Does the CMMC Phase 2 Pause Affect Self-Assessment Requirements?
The Department of Defense's (DoD) reported pause in the Cybersecurity Maturity Model Certification (CMMC) Phase 2 rollout has created uncertainty among defense contractors. One common misconception is that a delay in the rollout means organizations can postpone cybersecurity self-assessments or suspend compliance activities until implementation resumes.
However, a CMMC rollout delay does not automatically eliminate existing self-assessment requirements or contractual cybersecurity obligations. Contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) must continue meeting the requirements applicable to their contracts and information systems.
Under 32 CFR Part 170, the CMMC program establishes assessment requirements for verifying cybersecurity safeguards. Understanding how these requirements apply is essential for maintaining compliance and preparing for future assessments.
This article explains who must complete CMMC self-assessments, how frequently assessments are required, how results relate to Supplier Performance Risk System (SPRS) reporting, and why maintaining objective evidence should remain part of everyday cybersecurity operations.
Understanding Self-Assessment Requirements Under 32 CFR Part 170
32 CFR Part 170 establishes the regulatory framework for the CMMC program, including assessment requirements, procedures, and compliance expectations for organizations supporting the DoD. The program is designed to verify that defense contractors implement appropriate cybersecurity safeguards for FCI and CUI.
CMMC self-assessments allow eligible contractors to evaluate whether their information systems meet applicable security requirements. CMMC Level 1 addresses foundational safeguarding requirements derived from Federal Acquisition Regulation (FAR) 52.204-21. CMMC Level 2 incorporates the 110 security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 2.
Depending on the assessment level specified in a contract, an organization may be permitted to conduct a self-assessment or may need a third-party certification assessment.
How 32 CFR Part 170 Differs from DFARS Requirements
Contractors should distinguish between CMMC program requirements and cybersecurity obligations established through the Defense Federal Acquisition Regulation Supplement (DFARS).
While 32 CFR Part 170 defines CMMC assessment standards and procedures, DFARS clauses establish requirements that apply through DoD solicitations and contracts.
For example, DFARS 252.204-7012 establishes safeguarding and cyber incident reporting obligations for covered contractor information systems. DFARS 252.204-7019 and 252.204-7020 address applicable to NIST SP 800-171 assessment requirements, while DFARS 252.204-7021 addresses contractual CMMC requirements.
A delay in expanding CMMC implementation does not automatically suspend these separate obligations. Contractors must continue reviewing their contract terms, maintaining required security controls, and completing applicable assessments.
Who Is Required to Complete a CMMC Self-Assessment?
CMMC self-assessment requirements depend on the information a contractor handles, the systems within assessment scope, and the CMMC level specified in the applicable contract.
 |
CMMC Level 1: Contractors Handling FCIFederal Contract Information (FCI) is information provided by or generated by the government under a contract to develop or deliver a product or service. It excludes information intended for public release and certain simple transactional information. Organizations subject to CMMC Level 1 must complete an annual self-assessment against 15 foundational safeguarding requirements derived from FAR 52.204-21. These requirements address basic cybersecurity practices, including access control, identification and authentication, physical protection, and system and communications protection. Level 1 contractors must also submit their assessment results and complete an annual affirmation of continuing compliance through SPRS. |
 |
CMMC Level 2: Contractors Handling CUIControlled Unclassified Information (CUI) is information requiring safeguarding or dissemination controls under applicable laws, regulations, or government-wide policies. CMMC Level 2 aligns with the 110 security requirements established in NIST SP 800-171 Revision 2. These requirements address cybersecurity practices such as access control, incident response, configuration management, audit logging, and risk assessment. However, not every Level 2 contractor follows the same assessment pathway. Some contracts permit a CMMC Level 2 self-assessment, while others require an independent assessment by an authorized Certified Third-Party Assessment Organization (C3PAO). Contractors should review their solicitation and contract requirements to determine which assessment pathway applies. Handling CUI does not, by itself, establish that a self-assessment will satisfy every applicable CMMC requirement. |
How Often Must Contractors Perform Self-Assessments?
Under 32 CFR Part 170, CMMC self-assessment frequency depends on the organization's required CMMC level and assessment pathway.
