CMMC’s first phase priced a signature, not a score

The week

For years, companies that sell to the Pentagon had been told the same thing: protect the government’s sensitive information or lose the business. On November 10, 2025, that warning started to have teeth. The Department of Defense acquisition rule implementing the Cybersecurity Maturity Model Certification program, known as CMMC, took effect that day.

The DFARS, or Defense Federal Acquisition Regulation Supplement, is the rulebook that governs how the Defense Department buys things. The DFARS rule had been published on September 10, sixty days earlier, and it built on a separate CMMC program rule at 32 CFR Part 170, which sets out what the program is and how assessments work. Part 170, in effect, describes the exam; the DFARS rule says when a contract requires a passing grade.

The rule began a phased rollout. From that day, contracting officers, the government officials who write and award contracts, could include CMMC requirements in new solicitations and contracts. In the first phase, the requirements are mainly Level 1 and Level 2 self-assessments. Level 1 covers basic safeguarding of federal contract information; Level 2 covers controlled unclassified information, the sensitive but not secret material that fills most defense work, from engineering drawings to logistics data.

“Self-assessment” means exactly what it sounds like: the company grades itself. The result is posted in the Supplier Performance Risk System, or SPRS, a Defense database that contracting officers consult when they evaluate suppliers. And each posting is backed by an affirmation from a senior company official, a named person who states that the company meets the requirements.

Third-party Level 2 certifications, in which an independent assessor checks the company’s work, were scheduled to become the standard requirement for applicable contracts in a second phase starting November 10, 2026. So in the week the rule took effect, many contractors breathed a sigh of relief: no outside auditor yet. The relief was misplaced. The first phase asked for a signature rather than an auditor’s verdict, and a signature is something a company, and its leaders, can be held to.

CMMC had been debated for so long that its arrival felt anticlimactic. Industry had watched drafts, revisions and comment periods come and go for years. When the rule finally took effect, Phase 1 did not require most contractors to hire an assessor. It asked them to self-assess against requirements already in their contracts under DFARS 252.204-7012 and NIST SP 800-171.

Yet Phase 1 changed three things at once: who is eligible to win, who is personally accountable for the claims made, and how far down the supply chain obligations reach. The middle one carries the most weight, and each lands on a different part of the organization.

Controlled information and the missing inspection

Start with the information itself. When a company works on a Defense contract, the government shares material with it: specifications, drawings, test results, schedules, maintenance records. Most of it is not classified, but much of it is sensitive. The government calls the broad category “federal contract information,” and the more sensitive subset “controlled unclassified information,” or CUI. A drawing of a component for a military aircraft might be CUI. An invoice probably is not.

For years, contractors handling CUI have been bound by a contract clause, DFARS 252.204-7012, which requires them to protect it using a federal standard called NIST SP 800-171. NIST is the National Institute of Standards and Technology, a federal agency that writes technical standards. SP 800-171 is essentially a checklist of 110 security requirements: who can log in to which systems, whether passwords are backed up by a second factor such as a code on a phone, whether laptops are encrypted, whether someone reviews security logs, whether there is a plan for when things go wrong.

The arrangement resembled a building code with no inspector. The requirements existed, and every contractor promised to meet them. What was missing was the inspection. CMMC, the Cybersecurity Maturity Model Certification, is the inspection regime. It sets levels, says how each level is assessed, and requires the result to be recorded where the government can see it.

Level 1 is the basics, for companies that only handle federal contract information. Level 2 maps to the 110 requirements of SP 800-171, for companies that handle CUI. A higher level exists for the most sensitive programs, but Phase 1 was mainly about Levels 1 and 2. And in Phase 1, the inspection was mostly done by the company itself.

Eligibility: security status as a gate

Before CMMC, DFARS cybersecurity obligations were largely checked after award, if at all. A company promised compliance, won the work, and the question of whether it had actually done the work rarely came up unless something went wrong. Under the new clause, a solicitation that specifies a CMMC level requires the offeror to have a current status at that level in SPRS at the time of award. No status, no award.

Plans of action for unmet Level 2 requirements are allowed only within limits and must be closed within 180 days. A plan of action is a written promise to fix a known gap by a certain date. Level 1 allows none: at Level 1, you either meet every requirement or you do not qualify.

The scoring mechanics matter to the bid team. A Level 2 self-assessment is scored out of 110, and a conditional status requires at least 88, with only certain lower-weighted requirements eligible for a plan of action. Some requirements count for more points than others, because some failures are more dangerous than others. A contractor sitting just above the threshold has little room if a control fails between assessments. Knowing which requirements are deferred, and when each must close, is now part of pricing the risk of a pursuit.

