Preparing for a government-led cybersecurity assessment

Government-led assessments stayed on the table during the pause

When DoD suspended CMMC Phase 2 on July 13, 2026, third-party assessments stopped being the near-term default. Government assessments did not stop. DoD said that during the suspension it will continue using self-assessments and select government-led assessments, and contractors remain subject to government audits typically performed by DCMA's Defense Industrial Base Cybersecurity Assessment Center, known as DIBCAC.

So a firm can post a self-assessed score today and still be asked to prove it. As of early November 2026, no Phase 2 restart date has been announced. This guide covers what those assessments are, what authorizes them, what assessors look at and how to spend the weeks after notice arrives.

Two separate things share the DIBCAC name

DIBCAC performs CMMC Level 3 certification assessments, and the suspension bars program offices from designating those during the review period. Separately, the government can run Medium and High NIST SP 800-171 DoD Assessments of a contractor's implementation. Those come from the DFARS clause and are the ones this guide addresses.

The clause that authorizes the assessment

The authority sits in the NIST SP 800-171 DoD Assessment Requirements clause. In the codified DFARS it is 252.204-7020. DoD's current class deviation carries it as 252.240-7997, dated February 2026, so check which number your contract uses. Either way the core duty is the same: "The Contractor shall provide access to its facilities, systems, and personnel necessary for the Government to conduct a Medium or High NIST SP 800-171 DoD Assessment."

The clause flows down to subcontractors, excluding commercially available off-the-shelf items. The DFARS policy text also says these assessments will not duplicate other DoD assessments except in rare circumstances, such as when cybersecurity risks, threats or awareness have changed. When DCMA conducts one, the result takes precedence over any other assessment.

Medium and High assessments compared

The clause and the DoD Assessment Methodology describe two levels of government review.

Feature	Medium	High
Conducted by	Government personnel trained in DoD procedures	Government personnel trained in DoD procedures
Consists of	Review of prior assessments, thorough document review, discussions with the contractor	All of that, plus verification, examination and demonstration of the system security plan
Confidence	Medium	High
Setting	Per the methodology, a separately scheduled visit such as a Critical Design Review	On-site is preferred; virtual is possible, with some requirements left untested
Method	NIST SP 800-171A, focused on how the plan describes each requirement	NIST SP 800-171A, with evidence and demonstration

Both are scored with the method in 32 CFR 170.24. Network access by the assessors is not required under the methodology. You show them, on your systems, while they watch.

What assessors ask for

NIST SP 800-171A defines three methods: examine, interview and test. The methodology gives examples of what a High assessment reviews: recent scanning results, system inventories, configuration baselines and a demonstration of multifactor authentication.

The system security plan is the center of it. A High assessment validates that requirements are implemented as described in that plan, so every sentence in it is a claim someone may test. The methodology says the absence of a plan means an assessment cannot be completed. It also says requirements not implemented are assessed as not implemented whether or not a plan of action exists.

Every sentence in your system security plan is a claim someone may test.

Every sentence in your system security plan is a claim someone may test.

Scope comes first. Expect to walk through what is inside your boundary and why. The CMMC rule's asset categories show what a well-prepared environment has on hand: an asset inventory, the treatment of each asset type in the system security plan, and a network diagram of the assessment scope. An assessor who finds a server on the floor that is missing from all three will start to doubt the rest of the plan.

The evidence package to assemble first

Gather these before anything else, in one controlled location, indexed by requirement number.

• The current system security plan, with its approval and revision history
• Your plan of action, with dates and progress on each item
• Asset inventory and network diagram of the assessment scope
• Approved policies and procedures, in final form
• Recent vulnerability scan results and patch reports
• Configuration baselines for servers, workstations and network devices
• Account lists with privileged accounts identified, and multifactor authentication coverage
• Training records, incident records and visitor logs
• The service description and responsibility matrix from any outside provider
• Your SPRS entries and the score you posted

Interviews and demonstrations

Assessors talk with the people who do the work. Expect them to ask your IT lead how an account gets disabled, your office manager how visitors are escorted, and a shop employee where drawings are kept. Answers should come from experience and match the plan. Rehearsing a script usually goes badly, while walking through real tasks with your people beforehand goes well.

Demonstrations are short and specific. Have someone sign in with a second factor. Pull a log entry for a particular event. Show that a former employee's account is disabled. Show a patch report and explain the items still open. Prepare by running each demonstration yourself on the machines an assessor would see.

Decide who is in the room. One coordinator should track every request, who answered it and what was shown, so nothing is promised twice or forgotten. The IT lead or your provider's engineer should be available for technical questions, and the executive who signs the affirmation should open the assessment and be reachable throughout. Assessors notice whether leadership treats this as serious.

A plan for the 30 days after notice

Treat these as planning windows. The notice you receive sets the real dates.

Days	Work
1 to 5	Name one coordinator. Read the notice closely, confirm scope and level of assessment, and freeze changes to the plan until you have read it through.
6 to 15	Build an evidence index by requirement. Rescore yourself honestly against 32 CFR 170.24 and compare with the score in SPRS.
16 to 25	Run a mock review of the hardest requirements. Practice demonstrations and walk staff through what will be asked. Fix what can be genuinely fixed.
26 to 30	Handle logistics: rooms, escorts, a clean way to display evidence, a daily wrap-up, and the people who must be present.

Reconcile your score before they do

If your own rescore comes in below your posted number, correct it. The government's Medium or High result posts to SPRS as a summary score and takes precedence over your self-assessed score, and a gap discovered by the assessor is a much harder conversation than one you closed yourself. A posted score is also a statement to the government, with the exposure that carries.

After the assessment: the rebuttal window

The clause gives you a defined path. DoD provides the summary level score and offers an opportunity for rebuttal and adjudication before posting it. "Upon completion of each assessment, the contractor has 14 business days to provide additional information to demonstrate that they meet any security requirements not observed by the assessment team or to rebut the findings that may be of question."

Keep a running list during the assessment of anything an assessor did not get to see. Fourteen business days goes quickly, and the people who know the evidence will be back at their regular jobs.

Handling your evidence during the assessment

A High assessment may produce documentation beyond what the clause lists. DoD says it will retain and protect that as CUI for internal DoD use, and it points to Freedom of Information Act exemptions for protection against release. For a virtual High assessment, the methodology describes transmitting data through DoD Secure Access File Exchange and destroying contractor data after the assessment. Mark your evidence package and control how copies leave the building.

Mistakes that make an assessment harder

• Editing the plan overnight to match what an assessor just said, which reads as what it is
• Offering a plan of action as proof a requirement is met
• Sending the senior person alone, when the people who do the work have the answers
• Handing over draft policies, since the scoring rule says drafts and unofficial or unapproved policies are unacceptable evidence
• Guessing in an interview, when "let me get the person who runs that" is a fine answer

Frequently asked questions