRS, then periodically recheck status and retain their affirmations.
Mavericks Office Solutions
Strengthen Your Cybersecurity Readiness
Mavericks provides managed IT services and cybersecurity for small and midsize businesses working to secure their technology.

Visit Mavericks

Table of Contents

What CMMC Is and How It Connects to DFARS and NIST

The Cybersecurity Maturity Model Certification program exists to verify that contractors handling federal contract information (FCI) and controlled unclassified information (CUI) actually protect it, rather than just promising to. The program’s legal foundation sits in 32 CFR part 170, which maps each CMMC level to an existing federal standard:

  • Level 1 ties to the 15 basic safeguarding requirements in FAR 52.204-21.
  • Level 2 ties to the 110 security requirements in NIST SP 800-171 Rev 2.
  • Level 3 adds selected enhanced requirements from NIST SP 800-172 for your most sensitive programs.

Your contractual obligation to protect covered defense information flows from DFARS clause 252.204-7012, which has required safeguarding and incident reporting for years. CMMC adds the verification layer on top. The July 2026 pause affects Phase II rollout timing, not your underlying DFARS duties, which is why self-assessments and SPRS entries remain active requirements for contractors right now.

CMMC Levels: What Each One Actually Requires

Your required level depends on the sensitivity of the information your contract involves, and each level carries distinct assessment rules and timelines.

  • Level 1 covers 15 FAR-based safeguarding requirements, requires an annual self-assessment, and does not permit Plans of Action and Milestones (POA&Ms) for open items.
  • Level 2 requires all 110 NIST SP 800-171 Rev 2 requirements and allows either a self-assessment or a third-party assessment through a C3PAO, depending on your contract’s data sensitivity, on a triennial cadence.
  • Level 3 builds on Level 2 and adds selected NIST SP 800-172 requirements, assessed by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC); you must hold a current Level 2 status before pursuing Level 3.

Final CMMC statuses at Level 2 and Level 3 have a validity period defined by regulation, with an authorized affirming official required to submit annual affirmations in SPRS to keep that status active. This cadence matters because a lapsed affirmation, not just an expired assessment, can put your contract eligibility at risk, according to the DoD CIO’s CMMC program page.

POA&Ms are permitted at Level 2 for certain unmet requirements, giving you a path to a Conditional status while you close gaps, typically within a 180-day window before the status lapses. Level 1 offers no such grace period, which makes it the strictest level despite covering the fewest requirements.

How to Conduct and Report Your Assessment

Whichever level applies to you, the mechanics of proving compliance follow a consistent pattern.

  1. Assess against NIST SP 800-171A. This document provides the specific assessment objectives and criteria examiners use, and every objective tied to a requirement must be scored MET or Not Applicable for that requirement to pass.
  2. Gather finalized evidence, not drafts, since assessors working from the NIST SP 800-171A criteria expect policies, configurations, and logs that reflect your current environment.
  3. Enter results in SPRS (the Supplier Performance Risk System), where your score, assessment date, and status become visible to contracting officers.
  4. Have your affirming official submit the annual affirmation, confirming your status remains accurate between full assessments.

Timing interacts closely with status: a Conditional status from an incomplete Level 2 assessment starts a closeout clock, and missing that window can downgrade your eligibility for new awards. Failing to affirm on schedule carries the same risk, even if your underlying controls haven’t changed, so calendar reminders tied to your assessment date are worth setting up early.

Pro Tip: Set your SPRS affirmation reminder 60 days before the deadline, not 60 days after your last assessment, since the two dates rarely line up.

A Practical Readiness Checklist You Can Start Today

Getting ready for an assessment, self-performed or third-party, comes down to a short list of foundational moves.

  • Scope your environment first. Isolating where CUI actually lives, through a segmented enclave or VLAN separation, can shrink the number of systems you need to assess and document.
  • Build or update your SSP so every one of the 110 requirements ties to a specific, named piece of evidence.
  • Draft POA&Ms with real dates and owners for anything not yet implemented, anticipating the 180-day closeout window where it applies.
  • Prioritize high-impact controls: multi-factor authentication, least-privilege access, centralized logging, encryption for data at rest and in transit, and a documented incident response plan.
  • Name your affirming official now and put SPRS entry and annual affirmation dates on a shared compliance calendar.

Pro Tip: Start with MFA, since it touches the largest number of NIST SP 800-171 access control requirements for the least implementation effort.

