What DFARS 252.204-7021 requires of a contractor during performance
DFARS 252.204-7021 requires a current CMMC status at the required level for every system that processes, stores or transmits Federal contract information (FCI) or controlled unclassified information (CUI) in performance of the contract, an annual affirmation for each applicable CMMC UID, and closure of a valid plan of action and milestones (POA&M) for any contractor holding a Conditional status. Under paragraph (d), the contractor may handle FCI or CUI only on systems that hold that status, and the status counts as current only while nothing has changed in compliance with 32 CFR Part 170 since the status date and the affirmation is no more than one year old. Under paragraph (e), the contractor must give the contracting officer the CMMC UIDs for every system handling FCI or CUI, report changes during the contract, and enter current self-assessment results in SPRS for each UID that no C3PAO or DIBCAC assessment covers.
The organization owns its CMMC status and its affirmations, and no outside party can sign them on its behalf. An implementation partner or consultant can prepare systems, configurations and evidence, but only a C3PAO or DIBCAC assessment, or a self-assessment result entered in SPRS, establishes the status. Start by listing every system that stores, processes or transmits FCI or CUI, then match each one to its CMMC UID and status date. Confirm that list with the contracting officer before award and again whenever the system boundary changes. Primes also carry their own duty: before awarding a subcontract that involves FCI or CUI, they must confirm the subcontractor holds a current status at the level required for the information flowed down.
On 13 July 2026, the Department of War suspended CMMC Phase II, which had been scheduled to start on 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. The suspension started a 60-day review by a CMMC Reform Task Force, as described in the Department of War release on the suspension. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place, so the performance duties in this clause still apply to any contract that includes it. Ask the contracting officer which CMMC level the contract requires and which assessment type it expects, and check the DoW CIO's CMMC page for current implementation status, since the eCFR text still shows the original four-phase schedule.
Which duties the clause places on the contractor
DFARS 252.204-7021 turns CMMC into ongoing contract obligations rather than a one-time certificate. The six duties below work together: each in-scope system needs a current status, the contracting officer needs to know which systems those are, and SPRS and affirmations must stay accurate for the life of the contract.
Keep current status on in-scope systems
The contractor must hold a current CMMC status at the required level for every system that processes, stores or transmits FCI or CUI in performance of the contract. A status stays current only while there are no changes in compliance since the status date and a continuous compliance affirmation is in place. Internally, the CIO or CISO owns this duty. Evidence is the current assessment record for each system, with its status date, plus a change log showing that nothing material has changed since.
Handle FCI and CUI only on qualifying systems
Contract information may be handled only on systems that carry the required CMMC status. This is an operating rule, not just a configuration state, so it reaches file shares, email, collaboration tools, engineering repositories and backups. Internally, IT operations and data owners share this duty. Evidence includes a current system inventory that maps each repository and data flow to a CMMC UID, along with access restrictions that keep CUI off unassessed systems.
Report UIDs and changes to the contracting officer
The contractor must give the contracting officer the CMMC UIDs for systems that handle FCI or CUI and report any changes during the contract. Each UID is a 10-character alphanumeric identifier tied to a specific assessment and shown in SPRS for that system. Internally, contracts or compliance staff own this duty. Evidence is a dated UID register with a change history, reconciled against the system inventory whenever an environment is added, retired or reassessed.
Enter self-assessment results in SPRS
For each UID not covered by a C3PAO or DIBCAC assessment, the contractor must enter current self-assessment results in SPRS. Results come from scoring against the NIST SP 800-171A objectives, and the entry must match the evidence held on file. Internally, the compliance lead signs off and the assessor or preparer documents the score. Evidence is the completed assessment workbook, system security plan and POA&M behind each posted score, kept ready for review.
Keep annual affirmations current
Each applicable CMMC UID requires an annual affirmation of continuous compliance, entered in SPRS. The affirmation is made by the organization's Affirming Official, and it must stay within one year of the status date. Internally, leadership appoints the Affirming Official and compliance tracks due dates. Evidence includes the affirmation record for each UID, a calendar of renewal dates, and the internal review that supported the signature. A missed affirmation can lapse status, so track it per system.
Close a valid POA&M to reach Final status
A contractor holding Conditional status must close out a valid plan of action and milestones to reach Final status. The POA&M may cover only requirements allowed to wait under the rule, and it must be finished within its window. Internally, the security lead owns remediation and the contracts team tracks the deadline. Evidence is dated remediation records for each open item, testing results showing the fix works, and an updated SPRS entry once the items are closed.
Why CMMC assessments will not duplicate other DoD assessments
DFARS 252.204-7021(c) states that CMMC assessments will not duplicate other comparable DoD assessments. For a contractor, this means that if a system has already been evaluated by a DoD assessment that the clause treats as comparable, the department should not require a second assessment of the same system simply to repeat the work. The clause does not define the full list of comparable assessments in its own text, so the practical question for your team is which of your existing DoD assessment records a contracting officer will accept as covering a given CMMC UID. Treat that as an open question to settle early, not an assumption to carry into a proposal.
The clause also names the exception. A reassessment can still happen in rare cases, such as indications of a cybersecurity issue or a CMMC compliance issue that make a new assessment necessary. You cannot plan around that exception as a schedule, but you can plan for it as a risk. If a security incident, a failed self-assessment finding or a discrepancy in your SPRS entries surfaces, expect the department to be able to look again at the affected systems. Keep your self-assessment evidence and your SPRS entries consistent with what your systems actually do, because inconsistencies are the most likely trigger for reassessment.
Start a record now. For each system that handles FCI or CUI, keep a file that lists any comparable DoD assessment that covers it, the assessing body, the date, the scope and the systems included, along with the CMMC UID tied to that system. Then ask the contracting officer, in writing, how that prior assessment is recognized under the contract and whether any additional affirmation or SPRS entry is still expected. Your implementation partner can help assemble the records and map systems to scope, but the organization owns the decision about what it claims and the answer should come from the contracting officer, not from an advisor.
How the clause flows down to subcontractors
Under DFARS 252.204-7021(f), the prime contractor must put the substance of the clause into each subcontract whenever that subcontract involves processing, storing or transmitting Federal contract information (FCI) or Controlled Unclassified Information (CUI). The prime does not transfer its own obligations by doing so. It still keeps a current status on its own systems, still affirms for itself, and still answers to the contracting officer for the flowdown itself.
- Trigger: the duty applies when the subcontract touches FCI or CUI, not whenever a subcontract is merely connected to the contract.
- Substance, not a copy: the prime carries the clause's requirements into the subcontract terms so the subcontractor is bound to the same level of compliance.
- Own affirmations: the prime's annual affirmation covers only the prime's own systems and the subcontractors' status is not a substitute for it.
- Records: keep a list of subcontracts that carry FCI or CUI, with the flowdown language and the status each subcontractor reported.
- Changes: when a subcontract changes scope and begins handling FCI or CUI, flow the clause down at that point.
Check with your contracts team whether your subcontract template has a clear trigger for flowdown and a field for the required CMMC level.
Under DFARS 252.204-7021(f)(2), before awarding a subcontract, the prime must confirm that the subcontractor holds a current CMMC certificate or status at the level appropriate to the information being flowed down, as described in 32 CFR 170.23. The check is a precondition to award, so it belongs in the sourcing and onboarding process, not in a later audit.
- Right level: match the level to the information. A subcontractor receiving CUI needs the level that covers CUI, while one handling only FCI needs the lower level.
- Currency: a status counts only if it is current under the clause, so confirm the status date and the supporting affirmation.
- Evidence: record the subcontractor's CMMC UID or assessment reference and the date you checked it.
- Gaps: if a subcontractor cannot show the required status, do not award the work that involves FCI or CUI until it can.
- Repeat checks: statuses change, so re-confirm them when the subcontract is renewed or its scope grows.
Ask each subcontractor for its CMMC UID and status date in writing, and verify the entry in SPRS where the process allows.
Each subcontractor affirms for itself. A prime cannot sign for a subcontractor, and a subcontractor's affirmation does not cover the prime's systems or other subcontractors. Every company in the chain that processes, stores or transmits FCI or CUI is responsible for its own status, its own affirming official and its own annual affirmation in SPRS for each applicable CMMC UID.
- Separate status: each company has its own status, and a lapse at one tier does not change the status of another.
- Separate signatory: each company names its own affirming official, who attests to that company's compliance.
- Annual cycle: affirmations must stay current, so track each subcontractor's renewal date.
- Shared systems: if two companies share a system that handles CUI, confirm how the UID and affirmation apply before relying on either.
- Lapses: a missed affirmation at a subcontractor can stop the handling of FCI or CUI on that company's systems, which may affect the work you planned to give it.
Ask each subcontractor which affirming official will sign and when its next affirmation is due.