CMMC Level 1 contractors must complete a self-assessment annually to verify implementation of the applicable foundational safeguarding requirements. An authorized affirming official must also provide an annual affirmation of continuing compliance.
For organizations assigned the CMMC Level 2 self-assessment pathway, formal assessments are required every three years. These assessments evaluate implementation of the applicable NIST SP 800-171 security requirements.
Although the Level 2 self-assessment cycle is three years, contractors must still complete annual affirmations of continuing compliance. Importantly, assessment frequency should not be confused with the frequency of cybersecurity monitoring. An organization cannot assume its security controls will remain effective simply because it completed an assessment.
Changes to systems, personnel, configurations, and business processes can affect compliance between assessment dates.
Contractors should regularly validate implemented controls, maintain current documentation, and address identified deficiencies.
These ongoing activities help organizations support accurate affirmations, maintain assessment readiness, and reduce the risk of discovering significant compliance gaps immediately before a scheduled assessment.
Self-Assessments and SPRS Reporting Requirements
The Supplier Performance Risk System (SPRS) is a DoD system used to maintain contractor performance and compliance information, including cybersecurity assessment results and CMMC statuses.
For contractors subject to applicable CMMC self-assessment requirements, SPRS serves as the system for recording assessment results and required affirmations.
Understanding how CMMC assessments relate to SPRS is important because different cybersecurity assessment programs use different reporting methods.
NIST SP 800-171 Scores vs. CMMC Assessment Results
Under the DoD NIST SP 800-171 Assessment Methodology, contractors receive numerical assessment scores based on their implementation of applicable security requirements.
CMMC assessments, however, establish assessment outcomes and compliance statuses under the CMMC program.
These records serve related but distinct purposes. A previously submitted NIST SP 800-171 assessment score does not automatically establish that an organization has satisfied its applicable CMMC assessment requirements.
Contractors should ensure their SPRS information accurately reflects the assessed environment, applicable requirements, assessment results, and required affirmations.
Outdated records, inaccurate assessment information, or missing affirmations can create compliance concerns and potentially affect contract eligibility.
Submitting information to SPRS does not automatically constitute CMMC third-party certification. Organizations must complete the assessment pathway required by their contracts and maintain the corresponding CMMC status.
How Self-Assessments Differ from CMMC Certification Assessments
Understanding the difference between CMMC self-assessments and third-party certification assessments helps defense contractors determine their compliance responsibilities.
A CMMC self-assessment allows an eligible organization to evaluate its own implementation of applicable security requirements. Internal personnel or qualified external advisors may assist with reviewing technical controls, documentation, and supporting evidence.
When the self-assessment pathway applies, the organization is responsible for accurately reporting its results and completing the required affirmations.
A CMMC certification assessment, by contrast, is performed by an authorized Certified Third-Party Assessment Organization (C3PAO).
A C3PAO independently evaluates an organization's implementation of the applicable CMMC Level 2 security requirements. The resulting assessment determines whether the organization qualifies for the corresponding certification status.
Although self-assessments can establish an eligible organization's CMMC self-assessment status, they do not replace third-party certification when required by contract.
Self-assessments are also valuable preparation tools for organizations expecting future certification assessments.
By identifying security gaps, reviewing documentation, and validating technical controls in advance, contractors can prioritize remediation activities and improve readiness before engaging with a C3PAO.
Why Continuous Evidence Collection Is Essential for
CMMC Compliance
Continuous evidence collection is essential for demonstrating CMMC compliance and maintaining readiness for future cybersecurity assessments.
Contractors must be able to demonstrate that applicable security requirements are implemented, not simply that written policies exist.
Maintaining objective evidence throughout normal operations helps organizations validate security controls, identify documentation gaps, and support accurate assessment results.
What Objective Evidence Should Contractors Maintain?
Objective evidence consists of records, technical artifacts, and other verifiable information that demonstrates how security requirements are implemented.