What Assessors Expect in Your SSP and POA&Ms

Your System Security Plan needs to define your network boundary, list every implemented control, attach relevant policies and diagrams, and name who owns each responsibility.

  • Evidence must be finalized: a policy still in draft form, or a diagram that doesn’t match your current network, raises red flags during review.
  • POA&Ms should name a specific owner, a target date, and the artifact that will prove the gap is closed, not just a general intention to fix it.
  • The most common failings assessors flag are scope that doesn’t match the SSP’s description, missing evidence for a claimed control, and policy language that contradicts itself across documents.

Treat your password policy documentation the same way: consistent wording across your SSP, your actual configurations, and your employee-facing policy avoids the mismatches assessors look for first.

Managing Subcontractor Flow-Down and Supply Chain Risk

If your subcontractors process, store, or transmit FCI or CUI on your behalf, you’re responsible for confirming their CMMC status before passing sensitive work downstream. DFARS clause 252.204-7021 governs this flow-down, and your contracts should insert its substance along with a requirement to verify each subcontractor’s CMMC Unique Identifier (UID) in SPRS.

  • Verify subcontractor status before work begins, not after a contract is already underway.
  • Re-check status periodically, since a subcontractor’s assessment can lapse mid-contract.
  • Keep copies of subcontractor affirmations and UIDs on file for your own audit trail.

How We Support Your CMMC Readiness and Ongoing Compliance

Our services combine managed IT, cybersecurity, and vCIO support so your compliance work doesn’t sit on one overloaded in-house admin. We provide assistance with readiness assessments, SSP and POA&M documentation, and continuous monitoring that keeps your controls evidenced between formal assessments. For evidence trails and audit logs tied to emerging AI tools in your stack, a partner resource on compliance program design and evidence collection offers useful context for structuring documentation that holds up under review.

How We Support Your CMMC Readiness and Ongoing Compliance — overview diagram

Compliance Is a Daily Habit, Not a Binder

The contractors who struggle with CMMC are usually the ones who treat it as a paperwork exercise finished once a year. The Phase II pause doesn’t change your DFARS obligations, and the contractors who keep moving now, logging access, testing incident response, updating their SSP as systems change, will face far less scrambling when the next assessment window opens. Build the habit before the deadline forces it.

— Jeffrey

Get Help Closing Your Compliance Gaps

Meeting CMMC compliance requirements takes consistent monitoring, documented controls, and someone watching the deadlines so you don’t have to. Our cybersecurity services cover the continuous monitoring, incident response planning, and access controls that map directly onto NIST SP 800-171, while our managed IT support keeps those controls operating day to day rather than just on paper.

Mavericks Office Solutions

Your situation What we help with
Unclear assessment scope Scoping review and enclave isolation planning
Incomplete or outdated SSP SSP documentation tied to evidence
Open POA&M items Milestone tracking toward closeout
No dedicated IT security staff Managed cybersecurity and monitoring

Request a readiness conversation with our team and find out where your documentation and controls stand today.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

Is CMMC compliance mandatory?

Yes, for any contractor handling FCI or CUI under a DoD contract that includes the CMMC requirement, compliance is a condition of contract award, not optional guidance. The specific level required depends on the contract and is set by the contracting officer based on the information involved.

What are the requirements for CMMC security compliance?

Requirements scale by level: Level 1 covers 15 basic safeguarding practices from FAR 52.204-21, Level 2 requires all 110 NIST SP 800-171 Rev 2 requirements, and Level 3 adds selected NIST SP 800-172 enhanced requirements on top of Level 2. Each level also has its own assessment type, cadence, and reporting obligation in SPRS.

Is NIST 800-53 the same as CMMC?

No, NIST SP 800 is a separate catalog of security controls built primarily for federal information systems, while CMMC is based on NIST SP 800-171 and SP 800-172, which govern nonfederal systems handling CUI. The two frameworks overlap conceptually but serve different audiences and are not interchangeable for CMMC purposes.

Which DFARS clause requires CMMC?

DFARS clause 252.204-7012 establishes the underlying safeguarding and incident reporting obligations that CMMC verifies, while related clauses like DFARS 252.204-7021 address flow-down and reporting requirements to subcontractors. Contracting officers insert the applicable clauses directly into solicitations and contracts based on the information involved.

Sources

For anyone managing this process directly, these primary documents are worth bookmarking: