The Department of War’s review of the CMMC Phase II suspension has left many defense contractors waiting for clarity on what comes next. Questions remain about how the program may move forward, what changes may be introduced, and how those decisions could affect certification and assessment requirements.
While the industry awaits an official announcement, contractors shouldn’t put their CMMC efforts on hold.
Regardless of the outcome, organizations handling Controlled Unclassified Information (CUI) will need to understand their environments, address applicable cybersecurity requirements, and demonstrate that appropriate safeguards are in place. Much of the work involved in preparing for CMMC certification or self-attestation remains relevant across either path.
Rather than waiting for the next announcement to determine your next move, use this time to strengthen the foundation of your CMMC program. Here are five readiness activities worth prioritizing now.
Before an organization can demonstrate compliance with CMMC requirements, it needs a clear understanding of where CUI lives, how it moves through the organization, and which systems and assets are involved in protecting it.
This is also the foundation of a defensible assessment scope. If your organization cannot accurately identify the people, processes, technologies, and facilities that handle or protect CUI, it becomes much more difficult to determine which requirements apply and demonstrate they are being met.
Use this time to revisit your CUI data flows and confirm that your documented environment reflects how the business actually operates today.
Scoping Checklist
Consider the following:
■ Identify where CUI is stored, processed, and transmitted. Review the systems, applications, networks, endpoints, and locations that interact with CUI.
■ Validate your asset inventory. Confirm that all relevant assets are accounted for and appropriately categorized, including assets that support or protect the CUI environment.
■ Review your network architecture and boundaries. Make sure your documented boundaries accurately reflect how CUI is accessed and protected.
■ Account for external service providers. Identify cloud service providers, managed service providers, and other third parties that support your CUI environment, and confirm their responsibilities are understood.
Changes to your environment, including new applications, personnel, vendors, or business processes, can affect your CMMC scope. Taking the time to validate these details now can help prevent scope-related surprises later.
CMMC Level 2 is built around the 110 security requirements in NIST SP 800-171 Revision 2. Whether your organization ultimately pursues a third-party assessment or follows an applicable self-assessment path, understanding how your environment aligns with these requirements remains central to demonstrating compliance.
This is a good opportunity to revisit your existing control assessments and determine whether they accurately reflect your current security posture.
Start by reviewing your System Security Plan (SSP) and comparing documented practices against how security controls are actually implemented. A control that was marked as implemented several months ago may no longer reflect current operations. Likewise, changes to your infrastructure, security tools, or internal processes may have introduced new gaps.
Controls to Review
Pay particular attention to:
■ Controls that were previously identified as partially implemented or not implemented
■ Requirements where implementation depends on manual processes or inconsistent employee practices
■ Controls that rely on third-party providers or shared responsibilities
■ SSP descriptions that no longer accurately reflect your environment
■ Changes to policies, procedures, or technical configurations that have not been reflected in your documentation
The goal isn’t simply to confirm that requirements are marked as satisfied. It’s to establish whether your organization can demonstrate that the required safeguards are consistently implemented and supported by documentation.
Meeting a CMMC requirement and demonstrating that it is met are two different things.
During an assessment, organizations must provide objective evidence to support their implementation of applicable security requirements. That evidence may include policies, procedures, system configurations, access control records, audit logs, screenshots, and other documentation that demonstrates how controls operate.
Waiting until an assessment is scheduled to gather this information can create unnecessary pressure, particularly when evidence is spread across different departments, systems, and personnel.
Instead, begin organizing evidence now and establish a repeatable process for maintaining it.
Evidence Management Steps
A few practical steps include:
■ Map evidence to individual security requirements. Make it easy to identify which documents, configurations, or records support each control.
■ Centralize documentation. Establish a secure, organized location for assessment evidence, with appropriate access restrictions and version control.
■ Confirm evidence is current. Review documentation for outdated information, expired records, or configurations that no longer reflect the production environment.
■ Identify evidence gaps. Flag requirements where supporting documentation is missing, incomplete, or difficult to retrieve.
■ Establish ownership. Determine who is responsible for maintaining and producing evidence for each area of the CMMC program.
Strong evidence management can make a meaningful difference in assessment preparation. It also helps organizations maintain visibility into their security practices rather than treating evidence collection as a one-time exercise.
CMMC readiness involves more than the IT or cybersecurity department. It requires coordination across the organization, with clearly defined responsibilities for maintaining controls, managing documentation, and supporting an assessment or attestation.
As organizations revisit their readiness efforts, this is a good time to evaluate whether they have the right people and expertise in place.
Consider whether your current team has the capacity and experience to address the technical, operational, and documentation requirements of CMMC. Identify who owns key responsibilities, where additional expertise may be needed, and how internal stakeholders will coordinate throughout the process.
Key Questions to Answer
For example:
■ Who is responsible for maintaining the SSP and supporting documentation?
■ Who can provide evidence of technical control implementation?
■ Who manages relationships with external service providers?
■ Who is responsible for tracking and remediating identified gaps?
■ Who will coordinate assessment activities and serve as the primary point of contact?
Organizations that rely on external partners should also revisit those relationships and confirm that roles and responsibilities are clearly understood.
For contractors who have not yet assembled a CMMC team, the CMMC Partner Assurance Network (CPAN) can help simplify the process of identifying trusted expertise. CPAN connects defense contractors with an ecosystem of CMMC providers, including Registered Provider Organizations (RPOs), C3PAOs, cloud service providers, managed service providers, and other specialized partners.
Having the right team in place can help organizations navigate the requirements, coordinate responsibilities, and avoid unnecessary rework as they move toward certification or attestation.
Having the right team in place can help organizations navigate the requirements, coordinate responsibilities, and avoid unnecessary rework as they move toward certification or attestation.
A documented assessment of your current security posture is only useful if it leads to action.
As you review your CUI environment, security controls, and supporting evidence, take the time to identify the gaps that could create challenges when your organization is ready to pursue certification or self-attestation.
Not all gaps carry the same implications. Some may involve relatively straightforward documentation updates, while others could require significant technical changes, coordination with external providers, or additional time to implement and validate.
Prioritize gaps based on their potential impact, the effort required to address them, and any dependencies that could slow remediation.
Gaps to Evaluate
Your review should consider:
■ Technical gaps: Security requirements that are not fully implemented or consistently operating.
■ Documentation gaps: Missing, outdated, or incomplete policies, procedures, SSP descriptions, and supporting evidence.
■ Scoping gaps: Unidentified assets, unclear CUI data flows, or incomplete understanding of external service provider responsibilities.
■ Operational gaps: Unclear ownership, inconsistent processes, or insufficient coordination between departments.
■ Resource gaps: Limited internal expertise, competing priorities, or dependencies on external providers.
Once identified, document each gap, assign an owner, establish a remediation plan, and track progress. Even if the eventual CMMC process differs from current expectations, addressing weaknesses in your cybersecurity program and improving documentation will put your organization in a better position to respond.
The outcome of the Department of War’s review will help determine what the next phase of CMMC looks like. But contractors don’t need to wait for that announcement to make progress.
Understanding your CUI environment, validating your security controls, organizing objective evidence, establishing the right team, and identifying gaps are all meaningful steps toward demonstrating compliance.
The organizations that use this time to strengthen their readiness will have a clearer understanding of where they stand and what work remains, regardless of how the program moves forward.
Understanding where your organization stands is an important first step toward CMMC compliance. Coalfire Federal helps defense contractors navigate the CMMC Level 2 assessment process with clarity and confidence. When you're ready to take the next step, talk to our CMMC team.