The durable CMMC process is: identify the required level, define the assessment scope, implement and document the requirements, assemble evidence, complete the applicable assessment path, resolve any eligible conditional findings, affirm continuous compliance, and ensure the resulting status is recorded as required. The timing of mandatory Phase II third-party certification is currently suspended.
Status note: reviewed September 4, 2026. Phase II is suspended, Phase I remains in force, and the Department of War's CMMC Reform Task Force review is still open. Re-check the official CMMC page before publication if this article is published after that date.
The rule in plain English
32 CFR part 170 defines assessment statuses and DFARS clauses connect those statuses to solicitations and contracts. The Level 2 Assessment Guide explains how assessment objectives are evaluated.
Do not schedule around the old November 10, 2026 Phase II date as though it remains fixed; the Department suspended that phase on July 13, 2026.
How to implement it without overbuilding
Step one is contract/data analysis. Step two is the boundary and information-system identification. Step three is implementation and evidence. Step four is the applicable self, C3PAO, or government assessment. Step five is closure, affirmation, and status maintenance.
Run an internal readiness review before a formal event and avoid major uncontrolled environment changes during the final evidence period where practical.
What evidence to keep
Keep scoping records, current SSP, asset lists, evidence index, assessment artifacts, POA&M/closure records where permitted, affirmation records, and SPRS confirmation.
Version these records so the organization can show what environment was assessed.
Where teams get into trouble
Teams get into trouble when the commercial schedule is set before scope is stable, when evidence belongs to a different environment than the SSP, or when annual affirmation is treated as a clerical afterthought.
Small-contractor walkthrough
A company wants to book an assessment before its CUI boundary is stable. The safer sequence is to lock the contract/data interpretation, settle the scoped system, complete major remediation, accumulate operating evidence, run an internal review, and only then enter the formal assessment event.
- Confirm contract requirement.
- Define CMMC scope/UID.
- Complete implementation.
- Run readiness review.
Decisions to document before assessment
Before marking this topic ready, make four decisions explicit: confirm contract requirement; define cmmc scope/uid; complete implementation; and run readiness review. Assign an owner and an evidence location to each decision.
Manual deep review
The CMMC program and DFARS clauses define status types, assessment paths, CMMC UIDs, SPRS, and annual affirmation mechanics. Separately, the Department suspended Phase II on July 13, 2026, including pending and future implementation milestones while Phase I and Rev. 2 safeguarding/self-assessment activity continued. A current process guide must explain the mechanics without treating the old November 10 milestone as automatically active.
Start with the current solicitation and contract language. DFARS 252.204-7025 identifies the required CMMC level in solicitations when used, while 252.204-7021 governs maintaining the required status for contractor information systems used in performance. During the suspension, verify current Department guidance and amendments instead of inferring obligations from an old phase chart.
Map contract to information system before making a company-wide status claim. Identify the FCI or CUI, the system that will process, store, or transmit it, the assessment boundary, relevant providers and assets, and the CMMC UID/status relationship. Different systems can have different status histories, so the contract-to-system mapping should exist before sales relies on the representation.
Implement the applicable Rev. 2 requirements in the scoped environment, maintain an accurate SSP, and organize evidence at the assessment-objective level. Run internal examine, interview, and test-style validation before the applicable self, C3PAO, or government assessment path. If a conditional result is permitted, formal POA&M and closeout rules apply; ordinary remediation backlogs are not automatically equivalent.
DFARS 252.204-7021 requires current status at the required level for applicable systems and annual affirmation in SPRS for each applicable CMMC UID. 252.204-7025 requires applicable UIDs in the proposal when the provision applies. Before bid/no-bid, sales, contracts, compliance, IT, and management should confirm system, status, affirmation currency, CUI flow, provider dependencies, and any suspension/amendment effect.
Add a bid/no-bid CMMC gate before the proposal leaves the company
Before proposal submission, contracts should identify the applicable CMMC provision/clauses and required status; program leadership should identify the FCI/CUI expected; IT/compliance should identify the exact system and CMMC UID intended for performance; and management should confirm status and affirmation currency. Put the result in the proposal file so the representation is tied to a specific system rather than a company-wide slogan.
If any element is unknown, record the assumption and who must resolve it before award or data receipt. This prevents sales from committing to a level that only another business unit or enclave holds.
Treat status maintenance as part of contract performance
After award, monitor changes to the performance system, CUI flow, providers, CMMC UID, annual affirmation, and any Conditional-status closeout. A new collaboration service or MSP can change scope even when the contract language stays the same. Link material system changes to compliance review before users move controlled work.
Keep a contract-to-system register that operations can actually use. The register should show the active contract, required status, performance system, CMMC UID, status date, affirmation due date, relevant providers, and owner.
Separate current mechanics from future implementation policy
The 32 CFR/DFARS mechanics for levels, statuses, UIDs, assessments, and affirmations remain important reference material, while the July 2026 suspension changes implementation timing. When the Department publishes reform output, update the timeline and procurement gate from the authoritative source without rewriting stable definitions that did not change.
This separation makes the guide durable: readers can understand how the program works without being told that a suspended milestone is still active.
A short working check
- ✓Confirm contract requirement.
- ✓Define CMMC scope/UID.
- ✓Complete implementation.
- ✓Run readiness review.
- ✓Perform applicable assessment.
- ✓Maintain affirmation and status.
Common questions
Is a C3PAO always required for Level 2?
The program provides both Level 2 self-assessment and Level 2 C3PAO paths depending on the contract requirement. Phase II mandatory timing is currently suspended.
What happens after an assessment?
Depending on outcome and eligibility, the organization may receive final status or conditional status requiring permitted POA&M closeout.
Where is CMMC status used?
The DFARS framework uses SPRS for relevant assessment/status information tied to contracting.
Should we wait for reform before doing any work?
Contractual Rev. 2 safeguarding obligations remain, so core implementation and evidence work is still relevant.
Official sources used for this guide
Open the primary source before making a contract-specific decision. Regulations and program implementation can change.
