The first decision is scope, and it is commercial rather than technical. Where Controlled Unclassified Information is allowed to live determines how many systems are assessed, how much evidence has to be maintained, and what the whole programme costs. Two companies of the same size can differ by an order of magnitude on that basis alone. The engineering team can draw the boundary, but only the business can decide whether narrowing it is worth the operational friction, and that trade is a chief executive question.
The second is the affirmation. Under 32 CFR 170.22 a senior official affirms continuing compliance, at the time of the assessment and annually after it, and that affirmation is submitted to the government. It is a statement by the company about the company. Whoever signs it needs to be someone who can actually find out whether it is true, which in practice means the reporting line that produces the evidence has to be built before the first signature, not after it.
The schedule moved. The obligation did not.
On 13 July 2026 the Department of War suspended CMMC Phase 2, including the third-party certification requirement that was due to appear in contracts from 10 November 2026, and opened a review. It is reasonable to reset a timeline on that. It is not reasonable to stop: the safeguarding duties under Federal Acquisition Regulation 52.204-21 and Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 are unchanged, self-assessment and annual affirmation remain in force, and a supplier who stands the programme down will restart it under whatever schedule the review produces, with less time.
What to delegate
- The technical assessment of all 110 requirements, and the sequencing of remediation by points recovered.
- The System Security Plan and the Plan of Action and Milestones, which are documents produced from evidence rather than written in advance.
- The evidence cadence that keeps the score true between assessments, since the affirmation comes due every year.
Primary sources
- CMMC Program final rule (32 CFR Part 170)
- 32 CFR 170.22 — Affirmation
- CMMC Model Overview, Version 2.13 (September 2024)
Reference material, not legal advice. Where a specific number, deadline or level determination affects a decision, work from the source document and your own contract language.