Suppose a mid-sized engineering firm scores itself at 90. It has two open items: a gap in how it reviews audit logs, and an incomplete rollout of encryption on older laptops. Both are on a plan of action with a 180-day clock. Six months later, the laptop project has slipped because the IT lead left. The firm’s status is now in question just as it is preparing a bid for its largest recompete. By then the security gap has become a revenue problem.

The effect is to move cybersecurity from the contract performance file into the capture plan, the planning document a company uses to pursue a specific contract. A business development team now needs to know, months ahead, whether the bidding legal entity has the required status. It also needs to know whether the information system that will handle controlled unclassified information falls inside the assessed scope. A status held by a parent company or a sister entity does not transfer automatically.

For organizations outside the traditional defense base, this was often the first time the question reached leadership. Universities, academic medical centers and technology vendors with occasional Defense work tend to hold contracts in research or sales units that never coordinated with central IT. A professor’s lab may have a Defense research award that nobody in the central security office knows about. A register of every active and pursued Defense award, with its expected CMMC level, is the starting point.

Affirmation: a signature with legal weight

The affirmation is the most consequential feature. A senior official of the contractor must affirm continuing compliance with the applicable requirements after each assessment and annually. That statement is a representation to the government, recorded in SPRS with a name and a date.

The weight comes from a law most executives know mainly by reputation: the False Claims Act. It makes it costly to obtain government money on the strength of a false statement, and it allows insiders, known as whistleblowers or relators, to bring cases on the government’s behalf and share in any recovery.

The Justice Department’s Civil Cyber-Fraud Initiative, launched in 2021, has produced a series of False Claims Act settlements over cybersecurity representations. They include cases against defense contractors and, in 2025, a university research corporation. Several began with whistleblowers inside the company: an IT manager or compliance officer who saw a gap between what the company said and what it did.

CMMC affirmations create a clear, signed record of exactly the kind of claim those cases have turned on. Before CMMC, the government often had to piece together what a contractor had represented, combing through contract files and emails. Now it is in a federal system, with a name and a date beside it.

A company that affirms compliance while known gaps remain open takes a risk that sits with its general counsel as much as its CISO, the chief information security officer. Self-assessment makes this sharper, because no outside assessor shares the judgment. The score posted to SPRS and the signature beside it rest entirely on internal evidence. If the evidence is thin, the signature is carrying weight it cannot bear.

The response is governance more than technology. Decide who signs, and make sure that person has authority over the remediation budget. A signer who can see a gap but cannot fund the fix is in an impossible position. Define the evidence package the signer reviews: the System Security Plan, which describes how each requirement is met; the scoring worksheet; open plans of action; and changes since the last affirmation. Set a rule for gaps found between affirmations, including when a posted score must be corrected. Internal audit can test the package before each annual affirmation. Organizations should confirm their specific obligations, and the implications of an affirmation, with counsel.

Flow-down: obligations travel with the data

CMMC requirements flow down to subcontractors that handle federal contract information or controlled unclassified information. “Flow-down” is contracting language for a simple idea: if the prime contractor passes protected information to a supplier, the supplier inherits the obligation to protect it.

Primes therefore need to know which suppliers will touch that information, and at what level each must be assessed. Each subcontractor makes its own affirmation, so a prime’s exposure includes the accuracy of claims it did not write. Take an aerospace prime with forty suppliers. Twelve of them receive drawings. Each of those twelve has its own score, its own plan of action, its own signer. If one of them overstated its position, the prime’s program carries the consequences.

Flow-down forces a scoping decision many contractors had postponed. One option is a separate, tightly scoped enclave for controlled information: a walled-off set of systems, often a dedicated cloud environment, where CUI lives and nothing else does. The other is bringing the whole enterprise to the required level. An enclave limits assessment scope and cost but demands discipline about where data goes. An enterprise approach is simpler to operate but costs more to assess and maintain. Either can work. Leaving the boundary undefined cannot, because the assessment and the affirmation both depend on it.

An enclave is cheaper to protect, but only if everyone actually keeps controlled information inside it. The moment an engineer emails a CUI drawing from a personal laptop, the boundary has leaked, and the company’s affirmation may no longer describe reality.

Outsourced providers sit inside this question too. A contractor that outsources its help desk, cloud hosting or security monitoring brings those providers into scope wherever they touch controlled information. Their contracts should say what evidence they will supply for assessments and affirmations, and how fast. A managed service provider that cannot produce its own documentation on request is a weak link in the signer’s evidence package.

How this lands inside an organization

The three changes land on different desks: eligibility on business development, affirmation on legal and executive leadership, flow-down on procurement. Treating CMMC as an IT compliance project leaves the most important of the three, the signature, without a real owner.

