CMMC’s first phase priced a signature, not a score
When CMMC requirements began appearing in Defense contracts on November 10, 2025, attention went to assessment levels. The senior official’s affirmation mattered more, because it turned security claims into dated representations with legal weight.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On November 10, 2025, the Department of Defense acquisition rule implementing the Cybersecurity Maturity Model Certification program took effect. The DFARS rule had been published on September 10, sixty days earlier, and built on the CMMC program rule at 32 CFR Part 170.
It began a phased rollout in which contracting officers include CMMC requirements in new solicitations and contracts. In the first phase, the requirements are mainly Level 1 and Level 2 self-assessments, posted in the Supplier Performance Risk System and backed by an affirmation from a senior company official. Third-party Level 2 certifications were scheduled to become the standard requirement for applicable contracts in a second phase starting November 10, 2026.
CMMC had been debated for so long that its arrival felt anticlimactic. Phase 1 did not require most contractors to hire an assessor. It asked them to self-assess against requirements already in their contracts under DFARS 252.204-7012 and NIST SP 800-171. Yet Phase 1 changed three things at once: who is eligible to win, who is personally accountable for the claims made, and how far down the supply chain obligations reach. The middle one carries the most weight, and each lands on a different part of the organization.
Eligibility: security status as a gate
Before CMMC, DFARS cybersecurity obligations were largely checked after award, if at all. Under the new clause, a solicitation that specifies a CMMC level requires the offeror to have a current status at that level in SPRS at the time of award. Plans of action for unmet Level 2 requirements are allowed only within limits and must be closed within 180 days. Level 1 allows none.
The scoring mechanics matter to the bid team. A Level 2 self-assessment is scored out of 110, and a conditional status requires at least 88, with only certain lower-weighted requirements eligible for a plan of action. A contractor sitting just above the threshold has little room if a control fails between assessments. Knowing which requirements are deferred, and when each must close, is now part of pricing the risk of a pursuit.
The effect is to move cybersecurity from the contract performance file into the capture plan. A business development team now needs to know, months ahead, whether the bidding legal entity has the required status. It also needs to know whether the information system that will handle controlled unclassified information sits inside the assessed scope. A status held by a parent company or a sister entity does not transfer automatically.
For organizations outside the traditional defense base, this was often the first time the question reached leadership. Universities, academic medical centers and technology vendors with occasional Defense work tend to hold contracts in research or sales units that never coordinated with central IT. A register of every active and pursued Defense award, with its expected CMMC level, is the starting point.
Affirmation: a signature with legal weight
The affirmation is the most consequential feature. A senior official of the contractor must affirm continuing compliance with the applicable requirements after each assessment and annually. That statement is a representation to the government, recorded in SPRS with a name and a date.
The Justice Department’s Civil Cyber-Fraud Initiative, launched in 2021, has produced a series of False Claims Act settlements over cybersecurity representations. They include cases against defense contractors and, in 2025, a university research corporation. Several began with whistleblowers inside the company. CMMC affirmations create a clear, signed record of exactly the kind of claim those cases have turned on. Before CMMC, the government often had to piece together what a contractor had represented. Now it is in a federal system.
A company that affirms compliance while known gaps remain open takes a risk that sits with its general counsel as much as its CISO. Self-assessment makes this sharper, because no outside assessor shares the judgment. The score posted to SPRS and the signature beside it rest entirely on internal evidence.
The response is governance more than technology. Decide who signs, and make sure that person has authority over the remediation budget. Define the evidence package the signer reviews: the System Security Plan, the scoring worksheet, open plans of action and changes since the last affirmation. Set a rule for gaps found between affirmations, including when a posted score must be corrected. Internal audit can test the package before each annual affirmation. Organizations should confirm their specific obligations, and the implications of an affirmation, with counsel.
Flow-down: obligations travel with the data
CMMC requirements flow down to subcontractors that handle federal contract information or controlled unclassified information. Primes therefore need to know which suppliers will touch that information, and at what level each must be assessed. Each subcontractor makes its own affirmation, so a prime’s exposure includes the accuracy of claims it did not write.
Flow-down forces a scoping decision many contractors had postponed. One option is a separate, tightly scoped enclave for controlled information. The other is bringing the whole enterprise to the required level. An enclave limits assessment scope and cost but demands discipline about where data goes. An enterprise approach is simpler to operate but costs more to assess and maintain. Either can work. Leaving the boundary undefined cannot, because the assessment and the affirmation both depend on it.
Outsourced providers sit inside this question too. A contractor that outsources its help desk, cloud hosting or security monitoring brings those providers into scope wherever they touch controlled information. Their contracts should say what evidence they will supply for assessments and affirmations, and how fast.
The three changes land on different desks: eligibility on business development, affirmation on legal and executive leadership, flow-down on procurement. Treating CMMC as an IT compliance project leaves the most important of the three, the signature, without a real owner.
With hindsight
Phase 1 put CMMC status into award decisions and forced contractors to settle scope questions they had deferred. Phase 2 did not arrive on schedule. On July 13, 2026, the Department of War suspended the introduction of Phase 2 third-party assessment requirements. It cited the burden on small and mid-sized businesses and set up a CMMC Reform Task Force to recommend changes. The program rule, the DFARS clauses, SPRS reporting and Phase 1 self-assessments remained in force.
That turn reinforces the case for the affirmation. With independent certification paused, the senior official’s signature is the main assurance the government receives, and the False Claims Act exposure behind it is unchanged. Contractors that treated affirmation as a legal act, with a defined evidence package, were not affected by the pause. Those that had waited for an assessor to validate their posture had less to stand on.