The Department of War suspended CMMC Phase II on July 13, 2026, but DFARS 252.204-7012 remains in effect. Your obligation to protect covered defense information is still contractually binding, and your self-assessment scores are now the primary evidence in any future investigation.
This playbook outlines what your team should do right now.
The Problem: You're Operating Without a Safety Net
The suspension removes the structured validation that C3PAO assessments would have provided. You're still required to implement NIST SP 800-171 Rev 2 controls, but there's no independent assessor checking your work before a contract award or a breach investigation.
Your SPRS score is now your primary accountability mechanism. If you've inflated that score or left gaps unfixed, you're exposed. The same day the Pentagon suspended Phase II, NSA and CISA issued a joint advisory warning that Russian threat actors are exploiting misconfigured routers across the Defense Industrial Base. The threat didn't pause when the certification requirement did.
What You Need Before Starting
Documentation you must have:
- Current SPRS score submission with the date you last updated it
- System Security Plan describing your CUI boundary and security controls
- Plan of Action and Milestones (POA&M) for any controls not yet fully implemented
- Evidence that DFARS 252.204-7012 flows down to every subcontractor handling CUI
- Asset inventory showing which systems process, store, or transmit covered defense information
Access you'll need:
- SPRS portal credentials to update your assessment
- Administrative access to network boundary devices
- Configuration management tools or direct access to baseline configurations
- Logs from authentication systems, preferably centralized
Team roles:
- Someone who understands your CUI data flows
- A technical resource who can validate control implementation
- Legal or compliance lead who can interpret flow-down requirements
If you don't have a current SPRS score or haven't updated it in the past 12 months, that's your first task.
Step-by-Step Implementation
Step 1: Validate Your SPRS Score Against Reality
Log into SPRS and review your current assessment. For each NIST SP 800-171 control you marked as "implemented," ask: can I produce evidence of this control working right now?
Focus on the controls that matter most in the current threat landscape:
Access controls (3.1.x): Can you demonstrate that only authorized users have access to systems processing CUI? Check your Active Directory groups, VPN user lists, and application permissions. Document which roles map to which CUI access.
Incident response (3.6.x): Do you have a documented incident response plan that covers CUI? When did you last test it? The joint advisory highlights router compromises as an active threat vector. If your plan doesn't address network boundary compromises, update it.
Configuration management (3.4.x): Pull the running configurations from your edge routers and firewalls. Compare them against your documented baseline. The advisory specifically calls out poorly configured routers. If you don't have a documented baseline, create one now based on vendor hardening guides.
If you find gaps, don't ignore them. Document them in your POA&M with realistic remediation dates and interim mitigations. An honest POA&M is defensible. An inflated SPRS score is not.
Step 2: Harden Your Network Boundary
The NSA advisory released July 13, 2026, isn't coincidental timing. Threat actors know that many contractors will treat the Phase II suspension as permission to delay security investments.
Router and firewall configuration checklist:
- Disable unused services and interfaces
- Enforce strong authentication
- Enable logging and send logs to a centralized system
- Apply vendor security patches within 30 days of release
- Review access control lists to ensure they reflect current business needs
- Disable remote management interfaces or restrict them to specific IP ranges
If you're running Cisco IOS, start with show running-config and compare against the Cisco IOS Security Configuration Guide. For Juniper devices, review your firewall filter configurations. Fix any plaintext credentials immediately.
Step 3: Document Your CUI Boundary and Data Flows
The CMMC Reform Task Force is soliciting feedback through an RFI with responses due August 14, 2026. One question asks contractors to identify which NIST SP 800-171 controls deliver measurable security value. Your ability to answer that question depends on understanding where your CUI actually lives.
Map every system that processes, stores, or transmits covered defense information. Include:
- Email systems
- File servers and cloud storage
- Engineering workstations
- Project management systems
- Any system that synchronizes with or backs up CUI systems
Update your System Security Plan to reflect this boundary. If CUI has spread beyond the boundary you documented, either expand your boundary or implement compensating controls.
Step 4: Flow Down Requirements to Subcontractors
DFARS 252.204-7012 requires you to flow the clause down to subcontractors at any tier handling CUI. Don't assume your subcontractors are compliant.
Send a written notice to every subcontractor confirming:
- They're required to comply with NIST SP 800-171
- They must report their SPRS score
- They must notify you of cyber incidents affecting CUI within 72 hours
If a subcontractor can't produce a current SPRS score, you have a supply chain risk. Document it and decide whether to accept the risk, require remediation, or find an alternative supplier.
Validation: How to Verify It Works
Self-assessment validation: Schedule a tabletop exercise simulating a CUI breach. Walk through your incident response plan with your team. Can you identify the breach within the timeframes your plan specifies? Can you contain it? Can you report it to the contracting officer within 72 hours as DFARS 252.204-7012 requires?
Configuration validation: Run a vulnerability scan against your network boundary devices. Tools like Nessus, Qualys, or even free options like OpenVAS will identify common misconfigurations. If the scan finds critical or high-severity issues, your baseline isn't sufficient.
Evidence collection test: Pick three controls from your SPRS assessment at random. Pretend an auditor just asked for evidence. Can you produce it in under an hour? If not, your documentation isn't audit-ready.
Maintenance: Ongoing Tasks
Monthly:
- Review logs from boundary devices for anomalous activity
- Check for new vendor security advisories affecting your infrastructure
- Update your asset inventory if you've deployed new systems
Quarterly:
- Re-run vulnerability scans
- Review and update your POA&M
- Verify that subcontractor SPRS scores are current
Annually:
- Update your SPRS score (required within 12 months of the previous submission)
- Conduct a full incident response exercise
- Review your System Security Plan against actual data flows
The Phase II suspension doesn't mean you can defer these tasks. It means you're responsible for validating your own compliance without the forcing function of an external assessment. Treat your SPRS score as if it will be scrutinized in a False Claims Act investigation, because it might be.
