There is no cliff, and that is the problem
Firms brace for a date the way you brace for a tax deadline: one morning, everything changes. That is not how this works, and the misunderstanding causes real harm in both directions. Nothing arrives in the post. No inspector appears. What happens instead is that eligibility gets decided individually, on each award, as it comes up — and because the decisions are spread out, a firm can drift past readiness without any single moment that forces the issue.
The mechanism runs through two clauses. The solicitation provision, DFARS 252.204-7025, tells offerors what level a contract will require and obliges them to hold that status in SPRS before they are eligible for award. The contract clause, DFARS 252.204-7021, requires a current status in SPRS before award, before an option is exercised, and before a period of performance is extended — and requires the status to be maintained for the life of the contract, with a named official completing an annual affirmation of continuous compliance.
Read that middle phrase again, because it is the one that catches people. Before an option is exercised. Most firms plan their readiness around the next proposal. The nearer deadline is frequently a base year ending on work already in hand, where an option worth more than the pursuit they were preparing for comes up for exercise. Nobody sends a warning about that, because it is not a new competition. It is a routine administrative step that has quietly acquired a precondition.
The clause also flows down. It reaches subcontractors at all tiers that will process, store or transmit federal contract information or controlled unclassified information, and those subcontractors post their own results and affirmations. So a firm that never signs a contract directly with the government can find its eligibility gated at whatever tier it sits, on a timetable set by a prime rather than by the Department.
You are probably here because
- You started late and want to know honestly how bad it is
- A prime asked for your status and you do not have one to give
- An option comes up in a few months and somebody just mentioned the clause
- Someone suggested affirming a score you are not confident in
Read the conditional-status section for the legitimate partial path, then the ninety-day triage. The section on the affirmation is the one to read before anyone signs anything.
The partial path exists on purpose
The rule anticipates that firms will not all be at one hundred and ten out of one hundred and ten, and it builds a route for that. A Level 2 assessment starts at 110 and subtracts 5, 3 or 1 point per unimplemented requirement. A score of 88 or higher — exactly eighty percent — permits a Conditional status with a plan of action and milestones attached, and an award can be made against that conditional status.
It is a deadline, not a grace period. The plan has to be closed out within 180 days of the conditional status date, and if it is not, the conditional status expires. That timing lands in the middle of performance rather than before award, which is a worse moment to have an eligibility question than the one you were trying to avoid.
Two constraints on that path matter more than the number. Six requirements can never sit on a plan of action at any score: the two access-control requirements covering external connections and control of publicly posted information (AC.L2-3.1.20 and AC.L2-3.1.22), the system security plan itself (CA.L2-3.12.4), and the three physical-access requirements covering visitor escorting, physical access logs, and management of physical access (PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5). If any of the six is unmet, there is no conditional route regardless of the total. And the plan itself is read. A plan naming the gap, the fix, the owner and a date that is actually achievable reads very differently from one that lists forty items due on the same Friday.
The risk that is actually worse than missing a date
There is one outcome genuinely worse than being ineligible for an award, and firms walk into it while trying to avoid the lesser one.
The annual affirmation is a named official attesting, in a government system, that the organization continues to meet the requirements. Sign that to hold a date, with a score you have not validated or a boundary that no longer describes reality, and the problem is no longer a compliance problem. It is a signed representation to the government. The accreditation body's own framing of certification is that it is the best available protection against False Claims Act exposure, and the corollary is unavoidable: the exposure comes from the attestation, not from the gap.
The drift version of this is quieter and more common. A firm posts a self-assessment score, the environment changes over eighteen months, nobody re-scores, and the affirmation is renewed on the strength of a number that was true once. That is why the July 2026 pause does not reduce anyone's risk. A firm holding a Level 2 self-assessment it has not revisited since Phase 1 began is carrying more exposure now than it was a year ago, not less, because the number has had longer to become wrong.
The rule that follows is short. Never affirm to make a date. Being late is recoverable and it is a commercial problem. A false attestation is a different category of problem entirely, and it does not get better with time.
Ninety days, in the order that preserves the most
If you are behind, the goal is not to reach one hundred and ten. It is to protect the revenue you already have and to be honest about the rest, in that order.
