Certification Readiness for the
Defense Industrial Base.

Partly. Level 1 and Level 2 self-assessment, SPRS score submission, and the underlying NIST SP 800-171 and DFARS obligations are in force today on applicable solicitations. Third-party C3PAO certification at Level 2 and government-led Level 3 assessment were suspended by the Department of War in July 2026 and locked into a binding class deviation in September 2026, pending a reform review. What has not paused is enforcement of the existing self-attestation obligation, including through Department of Justice False Claims Act actions.

No. The Department suspended one part of the program, third-party certification, while it runs a formal reform review with a dedicated Task Force. The security requirements underneath CMMC, NIST SP 800-171 and the associated DFARS clauses, were never paused. The program is being revised, not retired.

We would not recommend it. Self-attestation and SPRS scoring remain a live obligation, and the Department of Justice has continued pursuing False Claims Act cases tied to inaccurate cybersecurity representations throughout the suspension, including a government-initiated assessment that led to a settlement in June 2026. Gap assessment and remediation work also is not wasted, it is the same preparation a future C3PAO assessment will draw on.

That is genuinely not yet public. Its report was due to the Department’s CIO in September 2026 and had not been released as of this writing. Reported themes under discussion include continuous compliance monitoring, expanded scope for operational technology, and standardized CUI marking, but none of this is confirmed policy.

We do not have a confirmed date, and we would rather tell you that plainly than guess. The Task Force report was due in mid-September 2026; industry estimates point to early October, but the Department has not announced a release date. We track this and update our CMMC program status page as confirmed information becomes available.

Your required level is specified in the DoD contract or solicitation. As a general matter, handling only FCI with no CUI points to Level 1. Contracts involving CUI most commonly require Level 2. Level 3 applies to the most sensitive national security programs. We can review your contract vehicles and data flows to confirm which level applies.

Trace where Controlled Unclassified Information actually flows: which systems, people, and service providers touch it, and which don’t. Most organizations find CUI has spread further than expected, often through email, shared drives, or a vendor nobody thought to ask. This is the first thing we determine, because it decides how large and expensive everything downstream becomes.

Often, and usually it saves money rather than costing it. Isolating CUI into a defined enclave, rather than trying to bring your entire network into scope, typically shrinks the assessment boundary significantly. Whether it makes sense depends on how your systems and data are currently architected, which is part of the scoping work.

A low or negative SPRS score doesn’t disqualify you by itself, but it does invite scrutiny, and an inaccurate one creates real legal exposure under the False Claims Act. We help recalculate your score accurately, identify what is actually dragging it down, and build a remediation plan that moves it in the right direction before it becomes a problem.

Yes. Any subcontractor that processes, stores, or transmits FCI or CUI covered by your prime contract must achieve the appropriate level. As the prime you are responsible for ensuring subcontractor compliance and must update subcontract templates with proper flow-down clauses.

Limited use of Plans of Action and Milestones is permitted for certain non-compliant items, but not all requirements are POA&M-eligible. Some must be fully implemented before certification. We help identify which gaps are blocking versus manageable, build a realistic POA&M, and prioritize remediation before your next opportunity closes.

Evidence, not promises. An assessor verifies each requirement through a combination of interviews, document review, and direct observation, checking that your System Security Plan matches what is actually implemented. Gaps between what is written down and what is real are the most common reason organizations fail on first attempt.

It varies substantially with your current posture. Organizations starting from a low SPRS score with incomplete documentation should budget six to eighteen months of preparation before engaging a C3PAO. The formal assessment itself takes several weeks to months depending on organization size. Starting early is strongly recommended, since assessor availability is constrained relative to the scale of the requirement.

The certificate is valid three years, but the obligation doesn’t pause in between. Annual affirmation is required, your SSP and POA&M need to stay current, and your control state needs to reflect reality if a government-initiated review ever asks. Evidence maintained continuously is far less painful than evidence reconstructed under pressure.

The Supplier Performance Risk System is where certifications, self-assessment scores, and annual affirmations are tracked. Contracting officers verify CMMC status through SPRS before award. Inaccurate records affect contract eligibility, and misrepresentation may create False Claims Act exposure.