How Should Defense Contractors Prepare for Recent CMMC Assessment Changes?

According to DFARS 252.204-7012, the affected population is contractors handling “covered defense information” on a “covered contractor information system,” meaning an unclassified system owned or operated by or for a contractor that processes, stores, or transmits that information. DFARS 252.204-7019 applies when an offeror is required to implement NIST SP 800-171 and requires a current assessment for each covered contractor information system relevant to the offer, contract, task order, or delivery order. DFARS 252.204-7020 says the NIST SP 800-171 assessment clause applies to covered contractor information systems required to comply with NIST SP 800-171. The newer DFARS 252.204-7021 adds CMMC compliance requirements and assigns a CMMC unique identifier for each assessment that is reflected in SPRS. Taken together, the clauses point to contractors whose systems support DoD work involving covered defense information and whose compliance must be shown through the applicable NIST SP 800-171 or CMMC assessment record.

According to DFARS 252.204-7021, “current” now depends on the type of CMMC status. Conditional Level 2 assessments, whether self-assessed or performed by a C3PAO, and Conditional Level 3 assessments performed by DIBCAC are current for not older than 180 days. Final Level 1 self-assessments are current for not older than 1 year, while Final Level 2 and Final Level 3 assessments are current for not older than 3 years. In every case, the clause also requires a corresponding affirmation of continuous compliance, and that affirmation is generally not older than 1 year. DFARS 252.204-7021 defines CMMC status as the result of meeting or exceeding the minimum required score for the corresponding assessment. The earlier DFARS 252.204-7019 and 252.204-7020 provisions still govern NIST SP 800-171 assessment posting in SPRS, including the summary-level score structure that DoD uses for visibility into assessments.

According to the cited clauses, compliance planning now has to track both the assessment record and the status record. DFARS 252.204-7019 says an offeror should verify that current NIST SP 800-171 assessment summary scores are posted in SPRS for all relevant covered contractor information systems, and if they are not posted, the offeror may conduct and submit a Basic Assessment for posting. DFARS 252.204-7020 requires the same SPRS reporting fields for Basic Assessments, including the version assessed, the organization conducting the assessment, CAGE codes, the system security plan architecture, the assessment date, the summary score, and the date full implementation is expected. For Medium and High assessments, DoD posts summary scores to SPRS, and the contractor receives an opportunity for rebuttal and adjudication before posting; the contractor has 14 business days after each assessment to provide additional information or rebut findings. Under DFARS 252.204-7021, teams also need the applicable CMMC status to remain within the clause’s current window and the related affirmation of continuous compliance to remain current.