Compliance & Regulations|April 6, 2026|10 min read

CMMC in Your Proposal Process: Phase 1 Rules, the Phase 2 Pause, and What to Change

CMMC Phase 1 is in force and Phase 2 is suspended. Here's how to build current CMMC status into bid decisions, compliance matrices, teaming documents, and reusable content.

Projectory team

A proposal team can write a strong technical volume and still be ineligible for award because of a CMMC status nobody checked. When a DoD solicitation includes the CMMC notice provision, an offeror is not eligible for award without the current CMMC status entered in SPRS at the required level and a current affirmation of continuous compliance for the systems that will handle Federal contract information or CUI [6]. That makes CMMC a bid decision input, not a section you finish during final review.

The program is also moving. Here is where it stands, and what your proposal process should do about it.

Where CMMC Stands in October 2026

The CMMC rule phases requirements in. Phase 1 began on the effective date of the DFARS CMMC acquisition rule [2], which was November 10, 2025 [1]. In Phase 1, DoD intends to require Level 1 (Self) or Level 2 (Self) status for applicable solicitations and contracts as a condition of award, and may require Level 2 (C3PAO) at its discretion [2]. Phase 2 was to begin one calendar year later, adding Level 2 (C3PAO) as a condition of award for applicable contracts [2].

On July 13, 2026, the Department of War suspended Phase 2, which was scheduled to begin on November 10, 2026, and established a CMMC Reform Task Force to review the program [3]. Phase 1 remains in full effect: self-assessment requirements, DFARS 252.204-7012, NIST SP 800-171 Rev 2 compliance, SPRS score postings, and annual affirmations continue [4].

ItemStatusWhat it means for the proposal team
Phase 1In effect since November 10, 2025 [1][2]Expect Level 1 (Self) or Level 2 (Self) requirements in applicable solicitations
Phase 2Suspended July 13, 2026 [3]C3PAO certification is not a general award condition while the suspension lasts
Safeguarding and reportingContinue [4]DFARS 252.204-7012 obligations and NIST SP 800-171 Rev 2 implementation still apply
SPRS and affirmationsContinue [4]Your score and affirmation must be current when the solicitation requires them [6]
Program changesUnder review by the CMMC Reform Task Force [3]Re-check the solicitation and current guidance before every bid decision

Put CMMC Status at the Bid Decision, Not Final Review

The practical question at the pursuit gate is narrow: what CMMC level does this solicitation require, and do we and every teammate who will handle FCI or CUI hold it, in SPRS, today? If the answer is no and the gap cannot close before award, the pursuit fails a hard gate regardless of technical strength.

Record four facts for every pursuit:

  • Required level from the solicitation, by information type (FCI or CUI).
  • Your current CMMC status for the information systems in scope, with the status date and SPRS entry.
  • Affirmation date and the official who made it.
  • Teammate status for each subcontractor whose work involves FCI or CUI.

Keep the record next to the compliance matrix so the bid decision, the proposal claims, and the teaming documents all draw on the same facts.

Map Claims to the Right Requirement Set

The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2 [5]. Map your compliance matrix and your system security plan to Revision 2 when you are responding to a CMMC requirement, and confirm whether the solicitation says anything different.

A single matrix row reading "CMMC Level 2: compliant" gives an evaluator nothing to verify. Better rows name the required level, the status you hold, the status date, the scope of systems covered, and where the supporting evidence lives. If you hold a Conditional status, say so and state your POA&M closeout plan; under the rule, open items must be closed out within 180 days of the status date [7].

Write status language that matches the record:

Actual statusSafer proposal languageAvoid
Final Level 2 (Self)"We hold a current Level 2 (Self) CMMC status for the in-scope systems, affirmed on [date].""We are CMMC certified."
Final Level 2 (C3PAO)"We hold a Final Level 2 (C3PAO) status for the assessed environment, with a status date of [date].""All company systems are certified."
Conditional"We hold a Conditional status and will close our POA&M by [date].""We are fully compliant."
Not yet assessed"We are completing our assessment for the in-scope systems, targeted for [date].""We are CMMC ready."

Inaccurate representations carry legal risk beyond the bid. The False Claims Act reaches anyone who knowingly makes or uses a false record or statement material to a false or fraudulent claim [8].

Teaming Documents Need Status Evidence

The CMMC clause requires the prime to flow the correct CMMC level down to subcontracts that will involve FCI or CUI and, before awarding such a subcontract, to ensure the subcontractor has a current CMMC certificate or status at the appropriate level [9]. Build that into teaming, not into contract startup.

Ask each teammate for:

  1. Current CMMC status and level for the systems that will handle your program's information, with the status date.
  2. Scope boundary describing which systems and enclaves are covered.
  3. Affirmation date and the official responsible.
  4. A notification commitment if the status changes, lapses, or the scope shrinks before award.

Put the flow-down and the notification commitment in the teaming agreement itself, and re-verify before submission. A teammate whose status changes after your technical volume is written forces a workshare change or a substitution under deadline pressure.

Keep Reusable Content Current

Reusable content is where stale CMMC claims hide. A capability statement written when a business unit was in scope, or before a status changed, keeps asserting the old fact until someone retires it.

Treat every CMMC-related block in your library as a dated claim:

  • Status, level, and status date in the block's metadata, not just in the prose.
  • Scope statement naming the systems or enclaves covered.
  • Owner and review date, with a forced review when the status, scope, or program rules change.
  • One source-of-truth block that other sections reference, so an update happens once.

AI drafting tools that pull from a historical library will reuse old claims confidently. Keep a subject matter expert sign-off on every CMMC statement before it enters a volume, checked against the current SSP, SPRS entry, and affirmation.

Watch the Rules Keep Moving

Two threads deserve a standing watch. The CMMC Reform Task Force review may change how and when third-party assessments return [3]. And on June 23, 2026, the FAR Council updated its proposed rule to expand safeguarding and incident reporting requirements to CUI handled under all federal contracts, not just DoD contracts [4]. A team that bids across agencies should expect NIST SP 800-171-derived requirements to matter beyond DoD work.

The 30-Minute Audit to Run This Week

  1. Pursuits: list every active DoD pursuit and the CMMC level each solicitation requires. Mark any where your status or a teammate's is unverified.
  2. SPRS and affirmation: confirm your current SPRS entry and the date of your last affirmation for each in-scope system.
  3. Matrix template: check that CMMC rows map to NIST SP 800-171 Rev 2 and carry status, date, scope, and evidence location.
  4. Teaming template: confirm it includes the CMMC flow-down, a pre-award status check, and a change notification commitment.
  5. Content library: search for "CMMC," "certified," and "800-171," and flag every block without a status date and owner.

The metric to track: hours from "we want to bid this" to "we have verified our CMMC status and every teammate's for the required level." If that takes more than a day or two, the check is happening too late in your process.

References

Related articles