CMMC Diligence: Verify Status, Scope, and Contract Requirements

CMMC is the Cybersecurity Maturity Model Certification. It is the Defense Department’s program for checking that a contractor meets defined cybersecurity requirements for Federal Contract Information and Controlled Unclassified Information. Assessment results attach to a defined system scope. Contract rules attach that Status to award eligibility.

Match the eligibility call to the contract, the assessed systems, and current evidence. Give the legal or contracts lead one decision file. Start the review while the team can still close gaps. Recheck before a readiness claim, a contract commitment, or a subcontract award.

Put CSF and CMMC to work

NIST’s Cybersecurity Framework 2.0 helps an organization assess, prioritize, and improve cybersecurity. Current and Target Profiles help teams find gaps and plan action. (NIST CSWP 29.)

Use CSF to organize the security program. Use CMMC evidence to support the required contract representation. Give each review its own conclusion.

Implementation note: check the current instructions

The official CMMC program page treats Phase I self-assessment requirements as active. On July 13, 2026, DoD suspended the planned November 2026 Phase II transition and later milestones. Treat November 10, 2026 as inactive for mandatory Level 2 (C3PAO).

During the suspension, Level 1 (Self) and Level 2 (Self) remain available. The July 13 instructions direct amendments to active solicitations that carried Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. They also direct changes to existing contracts before the next option exercise or at the next scheduled administrative modification. Waiver procedures remain suspended during the review.

Read those instructions with the latest class deviation and the award documents. Get the amendment, modification, or written clarification you need. For a subcontract, confirm how prime-contract changes affect the agreement you will sign.

Recheck the instructions at each award decision. Keep the documents that establish the requirement for that award.

1. Which information and systems support the work?

Identify Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). Trace what the customer provides and what your team will generate. Map where that information will be processed, stored, or transmitted.

Include email, file stores, engineering tools, backups, and external services. Resolve unclear data instructions with the contracting office or prime.

Section 170.3 ties CMMC applicability to FCI or CUI on contractor information systems. It generally applies above the micro-purchase threshold. COTS-only awards and Government-operated systems sit outside that ordinary reach.

Record the basis for your applicability conclusion. Identify any other safeguarding duties the contract imposes.

2. What level and assessment type does the deal require?

Read the completed requirement in DFARS 252.204-7025. Compare it with DFARS 252.204-7021, the applicable deviation, and the latest award documents. The solicitation provision identifies both the level and the assessment type.

Record the full designation. “Level 2 (Self)” gives the team a clearer target than “CMMC ready.”

Level 1 uses the FAR 52.204-21 safeguarding requirements. Level 2 uses NIST SP 800-171 Revision 2. Level 3 adds selected requirements from NIST SP 800-172.

The standing rules describe a Level 2 certification path through a C3PAO. Level 3 requires a prior Final Level 2 (C3PAO) status and a DIBCAC assessment. Apply the July 13 implementation instructions when you decide which path this award requires.

Resolve conflicting language with the contracting office or prime. Keep the resolution in the file.

3. Which evidence establishes current status?

Obtain the CMMC unique identifier (UID) for each assessment covering the proposed systems. Record the level, assessment type, and Conditional or Final status. Add the assessment date, status date, and latest affirmation date.

Check the record type. The Supplier Performance Risk System (SPRS) stores CMMC information and separate NIST SP 800-171 assessment results. Identify which record supports each claim.

Match each UID to the assessed scope. A CAGE hierarchy shows corporate structure. The assessment UID and scope establish coverage.

Final Level 1 requires annual reassessment. Final Levels 2 and 3 generally require assessment every three years. Each also requires continued compliance and a current annual affirmation. Conditional status carries a 180-day limit.

Record the next assessment, affirmation, and closeout deadlines. Check currency again at the award decision.

For buyer-side diligence, obtain permitted evidence directly from the subcontractor. Agree on a secure method for sharing it. Use a certificate where the assessment path provides one. Confirm current status and affirmation as part of the review.

4. What must happen before a Conditional status expires?

Level 1 requires a Final status. Level 2 allows a Conditional status when the assessment meets the rule’s eligibility requirements. Those include an 80-percent score threshold and limits on which unmet requirements may enter a plan of action and milestones (POA&M). (32 CFR § 170.21.)

Calculate the deadline from the Conditional CMMC Status Date. Complete remediation and the required POA&M closeout assessment within 180 days.

The closeout follows the assessment path. The organization performs a Level 2 self-assessment closeout. An authorized or accredited C3PAO performs a Level 2 certification closeout. DIBCAC performs a Level 3 closeout.

For Level 2 (Self), post the compliance results in SPRS within the 180-day period. An expired Conditional status affects existing performance and eligibility for additional covered awards. (32 CFR § 170.16.)