Depending on the applicable assessment objectives, contractors should maintain:
| Policies and procedures: Documentation describing established cybersecurity responsibilities and processes. | |
| System Security Plans (SSPs): Records describing system boundaries, operating environments, and implementation of security requirements. | |
| Technical configurations and screenshots: Evidence showing how security settings and technical safeguards are implemented. | |
| Security logs and monitoring records: Information supporting audit logging, security monitoring, and incident detection activities. | |
| Access control records: Documentation demonstrating user authorization, account management, and access permissions. | |
| Vulnerability management documentation: Records showing how vulnerabilities are identified, tracked, and remediated. | |
| Training records: Evidence demonstrating completion of applicable cybersecurity awareness and role-based training. |
Evidence should be relevant to the assessed environment and sufficiently current to support the security requirement being evaluated.
The Risks of Last-Minute Evidence Collection
Waiting until an upcoming assessment to gather evidence can create unnecessary compliance challenges.
Organizations may discover outdated documentation, missing technical records, or inconsistencies between written procedures and actual security practices.
These issues can make it difficult to demonstrate that controls are implemented and operating as intended.
Last-minute preparation can also increase remediation pressure, particularly when significant technical changes or documentation updates are required.
Building a Repeatable Evidence Collection Process
Contractors should integrate evidence collection into routine cybersecurity and compliance activities.
This includes assigning evidence owners, establishing recurring collection and review schedules, and maintaining supporting artifacts in a secure, organized repository. Organizations should also validate documentation against actual system configurations and update evidence when security controls, processes, or personnel change.
A repeatable evidence collection process helps contractors maintain CMMC assessment readiness while improving visibility into their cybersecurity posture.
Using the CMMC Phase 2 Pause to Strengthen
Compliance Readiness
The reported CMMC Phase 2 rollout pause may provide some defense contractors with additional preparation time. However, a delay in expanding CMMC requirements should not be interpreted as an exemption from existing cybersecurity obligations.
Contractors should use any additional time to strengthen their cybersecurity programs rather than postpone compliance activities.
A productive starting point is reviewing previous self-assessment results and identifying unresolved security gaps.
Organizations should prioritize remediation activities based on applicable security requirements, operational risks, and assessment readiness needs.
Priorities for Strengthening CMMC Readiness
Contractors can focus on several practical improvements:
Organizations should also establish repeatable compliance management processes that support monitoring, documentation reviews, and timely remediation.
These activities can help reduce assessment preparation challenges while improving the consistency of cybersecurity practices.
Ultimately, CMMC readiness requires ongoing attention to security control implementation, documentation quality, and operational effectiveness, regardless of changes to the rollout timeline.
How MAD Security Helps Contractors Maintain
CMMC Readiness
Maintaining CMMC readiness requires ongoing oversight, accurate documentation, and consistent implementation of cybersecurity controls.
MAD Security's Virtual Compliance Management (VCM) services help defense contractors manage these responsibilities while preparing for applicable CMMC assessments.
Through VCM, MAD Security supports organizations in identifying compliance gaps, maintaining policies and procedures, validating objective evidence, and strengthening assessment readiness. These activities help contractors establish repeatable compliance processes rather than relying on last-minute preparation.
MAD Security also combines managed compliance support with 24/7 Security Operations Center (SOC) services to help organizations monitor cybersecurity threats and maintain effective security practices.
As a Cyber-AB Registered Provider Organization (RPO), MAD Security helps defense contractors navigate CMMC requirements, strengthen cybersecurity programs, and maintain long-term compliance readiness.
Self-Assessment and Evidence Collection Remain Ongoing Responsibilities
A CMMC rollout pause does not automatically suspend applicable to CMMC self-assessment requirements or existing cybersecurity compliance obligations.
Defense contractors must continue maintaining accurate assessment records, validating security controls, and collecting objective evidence to demonstrate compliance with applicable requirements.
Rather than delaying compliance activities, organizations should use available preparation time to address security gaps, improve documentation, and strengthen readiness for future CMMC assessments.
Ongoing compliance management helps contractors maintain effective cybersecurity practices and reduce assessment preparation challenges.
Contact MAD Security to learn how its Virtual Compliance Management services can support CMMC readiness and ongoing cybersecurity compliance.
Frequently Asked Questions (FAQs)
