A 90-day CMMC readiness plan while Phase 2 is paused

Why ninety days, and why now

Since July 13, 2026, CMMC Phase 2 and every later milestone have been suspended "until further notice." As of early November 2026, no restart date has been announced. Phase 1 self-assessments, the annual affirmation and the underlying NIST SP 800-171 obligations remain in force, so a supplier handling controlled unclassified information still has to get this done. The difference is that you can now do it in a sensible order.

Ninety days is long enough to reach an honest score and short enough to hold everyone's attention. The plan below assumes a company of 20 to 200 people with a part-time IT lead or an outside provider, a senior official willing to own the result, and no assessor due at the door.

The shape of the plan

Each phase produces something you can hold in your hands. If a phase does not produce its output, do not start the next one. Effort below is relative, and it shifts with the size of your network and how much CUI you actually handle.

Weeks	Work	Owner	Output	Effort
1 to 4	Contracts, CUI inventory, boundary, assets	Senior official, contracts lead, IT lead	Scope document, data flow, asset inventory, network diagram	Moderate, mostly reading and interviews
5 to 8	Gap score, fix highest-point gaps, write the plan	IT lead or provider, shop and quality leads	Closed gaps, system security plan, plan of action	Heaviest of the three
9 to 12	Evidence, final score, SPRS, affirmation	IT lead, reviewer, Affirming Official	Evidence file, score in SPRS, affirmation	Moderate, mostly collection and review

Week 1: name the owner and read the contracts

Name one senior official who will own the outcome and, most likely, serve as Affirming Official under 32 CFR 170.22. Then pull every active DoD contract, subcontract, purchase order and open solicitation. Record which of FAR 52.204-21, DFARS 252.204-7012 and DFARS 252.204-7021 each one carries, the CMMC level it names, and any leftover third-party assessment language the July memo says should come out.

This one week answers the largest question in the plan: whether you are aiming at Level 1 or Level 2. Federal contract information alone means Level 1 and its 15 requirements. Controlled unclassified information means Level 2 and all 110.

Weeks 2 and 3: find where the CUI really is

Interview the people who touch the work: contracts, engineering, purchasing, quality and the shop floor. Ask each person how a drawing or specification reaches them, where they save it, and who they send it to. Follow actual files. Look at email, shared drives, cloud storage, CAD and CAM systems, inspection equipment, phones and removable media.

Write the result as a data flow on one page: where CUI enters, where it rests, where it moves, and how it leaves. Expect to find more paths than you assumed, because that is the point of the exercise. Each path you remove is a set of systems you no longer have to secure and document.

Week 4: draw the boundary and classify the assets

Decide the smallest boundary that can do the actual work, then sort every asset into the categories in 32 CFR 170.19: CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and Out-of-Scope Assets. Draw the network diagram. Record who your external service providers are and whether each one handles CUI or security data.

List your own lower tiers at the same time. DFARS 252.204-7021 requires you to flow the correct level down to any supplier that will handle federal contract information or CUI, and to confirm that supplier's status before award, so every outbound drawing is also a scoping question.

Hold a decision meeting at the end of the week with the senior official. The boundary is a business decision as much as a technical one, because it sets the cost of everything that follows.

The boundary is a business decision as much as a technical one, because it sets the cost of everything that follows.

Weeks 5 and 6: score the gaps and fix the expensive ones

Score your current state against NIST SP 800-171A, objective by objective. Do not soften it. A requirement with one unmet objective is not met, and 32 CFR 170.24 says a requirement not implemented is scored not met whether or not it appears on a plan of action.

Then work the list by points, not by convenience. The method subtracts five points for requirements that could lead to significant exploitation of the network or exfiltration of CUI, and those come first. Multifactor authentication is a common early win: it costs five points when no users have it, and three when only remote and privileged users do. Encryption of CUI that is not FIPS-validated costs three, and no encryption costs five.

Also clear the items that can never go on a plan of action for a Conditional status: the system security plan itself, verification of external connections, control of public information, and the physical protections for escorting visitors, keeping access logs and managing physical access. These are not available for deferral at any score.

Treat machine tools, inspection equipment and other shop technology separately. Under 32 CFR 170.19, operational technology and test equipment count as Specialized Assets. They must appear in the inventory, the plan and the network diagram, and you must show they are managed under your risk-based policies and practices, but at Level 2 they are not assessed against the other requirements. Isolating them on their own network segment is usually less work than arguing about them later.

Weeks 7 and 8: write the plan and the POA&M

Write the system security plan from the scope work you already finished: boundary, environment, asset inventory, connections, and a narrative for each of the 110 requirements that names the tool, the setting, the owner and the record it produces. Under 32 CFR 170.24, without a current plan there is no assessment at all.

For whatever remains open, write a plan of action with a specific owner, resource and date for each item. A Conditional status needs at least 80 percent, which is 88 of 110, with only one-point items allowed on the plan apart from a narrow exception for encryption that is not FIPS-validated, and the plan must close within 180 days. If a final count below 88 looks likely, that is the moment to tell leadership, not week 12.

Separate what cannot be fixed from what simply has not been. An enduring exception, such as a controller that cannot be fully secured, is scored met when the plan describes it along with its mitigations. Writing it down accurately now saves a long conversation later.

Weeks 9 and 10: gather evidence in final form

For each requirement, assemble what proves it: configuration exports, screenshots with dates, signed policies, training records, access reviews, log reviews, patch reports and incident response test results. The rule is firm that evidence must be in final form, and that working papers, drafts and unofficial policies do not count. Name each file so a reader can find it from the requirement number.

Have someone other than the system operator test a sample of it. A skeptical reviewer inside the company costs less than the same question from outside.

Weeks 11 and 12: score honestly, post and affirm

Rescore every requirement against the evidence, not against memory. Enter the score, status date, scope and CAGE codes in SPRS, along with any plan of action. Have the Affirming Official read a short summary and the sample results, then submit the affirmation. Calendar the next affirmation one year out, the 180-day closeout if you are Conditional, and the next self-assessment three years out.

Day 91 and after

The work does not end when the affirmation is submitted. Requirement 3.12.3 in NIST SP 800-171 calls for monitoring security controls on an ongoing basis, and 3.12.1 for assessing them periodically. Put a short monthly review on the calendar for access changes, log review, patching and open plan-of-action items, and name the person who runs it. A company that keeps that rhythm walks into next year's affirmation with a file that mostly maintains itself.

What to buy, and what to hold off on

Spend on what closes a scored gap and on what shrinks the boundary. Hold off on anything whose value depends on a schedule nobody has set.

• Buy now: multifactor authentication across the boundary, FIPS-validated encryption for CUI, centralized logging you will really review, and endpoint protection
• Buy now: a cloud service that meets the FedRAMP requirements in DFARS 252.204-7012 if you are going to keep CUI in the cloud
• Buy now: an outside review of your score, if your internal team cannot test its own work
• Buy now: a DoD-approved medium assurance certificate, which DFARS 252.204-7012 requires in order to report a cyber incident within its 72-hour window
• Hold: a third-party assessment date, since contracts during the suspension may call only for Level 1 (Self) or Level 2 (Self)
• Hold: a large compliance platform before you know your scope
• Hold: a network rebuild before you have tried reducing where CUI goes

Where these plans slip

• Buying tools in week 1, before the scope tells you what you need to protect
• No senior owner, so nobody can decide the boundary or fund the fixes
• Writing the plan before scoring the gaps, which produces a description of the network you wish you had
• Treating week 12 as the end. The annual affirmation comes back, and the controls need someone tending them every month

Frequently asked questions