In practice, a well-run program looks something like this. The business development team keeps the register of Defense awards and pursuits and flags the required level for each one. The security team maintains the System Security Plan and the scoring worksheet, and reports monthly on open plans of action and their deadlines. Procurement maintains a list of suppliers who receive controlled information, with each one’s status and affirmation date. Legal reviews the evidence package and advises the signer. And the signer, a senior executive with real budget authority, reviews the package before each affirmation and asks hard questions.

Programs tend to fail in familiar ways. The affirmation is delegated to whoever runs IT, who signs because the deadline is near. The scope boundary was drawn years ago and nobody has checked whether data still stays inside it. Suppliers were asked once for a compliance letter and never again. The score was calculated generously, crediting partial implementations as complete. These lapses are ordinary, and each creates the kind of gap between claim and reality that whistleblower cases have been built on.

CMMC creates three kinds of cost. There is the cost of meeting the requirements: tools, configuration work, staff time, sometimes a new enclave. There is the cost of proving it: documentation, internal testing, and later, where required, an outside assessment. And there is the cost of being wrong: a lost award because the status was not current on the day it mattered, or legal exposure because a signed statement did not match reality. The first two appear in budgets. The third rarely does, which is why leadership has to ask about it directly. For a company whose Defense revenue is a meaningful share of the total, the price of a modest security program is small next to the price of being ineligible to bid on a recompete.

Ordinary discipline around the signature

None of the requirements is exotic. They call for ordinary discipline, applied consistently.

• A named owner for the signature. The affirming official is senior, understands what the affirmation means legally, and controls the money needed to close gaps.
• Evidence, not assertion. Each of the 110 requirements has a documented basis for its score: a screenshot, a configuration report, a policy, a log review record.
• A defined boundary. Everyone knows where controlled information is allowed to live, and someone checks periodically that it has not wandered.
• A correction rule. If a gap appears between affirmations, there is an agreed process, set with counsel, for deciding whether and when the posted score is updated.
• Supplier tracking. Every supplier that receives controlled information has a known level, status and affirmation date, refreshed on a schedule.

The failures mirror these: treating the score as a target rather than a measurement, rounding partial controls up, assuming a parent company’s status covers a subsidiary, forgetting the outsourced help desk, and waiting for Phase 2 to “do it properly,” when the signature in Phase 1 already carries the legal weight.

One failure is cultural. Staff who raise concerns about the accuracy of a posted score should be heard, not managed around. Several cyber-fraud cases began with exactly such people. An organization that welcomes internal challenge fixes problems early; one that discourages it may meet those problems later, in a less friendly setting.

Where a board should press on CMMC

A board member or chief executive does not need to understand encryption to govern this well. A few direct questions reveal most of what matters.

1. Which of our legal entities bids on Defense work, and does each have a current CMMC status in SPRS at the level our pursuits require?
2. Who signs our affirmation, and does that person control the budget needed to fix what they find?
3. What exactly does the signer review before signing, and when did internal audit last test it?
4. If we discover a gap the week after we affirm, what written rule, agreed with counsel, tells us what to do?
5. Where is our assessment boundary, and how do we know controlled information stays inside it?

The questions need no technical answers to be useful. Vague answers, or answers that differ depending on who you ask, are the finding.

With hindsight

Phase 1 put CMMC status into award decisions and forced contractors to settle scope questions they had deferred. Business development teams learned to check status before bidding. Procurement teams started asking suppliers harder questions. Many organizations drew their assessment boundaries for the first time.

Phase 2 did not arrive on schedule. In mid-July 2026 the Department of War suspended the Phase 2 requirements, which would have made third-party assessments the norm, and set up a CMMC Reform Task Force for a 60-day review. It then sought industry views on reforming CMMC and reducing the compliance burden. According to the Cyber AB, the body that oversees the independent assessor community, only the Phase 2 requirements were suspended: the rest of the program kept operating, and NIST SP 800-171 and DFARS 252.204-7012 obligations were unchanged.

That turn reinforces the case for the affirmation. With independent certification paused, the senior official’s signature is the main assurance the government receives, and the False Claims Act exposure behind it is unchanged. Contractors that treated affirmation as a legal act, with a defined evidence package, were not affected by the pause. Those that had waited for an assessor to validate their posture had less to stand on.

Three conclusions follow. First, a regulatory pause does not suspend the underlying duty. The requirements to protect controlled information sit in contracts companies have already signed, and the affirmations already posted remain on the record. Second, the reform debate may change how assessments are done, but it is hard to imagine a version of the program in which a senior official’s statement to the government stops mattering. Signed representations are the common thread running through every version so far.

Third, the organizations best placed for whatever comes next are the ones that built habits rather than projects: a register of Defense work, a named signer with budget authority, a documented boundary, and suppliers who know what evidence they owe. Those habits serve a self-assessment regime, a third-party regime or something in between. The leaders who asked the plain questions in November 2025 will find the answers still useful, whatever shape CMMC finally takes.