Days 1–5. Build the real deadline list. Not a date on a wall — a list. Every current award with an option or extension coming up in the next twelve months, every solicitation you intend to bid, and every prime flowdown you have signed. Note what level each one calls for and when the decision point actually falls. Most firms find the nearest date is an option exercise nobody had connected to this.
Days 3–10. Confirm the level. Half the firms that believe they need Level 2 have not verified that CUI is genuinely in play. Read the clauses, the data deliverables and their distribution statements. If it is ambiguous, ask the contracting officer in writing. A firm that only ever handles federal contract information owes fifteen requirements and an annual self-assessment, and that discovery can end the emergency in a week.
Days 5–15. Check the six, then score honestly. The six requirements ineligible for a plan of action come first, because they determine whether a conditional path exists at all. Then score against all one hundred and ten with the five-point items first. An honest number, even a bad one, is the foundation of every decision that follows. A flattering number is worse than no number, because it will end up in an affirmation.
Days 10–30. Shrink the boundary. The fastest way to raise a score is to reduce what is being scored. Moving controlled work into a small, deliberately instrumented enclave converts most of the estate into assets documented as kept clear rather than assessed against the full set. This is faster than remediating a whole corporate network and it is the same work you would have done eventually.
Days 20–60. Remediate by weight, and turn on the record generators early. Five-point items first. Multifactor authentication and FIPS-validated cryptography are the two requirements with partial credit in the scoring, which makes moving each from partial to full unusually good value. And enable logging, retention and automated exports now rather than later, because some objectives are satisfied only by records that have accumulated, and history is the one thing you cannot buy at the end.
Days 45–90. Decide each pursuit individually. With a real score and a real boundary you can make honest calls: bid, sub, restructure, or pass. That decision per pursuit is the deliverable of the ninety days, not a certificate.
| Where you are | What actually happens | The move |
|---|---|---|
| Above 88, gaps documented | A conditional status is available, with a 180-day closeout obligation | Write a plan that is credible and dated, and resource the closeout before you rely on it |
| Below 88 | No conditional route; ineligible where the requirement applies | Shrink the boundary first, then remediate by point weight. Both raise the score; the first is faster |
| One of the six unmet | No conditional route at any score | Fix those before anything else. The physical three are often days of work, not months |
| Option exercise inside six months | The status is a precondition for the option, not only for new awards | Tell the contracting officer or prime now, with a dated plan. Late notice is what removes options |
| Prime flowdown you cannot meet | A commercial obligation, negotiable in principle | Propose a workshare where controlled data does not reach you, or a phased commitment with dates |
| A posted score that has drifted | The affirmation is the exposure, not the gap | Re-assess and update the entry. Correcting it is always better than renewing it |
What to tell a prime, and when
Primes are not surprised that small suppliers are behind. They are surprised in October by something they could have known in June, and that is what removes a supplier from a bid list.
Say where you are, in the terms the clause uses: your current status, your boundary, your honest score if you have one, your dated plan. Primes make sourcing decisions on trajectory as much as on current state, and a supplier with a credible plan and a named owner is a manageable risk. A supplier who says it is handled and produces nothing in September is not.
Be accurate and be specific, and do not promise a date you cannot hold. There is no advantage in an optimistic commitment that fails in the last month; it converts a solvable problem into a broken relationship. If a date is not achievable, propose the alternative in the same breath — a narrower workshare that keeps controlled data on their side, a later phase, a different scope. Bringing an option rather than only a problem is what keeps a supplier on the list.
What determines whether a firm loses work over this — our read
Our judgment from watching these situations, not a survey. The top two are administrative and nearly free; the one everybody focuses on is fifth.
What not to do, even under pressure
Four moves make a recoverable position unrecoverable, and all four are tempting when a date is close.
Do not affirm a status you cannot support. Everything above, in one line. The attestation is the exposure.
Do not accept a flowdown you know you cannot meet. Signing it to keep the relationship converts a commercial conversation you could have had in June into a breach you will have in December. Negotiate the workshare instead, before signature.
Do not buy your way out with a product. Nothing in a shopping cart makes an environment compliant, and money spent on a platform before the boundary is drawn is money that buys a more expensive place to store the same uncertainty.
Do not take the controlled data while you sort it out. This is the one with the sharpest edge. Accepting CUI onto systems that are not ready starts the safeguarding obligation immediately — including the requirement to report a cyber incident within 72 hours of discovery and to preserve affected system images for at least 90 days. Those obligations come from the safeguarding clause and do not wait for your readiness project. If you are not ready to hold it, do not accept it yet.
