How Defense Industrial Base leaders can validate compliance while certification requirements remain paused.
The Department of War suspended CMMC Phase II on July 13, 2026, which would have required CMMC Level 2 Certified Third-Party Assessment Organization (C3PAO) assessments in contract solicitations for organizations handling Controlled Unclassified Information (CUI). The current direction described in Department of War’s memorandum states that the Department will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments.
For Defense Industrial Base (DIB) organizations, the suspension changes the near-term assessment process, not the underlying responsibility to protect federal information. Leaders must still ensure that claims reported through the Supplier Performance Risk System, or SPRS, are supported by current documentation, technical settings, and day-to-day operating practices. The central risk is a gap between what the organization reports and what it can prove.
For DIB executives, the takeaway is straightforward: certification requirements may be paused, but the need to support compliance claims with evidence is not. Here is what DIB organizations should verify while certification requirements remain paused.
Confirm What Remains Required
Under the current guidance described in the draft, CMMC Level 1 requires an annual self-assessment and annual affirmation against the 15 basic safeguarding requirements in FAR 52.204-21.
CMMC Level 2 requires a self-assessment every three years and annual affirmation against the 110 requirements in NIST SP 800-171 Revision 2. Assessment results and affirmations must be entered into SPRS.
The draft also states that CMMC Level 1 does not permit a Plan of Action and Milestones (POA&M). CMMC Level 2 permits limited POA&Ms, which must be closed within 180 days to obtain Final CMMC Status. Organizations handling CUI remain responsible for DFARS 252.204-7012, and the CMMC Level 2 suspension does not eliminate that obligation.
A paused certification phase is not a paused security obligation. If leaders cannot identify which requirements apply to a contract, who owns them, and what evidence supports them, the organization is not ready to affirm compliance.
Build a Repeatable Validation Process
Organizations need a repeatable validation process that connects reported scores to implemented controls and retained evidence.
- Discover and classify. Identify systems, users, data flows, contracts, subcontractor dependencies, and documentation associated with controlled unclassified information. Confirm which environments and practices support the reported assessment scope.
- Assign accountability. Name an accountable owner for each requirement area, the System Security Plan, SPRS submissions, affirmations, remediation work, and retained evidence. A requirement without an owner is unlikely to remain operational.
- Validate implementation. Compare documented controls with actual system configurations and operating practices. Review access restrictions, administrative privilege, data protection, monitoring, secure configurations, vulnerability remediation, and incident response.
- Document and remediate. Correct inaccurate descriptions, unsupported scoring, and material implementation gaps. Use POA&Ms only where they are permitted and close eligible items within the stated period.
- Review and maintain. Reassess evidence, control operation, contract requirements, and subcontractor obligations on a defined schedule. Compliance evidence must reflect the current environment, not the environment that existed when the score was first submitted.
The process is not complete when the score is entered. It is complete only when the organization can connect each reported result to current documentation, implemented controls, and evidence.
Test the Strength of Compliance Claims
Use five questions to screen whether a reported posture can withstand compliance review:
- Is the assessment scope defined? Can the organization identify the systems, users, data, contracts, and dependencies covered by its score?
- Does the System Security Plan match the environment? Are documented configurations and operating practices consistent with what administrators and control owners can demonstrate?
- Can each score be supported? Is there current evidence showing that the relevant requirement is implemented and operating?
- Are remediation items permitted and current? Are POA&Ms limited to eligible CMMC Level 2 items, and are closure dates being managed against the stated 180-day period?
- Can leadership defend the affirmation? Do accountable owners understand the basis for the submission and the gaps that remain?
If the organization cannot answer these questions with documentation and evidence, it should correct the record or narrow the claim before treating the assessment as reliable.
Prepare for Government-Led Validation
The current guidance described in the CMMC Phase I draft states that the Department will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments. These reviews may be conducted by the Defense Industrial Base Cybersecurity Assessment Center, commonly known as DIBCAC.
A DIBCAC assessment can validate whether a contractor’s reported security posture matches the controls implemented in its environment. Submitting a score to SPRS does not automatically trigger an assessment, and the official CMMC page does not publish the selection methodology, according to the draft. Organizations should not assume that a strong score prevents review or that a low score automatically causes one.
The distinction is purpose. A C3PAO assessment determines CMMC Level 2 certification status. A DIBCAC assessment is government-led and can validate NIST SP 800-171 implementation and the accuracy of assessment claims. C3PAO certification requirements may be paused under the current approach; government oversight is not.
Review Documentation Against Operations
Consider a contractor that reports access control, secure configuration, vulnerability remediation, and incident-response practices in its System Security Plan. The review should not stop with the document. Administrators and control owners should verify that system access is limited to authorized users, administrative accounts follow least privilege, controlled unclassified information is protected during storage and transmission, security events are reviewed, secure configurations are maintained, vulnerabilities are remediated, and incident-response practices are supported by evidence.
The goal is not a polished document. It is an accurate account of the operating environment. If the written control cannot be demonstrated through technical settings, records, interviews, or operational evidence, the description needs correction or the implementation needs remediation.
At the end of this review, leaders should have:
- A defined assessment scope and named accountable owners
- A System Security Plan aligned with the current environment
- Evidence supporting reported SPRS results and affirmations
- A prioritized list of material gaps and permitted remediation items
- Records showing that controls operate as documented
- A process for reviewing contract and subcontractor requirements
Manage the Business Risk of Unsupported Claims
An unfavorable government assessment may identify unsupported SPRS scoring, inaccurate documentation, or security requirements that cannot be validated. According to the draft, those findings can lead to remediation obligations and additional contracting scrutiny.
The greater risk is not simply the existence of a compliance gap. It is submitting a score or affirmation that the organization cannot support with documentation, settings, and operating evidence. The draft states that unsupported claims have the potential to trigger a False Claims Act investigation and could result in financial penalties, suspension of contract awards, and potentially criminal investigations where other federal fraud statutes apply. This legal-impact statement requires review by qualified legal and compliance personnel before publication.
Self-assessment is not self-authorization. It is a representation that must have a defensible basis.
Use the Pause to Strengthen Readiness
The certification timeline changed, but the obligation to protect CUI and support compliance claims with evidence did not. Organizations should validate the SPRS score, reconcile the System Security Plan with the actual environment, close material NIST SP 800-171 gaps, retain evidence that controls operate as documented, and review contract and subcontractor requirements regularly. Inventory the scope, assign owners, validate the controls, correct unsupported claims, and maintain the evidence.
Planet Technologies can help government organizations and (DIB) contractors across Commercial, GCC, and GCC High environments assess Microsoft 365 compliance architecture, review NIST SP 800-171 readiness, reconcile documentation with technical configurations, and develop an evidence-based remediation process. If your team is reassessing its compliance roadmap during the CMMC suspension, contact Planet today.