DFARS 252.204-7021(f) extends the flowdown to subcontracts for commercial products and services, not just to custom development. The exclusion is narrower than many buyers assume: it covers COTS items, which are commercial items sold in the commercial marketplace. A commercial service that handles FCI or CUI, such as hosting, managed support or remote administration, is not automatically excluded just because it is commercial.
- Commercial services: a commercial service that processes, stores or transmits FCI or CUI generally falls under the flowdown.
- COTS exclusion: an off-the-shelf product that does not itself handle FCI or CUI during the work, such as a stand-alone tool bought without access to contract data, typically sits outside the flowdown. Confirm the boundary against the clause text and your contracting officer's interpretation.
- Cloud and hosting: a cloud or managed provider that stores CUI for you is a subcontractor for flowdown purposes, so check its status.
- Supply chain mapping: list each commercial supplier and note whether it touches FCI or CUI.
- Documentation: record the reasoning for each COTS exclusion so an assessor or contracting officer can follow it.
Confirm with your contracting officer or counsel how the COTS exclusion applies to each supplier before you rely on it.
What a contractor does in the first year of performance
The sequence below turns the clause into a working routine: the contractor knows which systems carry CUI, proves their status, hands the contracting officer the identifiers, and keeps affirmations and POA&M dates current as the contract runs. Each step ends with a record that a reader can check.
Map in-scope systems and their CMMC UIDs
Start by listing every system that processes, stores or transmits FCI or CUI for the contract, including enclaves, email, collaboration tools, backups, and any remote access paths. Confirm which of these are covered by a CMMC assessment record and note the CMMC UID that SPRS shows for each contractor information system. The output is a system inventory that names each UID and the data type it handles. Ask your team to confirm it against the data flow diagrams, since an omitted system is the most common gap a reviewer will find.
Confirm status and SPRS entries
For each in-scope UID, verify the current CMMC status at the level the contract requires and check that the SPRS entry matches it. A status counts as current only if nothing has changed in compliance with 32 CFR Part 170 since the status date and a corresponding affirmation of continuous compliance is in place. The output is a status record per UID with its date, level and affirmation reference. Where an entry is stale or missing, correct it before any CUI moves to that system.
Give the contracting officer the UIDs
Send the contracting officer the CMMC UIDs for systems handling FCI or CUI, using the contract's designated channel. Record the date and the list of identifiers you sent. The clause also requires you to report later changes, so this step creates the baseline that every future change will be measured against. The output is a written transmittal that the contract file can show.
Enter self-assessment results for non-certified UIDs
For each UID not covered by a C3PAO or DIBCAC assessment, enter current self-assessment results in SPRS. Results must reflect the requirements as they stand today, with the assessment scope matching the system inventory from the first step. Assessors will compare SPRS entries with your system security plan and evidence, so the entries should be reproducible from that documentation. The output is a SPRS record per UID that a second reviewer has checked against the scope.
Schedule the annual affirmation for each UID
Set a recurring calendar item for the annual affirmation required for each applicable CMMC UID, and name the Affirming Official responsible for signing it. Before the date, the team should refresh the evidence for the requirements in scope and confirm that nothing has changed in the environment. The affirmation must be entered in SPRS and kept current. The output is a dated affirmation for each UID and a reminder that shows when the next one is due. Confirm the signing authority and process with your contracting team before the first deadline.
Track POA&M dates when status is Conditional
If any UID holds a Conditional status, the clause requires a valid POA&M to be closed out to reach Final status. Record each open POA&M item with its owner, the requirement it addresses, and the closure evidence that will show it is done. Review the items on a set cadence so that none reaches its end date unresolved. Confirm the deadline rules and the eligibility of each open requirement with the contracting officer and the current 32 CFR 170.21 text. The output is a POA&M register that maps every open item to a planned closure.
Re-check status after each system or scope change
Whenever a system is added, moved, re-hosted, or reconfigured, or when the contract changes what data it handles, repeat the inventory, status check and SPRS review for the affected UIDs. Give the contracting officer updated UIDs for any change. Flow the clause to any new subcontract that will process FCI or CUI and confirm the subcontractor's status first. The output is an updated record that shows the change, the status effect and the notice sent. Treat this as a standing step for the life of the contract, not a one-time task.
What must be in place before the clause bites
DFARS 252.204-7021 makes a current CMMC status a condition of handling FCI and CUI, so the work starts before any affirmation is signed. The six items below connect: the boundary defines which systems the status covers, the SSP and evidence prove each requirement, and the POA&M, Affirming Official and subcontract inventory keep that status defensible after award.