Where you do not need outside help
Some versions of being behind are not engineering problems, and it is worth naming them.
If you are above 88 and every remaining gap is documentation — a procedure unwritten, an artifact not exported, a review not recorded — that is internal work by someone methodical, and it is measured in weeks. Paying an outside firm for it buys you a project manager at engineering rates.
If your level turns out to be Level 1, the whole thing is fifteen requirements, self-assessed annually, posted with an affirmation. Do them properly and move on. Nobody needs to be hired.
If the honest answer is that the defense revenue does not justify the program, that is a legitimate strategic position and not a failure. Staying deliberately clear of controlled data, or subbing under a prime who holds it, are both real strategies used by real firms. The bad outcome is not choosing either one — it is drifting, accepting the data anyway, and ending up with controlled information on unmanaged machines and a signature already on file.
The narrow places outside help earns its money: designing and building an enclave under time pressure, building the evidence generation so the package maintains itself, and providing an independent reader who has no stake in the answer. Those are the ones we take.
The mistakes we see most
- Planning around the next proposal and missing an option exercise that comes first
- Assuming Level 2 applies without ever verifying that CUI is actually in play
- Treating a conditional status as breathing room rather than as a 180-day obligation
- Remediating alphabetically instead of by point weight and by what cannot be deferred
- Telling the prime late, which converts a manageable risk into a sourcing decision
- Signing an affirmation to hold a date — the one genuinely unrecoverable move
- Accepting controlled data before the environment is ready, starting obligations you cannot meet
- Renewing a posted score that has quietly stopped describing the environment
If you are behind, in order
- Every option, extension and intended bid in the next twelve months is on one list
- The required level is verified against the contract, not assumed
- The six requirements ineligible for a plan of action are checked first
- An honest score exists, produced without flattery
- The boundary has been reduced as far as the work allows
- Logging, retention and automated exports are already running
- Remediation is sequenced by point weight
- Primes and contracting officers have been told, with dates that are achievable
- Any plan of action names a gap, a fix, an owner and a real date
- Nobody has signed an affirmation that the score does not support
Bottom line
Missing readiness is not a cliff and it is not a catastrophe. It is a series of individual eligibility decisions, and the nearest one is usually an option on work you already hold rather than the bid you were preparing for. Build the real deadline list, verify the level, check the six requirements that can never be deferred, get an honest score, and shrink the boundary before remediating — because reducing what is assessed raises the number faster than fixing everything inside it. Then tell your primes early and specifically. The one thing to hold absolutely is the affirmation: sign it when it is true and not before. Being late costs work you can win back. A signature that was not true costs something else.
Frequently asked questions
The clause requires a current status in SPRS before an option is exercised and before a period of performance is extended, and requires the status to be maintained for the life of the contract. So the near-term risk is usually to an option or an extension rather than to the base period. This is the deadline firms most often miss, because it is a routine administrative step rather than a competition. Put every upcoming option on the list before you plan anything else.
It buys a different deadline. A score of 88 or above permits a conditional status with a plan that must be closed out within 180 days of the conditional status date, and if it is not, the status expires mid-performance. Six requirements can never appear on such a plan at any score. Treat conditional status as a funded project with an owner and a date, not as relief.
No, and the parts that were not suspended are the parts with teeth. The safeguarding clause, the underlying standard, the Phase 1 award conditions and the annual affirmation all continue. Phase 1 already permits the Department to require a third-party assessment on a specific requirement at its discretion, and primes set their own sourcing standards regardless of the government's calendar. Work spent implementing the requirements is not at risk from the review.
Your current status, your boundary, your honest score if you have one, and a dated plan with a named owner. Accurate and early beats optimistic and late by a wide margin, because primes are managing risk across many suppliers and can plan around a known position. If a date is not achievable, bring the alternative in the same message — a workshare that keeps controlled data on their side is a real answer and it is frequently accepted.
Re-assess and update the entry. A stale score that gets renewed through an annual affirmation is the fact pattern that turns a technical gap into a legal one, and correcting it is always better than carrying it forward. Do the re-score honestly, update the record, and put a recurring review on the calendar so the number and the environment stay attached to each other.