Maintaining CMMC status between assessments

A significant change can introduce a deficiency after your organization has already achieved a CMMC status. The DoW CMMC FAQ (July 2026) says such a deficiency may be handled with an operational plan of action (OPA), provided the change itself is controlled. The process starts before the change goes live. Under CM.L2-3.4.4, you perform a security impact analysis, and if the analysis reveals a new risk that the existing System Security Plan (SSP) does not address, that usually signals a significant change that needs reassessment planning.

• Analyze before implementing: Document the security impact analysis for the change, including which requirements the change affects and whether any were previously assessed as not applicable.
• Record the temporary deficiency: Name the affected requirement, the reason it is temporarily unmet, the compensating measures, and the date the deficiency will be closed.
• Update the SSP: Reflect the change, the new risk and the OPA in the SSP so the documentation matches the operating environment.
• Track closure to a verified end state: Set an owner and a closure target, and retain evidence that the requirement is met once the fix is in place.
• Plan for reassessment: Confirm with your assessment sponsor or C3PAO whether the change triggers a reassessment, since adding a previously excluded technology such as Wi-Fi can make requirements applicable.

Before relying on an OPA, confirm its treatment against the current DoW FAQ and your contract requirements, and ask your assessor how they will score it.

A requirement found NOT MET during a CMMC assessment is a different situation. Level 2 requirements are scored against the SP 800-171A assessment objectives, and a requirement is MET only when all applicable objectives are satisfied with evidence in final form. An unmet requirement is recorded in a Plan of Action and Milestones (POA&M), which is the document that governs how the gap is closed and how the closeout assessment is handled. The consequence is tied to the scoring and status rules, not to a judgment about the organization's intent.

• Document the gap precisely: Record the requirement ID, the objective that failed, and the evidence that was missing or inadequate.
• Build the POA&M around closeable items: Each entry needs an owner, a remediation approach and a target that the closeout assessment can verify.
• Expect a closeout assessment: Plan the evidence for each closed item so an assessor can confirm the fix works, not only that a ticket was closed.
• Keep the POA&M current: Status changes must be reflected in the POA&M and in SPRS according to the affirmation rules.
• Confirm the status pathway: Check with your sponsor how open POA&M items affect Conditional status and the closeout timeline under the applicable rules.

Before the assessment, ask your assessor how they will score evidence for items you expect to close during the review.

Assessors judge OPAs and POA&M entries by the same standard they apply to other evidence: documents must be final, current and traceable to the requirement. For a temporary deficiency, the assessor will look for proof that the change was analyzed, that the deficiency is bounded, and that a closure plan exists. For an unmet requirement, the assessor will look for the remediated state itself, such as a configuration export, a log extract or a signed policy, along with the record that it was reviewed. Vague entries such as "in progress" do not give an assessor anything to test.

• Security impact analysis: A dated, final analysis tied to the specific change and the affected requirements.
• Updated SSP and POA&M: Versions that match each other and the current environment.
• Remediation records: Configuration evidence, test results or tickets that show the fix was implemented and verified.
• Compensating measures: Documented controls in place while the item is open, with evidence they operate.
• Review records: Sign-off by the people accountable for the risk, showing the decision was made deliberately.

Before submitting evidence, ask your assessor which artifact formats and retention periods they accept, because drafts and undated notes can be rejected.

Open items do not disappear at the affirmation date. Under 32 CFR 170.22, a senior Affirming Official must affirm continuing compliance in SPRS after an assessment and annually after that. A status counts as current only if there have been no changes in compliance since the status date and a corresponding affirmation is in place that is not older than one year. An affirmation made while a known deficiency is unmanaged, or while a POA&M closeout is overdue, creates exposure for the company and for the individual who signs. The affirmation should describe the actual state of the environment, including any open OPA or POA&M items.

• Reconcile before every affirmation: Compare the SSP, POA&M and SPRS entries to the actual environment before the Affirming Official signs.
• Track the POA&M closeout requirement: Note whether an affirmation is required after a POA&M closeout assessment and schedule it.
• Escalate overdue items: Give leadership a clear list of open items, their owners and their risk, so the decision to accept or fix is documented.
• Watch for lapse risk: The assessment lapses if the annual affirmation is not made, so calendar the date and assign a backup signer.
• Verify DoD reassessment exposure: DoD may conduct a DIBCAC assessment at any time under DFARS 252.204-7020, and findings that requirements were not maintained can override an existing status.

Before each affirmation, ask your sponsor or counsel to confirm that the SPRS entry matches the open items you can evidence today.

The organization holding the CMMC status owns every control, every change decision and every affirmation. Between assessments, leadership must decide whether a proposed change can go ahead, who accepts residual risk and when a deficiency is tolerated under an operational plan of action. A senior Affirming Official signs the annual affirmation in SPRS, and that person is accountable for the statement being true. Outsourcing work does not move that accountability.

• Change decisions: Approve or reject changes only after the security impact analysis under CM.L2-3.4.4 is complete and the System Security Plan is updated.
• Risk acceptance: Record who accepts each risk, including temporary deficiencies handled through an operational plan of action.
• Affirmations: The Affirming Official reviews the evidence before entering the annual affirmation in SPRS, and the status lapses if it is not made.
• Control ownership: Assign named owners for access reviews, log review, patching and media handling, with deadlines.
• Subcontractor oversight: Confirm that external providers handling CUI maintain their own compliance and flow requirements down correctly.

Confirm that your Affirming Official understands the affirmation is a personal certification of current compliance, not a formality.

An implementation partner such as DeployOpen can prepare the systems and the evidence that the organization uses to run its own controls. Work typically covers configuring monitoring routines, keeping documentation current, supporting change reviews and organizing evidence so the organization can review it before an affirmation. The partner works inside the client's own environment and reports to the client. It does not decide whether a status is maintained, and it does not sign affirmations.

• Monitoring routines: Set up recurring checks on configuration baselines, account reviews, log collection and vulnerability scanning, with outputs the organization can review.
• Evidence and documentation: Keep the SSP, POA&M and configuration records in final form with dated revisions.
• Change support: Prepare the impact analysis inputs and document how each change affects requirements that were assessed as N/A.
• Remediation work: Carry out fixes the organization approves and produce the artifacts that show each fix worked.
• Scope limits: Fixed-scope work is agreed in writing before it starts, and ongoing support is available under a separate retainer.

DeployOpen does not issue reports, affirmations or certificates, and hiring a partner does not guarantee any assessment result. Ask any partner to confirm which deliverables it owns and which remain with you.

An independent assessor is the only party that issues assessment results. A Level 2 certification assessment is performed by a C3PAO authorized or accredited by The Cyber AB, while a Level 2 self-assessment is conducted by the organization itself against NIST SP 800-171A. Between assessments, the assessor's role is limited to the assessment events themselves, and DoD can trigger a DIBCAC assessment at any time under DFARS 252.204-7020.

• Results: A C3PAO assessment produces the result for a certification assessment, and DoD records it in SPRS.
• Independence: The assessor cannot design or implement the controls it later evaluates for the same scope.
• Reassessment cycle: A new Level 2 assessment is required every three years, self or C3PAO, depending on the contract requirement.
• DoD reassessment: A DIBCAC finding that requirements were not achieved or maintained takes precedence over the existing status.
• Consulting boundary: Ask your assessor which advisory services it can provide without losing independence.

Confirm with The Cyber AB and your contracting officer which assessment type your contracts currently require, since the program's phase schedule has changed.