A scoped system boundary
Before the contractor can state a status, it must know every system that processes, stores or transmits FCI or CUI in performance of the contract. Each of those systems needs its own CMMC UID, and the contracting officer must receive those UIDs. Check the boundary by tracing actual data flows, including email, collaboration tools, backups, remote access paths and any managed service that touches CUI. A system left out of scope still carries the handling restriction.
A current system security plan
The System Security Plan describes how each in-scope system meets the Level 2 requirements, who owns each control, and where the system's boundary and interconnections sit. Assessors read it first, so an out-of-date plan undermines every other piece of evidence. Check that the plan names the current system version, the current boundary diagram and the current owners, and that its review date falls after the most recent significant change.
Final-form evidence for each objective
A requirement counts as MET only when every applicable assessment objective in NIST SP 800-171A is satisfied with evidence in final form. Draft policies, unsigned procedures, screenshots taken without dates and undated scan reports do not count. Check each objective against a named artifact, an owner and a date, and confirm that configuration exports, access reviews and training records are the approved versions that were in force during the assessment period.
A POA&M with named owners
A Conditional status depends on a plan of action and milestones that the contractor closes out to reach Final status. Each open item needs a named owner, a remediation step, a target date and a link to the control it affects. Check that no requirement that cannot wait is sitting on the POA&M, and that the contractor can show progress on each item rather than a list that was written once and never reviewed.
An Affirming Official with authority
The annual affirmation in SPRS must be entered by an official who can speak for the company and who has actually reviewed the compliance state of each in-scope system. That person must be able to commit the organization to the statement of continuous compliance. Check the appointment in writing, confirm the person has access to the SPRS account, and confirm they have a documented process for reviewing evidence before signing.
A subcontract inventory
The prime must flow the clause down to any subcontractor that processes, stores or transmits FCI or CUI, excluding COTS items, and must confirm before award that each subcontractor holds a current status at the right level. A subcontract inventory lists each supplier, the information it will receive, the CMMC level required and the status date on file. Check it against purchase orders and cloud or IT service agreements, because a forgotten provider is a common gap.
Who owns each part of clause compliance
The contractor's leadership owns the decision to hold a CMMC status and the legal exposure that comes with it. The Affirming Official is the senior person who signs the annual affirmation in SPRS for each applicable CMMC UID, attesting that the organization continues to comply with 32 CFR Part 170 for the systems it uses to handle FCI or CUI. That signature is a personal and corporate representation, so the person chosen should have real authority over the systems in scope and the budget to fix gaps.
- Funding decisions: Leadership approves the scope, the budget for remediation and any outside help before work starts.
- Affirmation ownership: The Affirming Official confirms continuous compliance before signing, and the affirmation must stay current within one year.
- Subcontract decisions: Leadership confirms that each subcontractor holds a current status at the right level before award.
- Escalation: Leadership decides how to respond when a status lapses or a POA&M is not closed in time.
Confirm with counsel how the affirmation process is documented and who holds signing authority, because the affirmation carries False Claims Act exposure.
The internal compliance team runs the day-to-day work that keeps the status current. It maintains the list of CMMC UIDs, tracks every system that processes, stores or transmits FCI or CUI, and reports changes to the contracting officer. It also owns the evidence library and the POA&M register, so that every requirement has documentation an assessor can read.
- UID and system inventory: The team keeps current the list of systems in scope and reports UIDs and changes to the contracting officer.
- SPRS entries: The team enters current self-assessment results for each UID not covered by a C3PAO or DIBCAC assessment.
- Evidence management: The team collects evidence in final form, not drafts, and tracks its dates.
- POA&M tracking: The team monitors open items and plans closure within the required window.
- Change control: The team checks that system changes do not alter compliance and records them.
Ask whether your team can name an owner for each UID and each POA&M item, since most status lapses trace back to a missed change or an unclosed item.
An implementation partner such as DeployOpen helps prepare the systems and evidence that the contractor later presents. Under a fixed-scope engagement, the partner can configure, harden, document and test the environment in the contractor's own infrastructure, and then hand over the results. The partner does not own the controls, does not decide whether requirements are met, and does not sign or submit anything on the contractor's behalf.
- Systems work: Configuring logging, access controls, encryption and other technical controls in the client's environment.
- Documentation: Drafting the system security plan, procedures and evidence packages for the contractor to review and adopt.
