CMMC 2.0 Phase 1 Execution: Managing SPRS Scores and C3PAO Engagement

The CMMC Acquisition Rule Reality

The Department of Defense (DoD) has officially set the clock for the Cybersecurity Maturity Model Certification (CMMC) 2.0. With the 48 CFR CMMC Acquisition Rule taking effect on November 10, 2025, the transition from "voluntary compliance" to "contractual prerequisite" is complete. For GovCon executives, the focus must now shift from high-level policy to the granular execution of Phase 1.

Phase 1 begins the immediate inclusion of CMMC Level 1 or Level 2 self-assessment requirements in all new DoD solicitations. While many firms have relied on self-attestation under DFARS 252.204-7012, the new rule introduces a mandatory annual affirmation by a senior company official, increasing the legal and professional stakes for non-compliance.

Operationalizing NIST SP 800-171

The foundation of CMMC Level 2 is NIST SP 800-171. Contractors must not only implement the 110 controls but also maintain a robust System Security Plan (SSP) and a Plan of Action and Milestones (POA&M) for any deficiencies.

Key actions for compliance leads include:

• SPRS Score Accuracy: Ensure your score in the Supplier Performance Risk System (SPRS) is current. A common pitfall is failing to update the score after remediating POA&M items.
• Scoping the CUI Environment: Clearly define where Controlled Unclassified Information (CUI) resides. Over-scoping leads to unnecessary costs, while under-scoping leads to audit failure.
• C3PAO Engagement: For those requiring a Level 2 certification (the "Advanced" tier), engaging a Certified Third-Party Assessor Organization (C3PAO) early is critical. The CMMC Program anticipates a bottleneck as thousands of firms seek assessments simultaneously.

The Four-Phase Rollout Strategy

The DoD is implementing CMMC in four phases over a three-year period. By November 10, 2028, all applicable solicitations will include full CMMC requirements. However, capture managers should assume that any high-value contract involving sensitive CUI will require Level 2 certification much sooner.

Waiting for Phase 4 is not a viable strategy. Prime contractors are already auditing their subcontractors' SPRS scores to mitigate supply chain risk. If your firm cannot demonstrate a high SPRS score and a clear path to C3PAO certification, you risk being excluded from teaming agreements for major programs of record.