Give remediation, closeout, and submission separate owners and dates. Escalate a threatened deadline to legal, contracts, and technical leads while they still have time to act.

5. Does the assessed scope cover the operating environment?

Review the system boundary and the services that support it. For Level 2, examine the System Security Plan (SSP), asset inventory, and network diagram. Confirm how each relevant asset is treated. (32 CFR § 170.19.)

Include external providers that handle CUI or Security Protection Data. Review each provider’s service description and customer responsibility matrix. That matrix identifies the responsibilities the provider and contractor each carry.

For Level 2 (Self), a cloud offering used to handle CUI must have FedRAMP Moderate-or-higher authorization or qualifying equivalency. Verify the specific product or service offering.

Check the cloud arrangement against DFARS 252.204-7012 as well. That clause covers incident reporting, evidence preservation, and forensic access alongside the cloud security requirement.

Apply the asset rules for the relevant level. Specialized assets receive different treatment at Levels 1, 2, and 3. Record the applicable treatment and the supporting rationale.

For buyer-side diligence, begin with status evidence and a scope summary. Seek deeper technical records when the review warrants them. Use controlled access for sensitive material.

6. What must be verified before subcontract award?

Match the subcontract requirement to the information being shared and the applicable prime-contract requirement. Section 170.23 sets the level and assessment-type rules for the supply chain.

DFARS 252.204-7021 requires verification of the appropriate current certificate or status before subcontract award. It also requires the subcontractor’s affirmation before award and continued annual affirmation.

Build those checks into procurement approval. Confirm scope coverage before releasing FCI or CUI. Include the required flow-down language in the agreement.

Distinguish mandatory flow-downs from additional commercial promises. Resolve both in the signed terms. Assign an owner to track status, affirmation, and scope changes throughout performance.

7. Who keeps the incident process ready?

Keep safeguarding and incident response staffed after the assessment. The July 13 instructions preserve the DFARS 252.204-7012 requirements.

For incidents covered by that clause, rapid reporting means reporting within 72 hours of discovery. The clause also requires preservation of images of known affected systems and relevant monitoring or packet-capture data. The minimum preservation period runs for 90 days from report submission.

Name the reporting lead and a backup. Confirm their access to the reporting channel. Identify who preserves evidence, coordinates the technical response, and consults counsel. Test the handoff with external providers.

Use Data Incident: The First 48 Hours to support the response plan. Set that plan to meet the applicable reporting deadline.

8. What belongs in the decision file?

Keep one concise record of the conclusion. Link it to the supporting evidence and control access to that material.

Record	What it should establish
Contract requirement	Applicable clauses, deviations, amendments, and required level and assessment type
Information and scope	FCI or CUI involved, covered systems, and assessment boundary
Status evidence	UIDs, Conditional or Final status, relevant dates, and affirmation
Provider review	Services used, assigned responsibilities, and required cloud evidence
Subcontract review	Required flow-downs and completed pre-award checks
Decision and follow-up	Reviewer, conclusion, open actions, owners, and deadlines

Preserve assessment evidence under the applicable retention rules. For Level 2 self-assessments, § 170.16 requires the organization to retain assessment artifacts for six years from the CMMC Status Date.

Apply the appropriate handling and sharing rules to each record. Use approved channels for SSPs, diagrams, and assessment evidence.

Correct unsupported readiness statements. Record the correction and its basis. Preserve relevant records under the organization’s retention and preservation procedures.

Revisit the decision when the contract, system boundary, provider arrangement, or compliance position changes. Give someone responsibility for that review.

Make the readiness claim precise

A useful readiness statement names the level, assessment path, covered systems, and date of verification. It points to supporting evidence. It identifies any remaining conditions and who owns them.

Legal reviews the obligations. Technical staff confirm the systems and evidence. The authorized business lead approves the commitment.

Verify the status. Match the scope. Confirm the contract. Put the evidence behind the claim.

Use note

This article provides general information for legal, contracts, procurement, and technical leads. Use it to coordinate a readiness review. Obtain legal advice for the specific solicitation, contract, or subcontract.

Check the current rules and implementation instructions before relying on the timing discussion. Confirm the exact clause text and any applicable deviation in the award documents.

Questions: Tom@TomCedoz.com

Primary sources: NIST CSWP 29 (CSF 2.0) · 32 CFR Part 170 · DFARS 252.204-7021 · DFARS 252.204-7025 · DFARS 252.204-7012 · CIO memorandum, Removing Barriers to Defense Industrial Base Expansion (July 13, 2026) · Acquisition and Sustainment memorandum implementing the Phase 2 suspension (July 13, 2026, incl. Attachment 1) · Official CMMC program page