- Testing support: Running security testing and helping the contractor act on findings.
- Handover: Delivering documented scope, deliverables and timelines agreed in writing before work starts.
- Ongoing support: Upgrades and continuous testing are available as retainers, which the contractor should scope separately.
Ask the partner to state in writing which parts of the work it performs and which the contractor retains, including who signs any document.
The party that determines the status is either the contractor itself, for a self-assessment, or an independent assessor. Level 2 certification assessments are performed by C3PAOs authorized or accredited by The Cyber AB, and Level 3 certification assessments are performed by DCMA DIBCAC. A self-assessment is performed by the contractor, and its results are entered in SPRS. Only the independent assessor or the contractor's own affirmation produces the status that the clause relies on.
- Independent judgment: A C3PAO or DIBCAC decides whether each requirement is met against the assessment objectives.
- Self-assessment: The contractor scores its own environment and enters the result in SPRS.
- Reassessment limits: The clause states that assessments will not duplicate other comparable DoD assessments, except in rare cases.
- Report issuance: Only the assessor issues the assessment result and certificate.
- Partner role: A partner that helped prepare the environment cannot also serve as the assessor for that same environment.
Confirm which assessment type applies to each UID under the current rule and any DoW guidance in effect, since the program schedule has changed.
What usually breaks compliance during performance
Most DFARS 252.204-7021 problems do not start with a failed assessment. They start with a system change nobody recorded, a date nobody owned, or a subcontract nobody checked. The five patterns below are where primes most often lose a current status during performance.
UIDs not updated after system changes
The clause requires the contractor to give the contracting officer the CMMC UIDs for every system that handles FCI or CUI, and to report changes during the contract. When a new enclave, cloud tenant or collaboration tool starts holding CUI, or an old one is retired, the UID list can drift from reality within weeks. Check the system inventory against the SPRS entries at every change request, and treat a new data flow as a reporting event, not an IT ticket.
Affirmations that lapse unowned
A status counts as current only with a corresponding affirmation of continuous compliance that is not older than one year. Affirmations are easy to miss because they recur annually, sit outside the normal change process, and often have no named owner after the person who filed the first one leaves. Assign a named Affirming Official and a calendar owner for each UID, and set the renewal reminder well ahead of the anniversary so the date does not depend on one person's memory.
Subcontractors flowed the clause late
The prime must include the substance of the clause in subcontracts that process, store or transmit FCI or CUI, including subcontracts for commercial products and services, and must confirm before award that the subcontractor holds a current status at the right level. Late flowdown, or a purchase order that omits the clause, leaves the prime exposed for work it already awarded. Before issuing any subcontract, check the data flow, confirm the subcontractor's current status in SPRS, and keep the evidence in the award file.
POA&M items open when status ages out
A contractor holding a Conditional status must successfully close out a valid POA&M to reach Final status. Items that stay open while the status date gets older are the most common path to losing eligibility mid-contract. Track each POA&M item with its own target date and owner, and review open items against the status date monthly, so that a Conditional status does not quietly become a problem at renewal.
Draft evidence presented as final
A requirement counts as MET only when all applicable assessment objectives are satisfied with evidence in final form, not drafts. Policies still marked draft, scan reports without approval, or access reviews that were prepared but never signed do not carry the requirement, and an assessor will not accept them as final. Before any affirmation or SPRS update, check that each artifact is approved, dated and version-controlled, and that the assessment objective it supports is covered.
Questions contractors ask about DFARS 252.204-7021
Does DFARS 252.204-7021 apply to every system or only CUI systems?
The clause reaches every system that processes, stores or transmits Federal contract information (FCI) or controlled unclassified information (CUI) in performance of the contract. Systems that never touch that information fall outside it, but you still need to show how you drew that boundary. The clause requires you to keep a current CMMC status at the required level for each such system, to handle FCI or CUI only on systems with that status, and to give the contracting officer the CMMC unique identifiers (CMMC UIDs) for those systems. Document your data flows and system boundary early, because the UID list and every affirmation depend on it. Confirm the scope of your specific contract with the contracting officer.
How much effort and cost should we expect to keep CMMC status current?
No supplied figure sets a price for this clause, so treat any number you see from a vendor as a question to verify. The main cost drivers are the number of systems that handle FCI or CUI, how many of the 110 Level 2 requirements already exist in your environment, the state of your system security plan and POA&M, and whether a C3PAO or DIBCAC assessment is required for each UID. Some costs are one-time, such as gap remediation and the first assessment. Others recur, including annual affirmations, self-assessment refreshes after changes, and staff time for evidence collection. When requesting a quote, ask for the work broken out by system, by requirement family, and by one-time versus recurring effort.
