CMMC and NIST 800-171: What DC-Area Government Contractors Still Owe
What Do DC-Area Government Contractors Still Owe Under CMMC and NIST 800-171?
CMMC Phase 2 is suspended, but almost everything that actually protects federal data is still required. Contractors that handle Controlled Unclassified Information (CUI) must still implement the 110 security requirements in NIST SP 800-171, keep an accurate score in the Supplier Performance Risk System (SPRS), report cyber incidents within 72 hours, and complete the CMMC self-assessments that apply to their contracts. What paused is the mandatory third-party certification — not the obligations underneath it.
For the contractors, subcontractors and consultancies that make up so much of the market for IT services in Washington, DC and across Northern Virginia and Maryland, the practical question is not whether CMMC is on hold. It is whether your security program would hold up if a contracting officer, a prime or the Department of Justice asked to see it tomorrow.
Status as of October 2026. This article is general guidance, not legal advice.
Where CMMC Stands Today
- Phase 1 is in effect. Since November 10, 2025, the DFARS acquisition rule has allowed CMMC Level 1 and Level 2 self-assessment requirements in new solicitations and contracts. The program itself is codified in the 32 CFR Part 170 CMMC Program rule.
- Phase 2 is suspended. On July 13, 2026, the Department of War suspended Phase 2 — the step that would have made Level 2 third-party (C3PAO) certification standard for CUI contracts from November 10, 2026 — along with Phases 3 and 4, as Federal News Network reported. A September 2026 class deviation made the suspension binding on contracting officers.
- The program is under review, not cancelled. A CMMC Reform Task Force is reviewing the program, and the DoD CIO’s CMMC page remains the official source for updates. No replacement schedule has been published, which means requirements can return with little notice.
CMMC paused the audit. It did not pause the requirement — or the risk.
What Still Applies
- DFARS 252.204-7012. If you handle covered defense information, the 7012 clause requires you to implement NIST SP 800-171, report cyber incidents to the DoD within 72 hours, preserve images and data for investigation, and flow the clause down to subcontractors.
- Your SPRS score. Contractors subject to DFARS 252.204-7019 and 7020 must post a NIST SP 800-171 assessment score, which ranges from −203 to 110. An inflated score is a liability, not an asset.
- CMMC Level 1 self-assessment. Contracts involving Federal Contract Information require the 15 basic safeguarding requirements, assessed and affirmed annually.
- CMMC Level 2 self-assessment. Where a contract specifies Level 2 (Self), you assess all 110 NIST SP 800-171 requirements every three years and affirm compliance annually.
- False Claims Act exposure. Every affirmation and SPRS score is a representation to the government. The Department of Justice’s Civil Cyber-Fraud Initiative has pursued contractors whose security claims did not match reality.
Which Revision of NIST SP 800-171?
NIST has published Revision 3, but DFARS and the CMMC program rule are tied to NIST SP 800-171 Revision 2 and its 110 requirements. Build and score your program against Revision 2 until your contracts say otherwise, and track Revision 3 so the transition is not a surprise.
Why Waiting Is the Expensive Option
Level 2 readiness typically takes months, not weeks: scoping where CUI lives, closing technical gaps, writing a System Security Plan, and building the evidence an assessor will ask for. Contractors that pause their programs now risk two outcomes — losing bids when primes start requiring evidence of readiness from their supply chain, and scrambling if the Task Force reinstates third-party assessments on a short timeline.
The suspension also changes nothing about the threat. The data CMMC was designed to protect is still a target, and the controls that protect it — access control, logging, data loss prevention, incident response — are the same ones every regulator now expects, from the SEC to NYDFS.
A Practical Plan for the Next 90 Days
- Scope your CUI. Identify exactly which people, systems and locations handle it. A smaller, well-defined enclave is cheaper to secure and easier to assess.
- Re-score honestly. Run a fresh NIST SP 800-171 self-assessment and correct your SPRS score if it no longer reflects reality.
- Update your System Security Plan and POA&M. Every open gap needs an owner and a date.
- Close the high-value controls first. Phishing-resistant multifactor authentication, centralized logging with retention, endpoint detection and response, encryption and access reviews carry the most weight.
- Write it down. A current cybersecurity policy and BCDR plan are evidence assessors and primes ask for first.
- Test incident reporting. Confirm who files a report within 72 hours and that you hold a valid DoD-approved medium assurance certificate to do it.
- Check your providers. Your MSP and cloud services sit inside your compliance boundary. Ask them how they meet the requirements that apply to them.
Where DAG Tech Fits
DAG Tech’s IT compliance services help contractors scope CUI, close NIST SP 800-171 gaps and keep the documentation current, while X-SOC provides the 24/7 monitoring, detection and log retention the standard expects. For leadership-level ownership of the program, our CxO practice provides fractional security leadership, and a State of the Technology assessment gives you an honest starting score.
For organizations that sell directly to federal agencies, DAG Tech works alongside Converge Networks Corporation on mission-focused federal work.
Contact DAG Tech today to review where your NIST SP 800-171 program stands — we deliver proposals within one business day.
Related reading: How to Choose an IT Company in Washington, DC · What Is Data Loss Prevention? · What Is a BCDR Policy, Runbook and Tabletop Program?