FAQs
Frequently Asked Questions
Answers to the top questions about CMMC, DFARS, NIST, and other Department of War cybersecurity topics.
- CMMC Assessments & Certification Process
- What triggers a new CMMC assessment?
- When will the CMMC final rule be published?
- What happens if our conditional CMMC status expires during contract performance?
- Does a DIBCAC high assessment equate to a CMMC Level 2 certification?
- Will Phase 1 of the CMMC rollout only require self-assessments?
- Can joint ventures achieve CMMC certification?
- Summit 7 is the Defense Industrial Base's most trusted group of certified experts.
CMMC Assessments & Certification Process
What triggers a new CMMC assessment?
A new assessment is required if there are “significant” changes to the system architecture, though this term is loosely defined. Referencing NIST 800-37, changes like hardware upgrades, OS modifications, or altered data types may qualify. Organizations are advised to define “significant” internally and document that in their change management procedures.
When will the CMMC final rule be published?
The U.S. Department of War has published the long-awaited 48 CFR Final Rule, officially making the Cybersecurity Maturity Model Certification (CMMC) a binding requirement in defense contracts. The rule was published in the Federal Register on September 10, 2025. A 60-day window follows before clauses begin appearing in contracts, meaning contractors could see DFARS 252.204-7021 requirements starting November 10, 2025.
What happens if our conditional CMMC status expires during contract performance?
If a conditional status expires without POAM items being remediated within 180 days, contractors may face contract remedies and be deemed ineligible for further awards. Conditional status should not be treated casually—address POAMs promptly.
Does a DIBCAC high assessment equate to a CMMC Level 2 certification?
No. A DIBCAC high assessment is an audit under DFARS clauses, not a CMMC certification. Only joint surveillance assessments conducted before December 2024 can be converted into CMMC Level 2 certification status.
Will Phase 1 of the CMMC rollout only require self-assessments?
Not necessarily. Although many hope for self-assessments, contracting officers retain discretion. Contracts involving specific CUI types may require full third-party assessments (C3PAO) even during Phase 1. Organizations should prepare for the possibility of certification-level requirements immediately.
Can joint ventures achieve CMMC certification?
Yes. Joint ventures can undergo CMMC assessments. If they share the same enclave or assessment boundary as the parent company, they may need a separate certification tied to their own CAGE code and contract context.
Protecting the American Dream