Who signs the annual CMMC affirmation under DFARS 252.204-7021?
The affirmation is made by an affirming official, a senior person in your organization who has authority to bind the company on cybersecurity compliance. The affirming official attests that the organization is continuously compliant with 32 CFR Part 170 for each applicable CMMC UID, and the affirmation is entered in SPRS. Your organization makes this attestation for itself, so a consultant or implementation partner cannot sign it on your behalf. The attestation carries legal weight, so the person chosen should understand the systems and evidence they are vouching for. Each affirmation must stay within one year, so calendar the renewal date for every UID.
Can our own engineers do the CMMC work without outside help?
Yes, the organization can perform the implementation, documentation and evidence work with its own staff, and nothing in the clause requires an outside firm. The harder question is whether your team can run the work with the independence and rigor an assessor expects. Internal teams often underestimate evidence work: every requirement must be met with evidence in final form, and drafts do not count. Many organizations keep ownership of the controls and the affirmation while bringing in an implementation partner to prepare systems, configuration baselines, logging and documentation. Independent assessment remains with a C3PAO or DIBCAC where required. A DeployOpen engagement would prepare systems and evidence in your environment, but it does not issue assessment reports or certifications.
What happens if a subcontractor does not have a current CMMC status?
Before awarding a subcontract that involves FCI or CUI, the prime contractor must confirm that the subcontractor holds a current CMMC certificate or status at the level matching the information being flowed down. The prime must also include the substance of the clause in the subcontract, including subcontracts for commercial products and services, but excluding COTS items. If the subcontractor lacks the required status, the prime should not send that information to them. In practice, that means either choosing a qualified subcontractor, limiting the data shared, or reworking the subcontract scope. Ask each subcontractor for its CMMC UID and status date, and confirm the status in SPRS rather than relying on a letter alone.
What does the Phase II suspension change for this clause?
The suspension changes the timing of certification requirements, but it does not remove this clause's core duties. On 13 July 2026 the Department of War suspended CMMC Phase II, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The department also began a 60-day review by a CMMC Reform Task Force. The eCFR text still reflects the original four-phase schedule, and the DoW CIO page describes implementation as paused, so check current guidance before planning a certification date. Keep your status, affirmations and UID records current in the meantime.
How do we confirm current requirements with the contracting officer?
Ask the contracting officer in writing which CMMC level applies to your contract, which systems must be listed as CMMC UIDs, and which version of the requirements governs performance. Request the solicitation's CMMC language and any modifications, because the clause and its level are set in the contract itself. Also check the official sources directly: the eCFR text of 32 CFR Part 170, the DoW CIO About CMMC page, and the DFARS rule in the Federal Register. Record each answer and the date you received it, and keep that record with your contract file. Where the sources disagree, the contracting officer's written direction for your contract should guide your next steps.
How DeployOpen prepares systems and evidence for the clause
DeployOpen works on the technical side of this clause. Under a written, fixed scope agreed before work starts, we plan, implement and harden self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, then document the configuration and collect the evidence an assessor will later review. That covers the systems that process, store or transmit FCI or CUI, the boundary around them, and the records that show each Level 2 requirement is operating. Your organization still owns its controls, decides which systems fall inside the CUI boundary, and remains the party that signs for its own CMMC UIDs and status.
DeployOpen does not issue CMMC statuses, enter results or affirmations in SPRS on your behalf as an assessor, sign affirmations, or produce assessment reports or certificates. Those actions belong to your Affirming Official, your own self-assessment team, or an independent C3PAO or DIBCAC assessor where one applies. Hiring us does not guarantee any status, score or contract outcome. Before you sign, ask for the written scope to name which systems, which NIST SP 800-171 requirements and which evidence artifacts are in and out of scope, and confirm with your contracting officer and your assessor which UIDs and status dates your engagement affects.
Ask your partner to show, in writing, how each deliverable maps to the 800-171A assessment objectives it supports and where the final-form evidence will be stored. Practical checks include confirming that configuration baselines, access reviews, audit log retention and POA&M records are dated and versioned, and that any open items are tracked with owners and dates. Because a status counts as current only while compliance is unchanged and the annual affirmation is in place, plan for ongoing change control after handover, and confirm whether the retainer you are considering covers upgrades, re-evidencing and support between assessments.
