Did the word “extension” nudge your CMMC project into next year’s budget? That’s a fair reading of the headlines. Between bids, schedules, and punch lists, a compliance project is easy to slide down the list. On July 13, 2026, the Department of War suspended Phase 2, the third-party assessment step due to start November 10. It also set up a Task Force to review the program. A pause for review doesn’t pause the rules underneath it, so CMMC NIST 800-171 readiness work still makes sense today. You can build a four-document readiness file before year end, and every piece rests on requirements already in force.
What Goes Into a CMMC NIST 800-171 Readiness File?
A readiness file comes down to four documents, and the Department still enforces NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments. NIST withdrew Rev 2 on May 14, 2024 in favor of Rev 3, but the Department still measures against it, so that’s the text you’ll work from.
Here’s the file at a glance:
| Document | Owner | Month | Requiring rule |
|---|---|---|---|
| CUI scope and asset inventory | Your leadership and the people who run your systems | October | DFARS 252.204-7012 and the CMMC Scoping Guide |
| System security plan | Your IT lead, with outside help if you want it | November | NIST SP 800-171 requirement 3.12.4 and 32 CFR 170.21 |
| POA&M | Your IT lead and the executive who approves the budget | November to December | DFARS 252.204-7019 and 32 CFR 170.21 |
| SPRS score | You, as the contractor posting it | December | DFARS 252.204-7019 |
How Do You Scope CUI in October?
Scoping means writing down which contracts, people, and systems touch controlled unclassified information (CUI). Every later document describes only what sits inside that boundary.
Start With the Contract and the Prime’s Flowdown
Every scoping conversation begins with one question. Does your contract involve CUI, or only federal contract information (FCI)? FCI is information the government provides or generates for a contract that isn’t meant for public release. A contract that carries only FCI sits at Level 1, with 15 requirements, an annual self-assessment, and no POA&M. If yours carries CUI, you’re in Level 2 territory and the rest of this file applies. Our breakdown of CMMC’s levels covers that split in more detail.
Construction adds a second wrinkle because plans pass through so many hands before they reach your trailer. DFARS 252.204-7012 lists engineering drawings among the technical information it covers. Whether a given set counts as covered defense information depends on how your contract marks it. Information you collect or develop while performing the contract can count too. So can whatever your prime decides when it passes information down to you. The simplest move is to ask your prime in writing which project documents it treats as covered. Keep that answer with your scope.
Map Job-Site Devices, Temporary Networks, and Shared Platforms
Sort your environment into the five asset categories in the CMMC Scoping Guide. Each question below can be answered from your own setup:
- CUI assets store, process, or transmit CUI. Which job-site laptops, tablets, and phones open files from your prime?
- Security protection assets protect those systems. Does the firewall or VPN at the job trailer belong here?
- Contractor risk managed assets could handle CUI but aren’t meant to, and your own policies manage that risk. Which devices fall in this group?
- Specialized assets include equipment such as IoT devices and test equipment that can handle CUI but can’t be fully secured. Do any cameras, sensors, or machine controllers on site connect to your network?
- Out-of-scope assets can’t touch CUI at all. Can you show why, for example through separate networks?
Shared project platforms deserve a question of their own. Where do drawings, submittals, and requests for information live, and who can open them? Does your prime or a vendor host the platform?
The Guide expects an asset inventory and a network diagram. It also expects your system security plan to describe how you treat each asset. Start the inventory now. If a temporary job-site network is up, sketch its diagram while the trailer’s still on site.
How Do You Write the System Security Plan in November?
The system security plan (SSP) explains how you meet each of the 110 requirements in NIST SP 800-171 Rev 2. You write it against the scope you set first.
Nobody enjoys writing a plan this size between pay applications. NIST offers a CUI system security plan template and doesn’t prescribe a format, so there’s no blank page. Some firms write the plan in house and others bring in help. Either way, the people who run your systems need to confirm that every entry is true. Our guide to who does what when you need CMMC compliance support includes a roles table that shows who writes the plan, who keeps scoping, and who handles the affirmation.
Write each entry the way things stand today. You’ll probably find controls you haven’t finished yet, and that’s the point of writing the plan now. Those gaps become your starting list for the POA&M.
How Do You Build the POA&M for What the Plan Reveals?
A plan of action and milestones (POA&M) lists each requirement you haven’t met, what you’ll do about it, and when. Two different rule sets decide what can sit on it.
What a DFARS Plan of Action Records
Under DFARS 252.204-7019, a Basic Assessment submission includes the date the assessment was completed and the CAGE codes tied to your system security plan. It also includes a summary score, such as 95 out of 110, and the POA&M backs up the date you project for reaching 110.
What the CMMC Rule Won’t Let You Defer
The CMMC rule at 32 CFR 170.21 is stricter, and Level 1 allows no POA&M at all. At Level 2, the rule sets four limits:
- Conditional status needs a score of at least 80 percent, which works out to 88 out of 110.
- Deferral is limited to one-point requirements, with one narrow encryption exception.
- The system security plan can never go on a POA&M, and five other requirements are excluded with it.
- Open items must close within 180 days of the conditional status date, or the status expires.
The Department’s CMMC page also allows POA&Ms for Level 2 self-assessments, with the same 180-day closeout. Keep two lists, labeling each entry with the rule it answers to, so your score agrees with both.
How Do You Post a Current SPRS Score in December?
A current score comes from an assessment no more than three years old, unless the solicitation asks for newer. You post it as a summary score in the Supplier Performance Risk System (SPRS), under DFARS 252.204-7019.
Scores start at 110 and drop with each requirement you haven’t met, and the possible range runs down to negative 203, according to a June 2026 Justice Department settlement announcement. That release describes allegations rather than findings.
The score is your own self-assessment, so post it last, after the SSP and POA&M are done, and make sure all three tell the same story. Our team can help you find gaps and prepare, but the score and the annual affirmation stay with you.
What Do You Do When the Task Force Reports?
As of this writing, the Department’s CMMC page still lists the program as paused in Phase 1, with no restart date announced.
The Task Force began its review on July 13, and we haven’t seen a public report yet. We can’t say what it will recommend, and nothing in this file depends on a guess. What you can control is the file itself, and three habits keep it current:
- Date every document.
- Revisit the scope when a contract changes.
- Check your prime’s flowdown language at each renewal.
When the report lands, lay it next to your file and adjust whatever needs it.
Check Your Readiness File Plan With Our Team
Your scope, plan, POA&M, and score rest on DFARS 252.204-7012, DFARS 252.204-7019, and 32 CFR 170.21, all in force today. Check your readiness file plan with our team before the Task Force reports. We’ll help you find gaps, prepare questions for your prime, and decide which pieces to write in house. The self-assessment, the score, and the affirmation stay yours.
