What DFARS 252.204-7025 requires an offeror to hold before award
DFARS 252.204-7025 tells every offeror which CMMC level a solicitation requires: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). That level must be held before award for each system that will process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Eligibility depends on three things: the required current CMMC status entered in SPRS, a current affirmation of continuous compliance in SPRS, and the CMMC UIDs for each in-scope system listed in the proposal. A missing item can make an otherwise strong bid ineligible, so the first check is always the level named in the solicitation, not the level the company assumes it needs. The required level, the systems in scope and the status each offeror already holds differ from one organization to the next. A prime with a single enclave may hold a different status than a subcontractor-heavy supplier whose engineering network touches CUI. Read the provision, then map each system that will handle FCI or CUI against the status it holds. Ask the contracting officer to confirm the scope if the solicitation is ambiguous. DeployOpen prepares systems, controls and evidence for these assessments. Only the independent assessor or certification body issues results, and a company should not treat implementation work as a substitute for an assessment outcome. The Department of War suspended CMMC Phase II on 13 July 2026, as stated in its release on the suspension of CMMC Phase II. Phase I self-assessments, SPRS postings and annual affirmations remain in place, and DFARS 252.204-7012 obligations continue. Because the schedule is changing, confirm with the contracting officer which level a specific solicitation actually requires and whether a Level 2 (C3PAO) requirement is still being applied, rather than assuming the original phase timing.
How a solicitation states its CMMC requirement
The sequence from the contracting officer's provision to an award decision gives the government a verified CMMC status for every system that will handle CUI before any contract is signed. Each step produces a record the next party can check.
Contracting officer names the CMMC level
The contracting officer includes DFARS 252.204-7025 in the solicitation and selects the level the work requires: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). The program office or requiring activity supplies that choice, and the provision tells every offeror which status must be held before award. You know this step is done when the solicitation text shows one specific level, not a range. Confirm the level against the solicitation's Section L and M language before you plan your assessment.
Offeror identifies every system handling CUI
The offeror lists each information system that will process, store or transmit Federal Contract Information or CUI for the requirement. This list drives everything else, because the required status applies to each system, not only to the company as a whole. Enclaves, cloud tenants and subcontractor systems that touch the data belong on it. The check that closes this step is a scoped system inventory matched against the data flows in the statement of work.
Offeror confirms SPRS status and affirmation
Before submitting, the offeror confirms that SPRS holds the required current CMMC status for each in-scope system, and that a current affirmation of continuous compliance is entered. Under DFARS 252.204-7025(b)(2), an offeror is not eligible for award without both. The offeror, through its Affirming Official, is responsible for the accuracy of these entries. The output is a documented check showing the status, status date and affirmation for each system, with any gaps identified before the bid goes out.
Offeror lists CMMC UIDs in the proposal
Under DFARS 252.204-7025(d), the proposal must list the CMMC Unique Identifiers issued by SPRS for each system that will handle FCI or CUI. SPRS generates a UID once self-assessment results are entered, so the offeror needs those entries complete before writing this section. The output is a proposal table pairing each UID with its system name and boundary. Check that each UID in the proposal matches a live SPRS record for the same system.
Offeror updates UIDs as new ones are generated
If a new UID is generated while the solicitation is open, or after submission and before award, the offeror updates the list that DFARS 252.204-7025(d) requires. This matters when a new system is added, an assessment is entered late, or a boundary changes during evaluation. The step closes when the proposal's UID list matches SPRS at the time of update. Confirm with the contracting officer how and when updates are submitted, since the solicitation or contracting office sets that process.
Contracting officer checks award eligibility
The contracting officer reviews the offeror's SPRS status, affirmation and UID list against the level named in the solicitation. Under DFARS 252.204-7025(b)(2), an offeror that lacks the required current status or affirmation for any in-scope system is not eligible for award. A higher status satisfies a lower requirement for the same assessment scope, so a Level 2 (C3PAO) result also meets a Level 1 (Self) requirement. The output is an eligibility determination made before award.
Award decision with Conditional status where allowed
For Level 2 and Level 3 requirements, DFARS 204.7502(b)(2) allows a Conditional status for up to 180 days from the CMMC status date, and award can occur on that basis. Level 1 requires a Final status. The offeror should confirm that its Conditional status and the date it was set are accurately recorded, because the clock runs from that date. The contract file records the eligibility decision, and the offeror carries the status obligations into performance under DFARS 252.204-7021.
Which of the four levels a solicitation can require
Each DFARS 252.204-7025 solicitation names one of four CMMC levels: Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). The level determines who assesses the systems, which type of information they protect and which statuses can win award. Identify the level in the solicitation first, then match it to every system that will handle the data.
Level 1 (Self)
Level 1 (Self) applies to Federal contract information (FCI) and follows the safeguarding requirements of FAR 52.204-21. The organization performs the assessment itself and enters the result in SPRS. A solicitation that names this level signals that the work touches FCI but no CUI. Level 1 has no Conditional status, so the offeror must hold a Final status before award. Confirm the SPRS entry and its status date before submitting the proposal.
Level 2 (Self)
Level 2 (Self) applies to controlled unclassified information (CUI) and uses the requirements of NIST SP 800-171 Rev. 2. The organization assesses itself against the NIST SP 800-171A objectives and posts the result to SPRS, which then issues a CMMC UID. Solicitations that name this level often involve CUI in the work statement without calling for third-party review. Check whether the contract requires a higher status, because a Level 2 (C3PAO) result also satisfies this level.
Level 2 (C3PAO)
Level 2 (C3PAO) covers the same CUI requirements as Level 2 (Self), but a C3PAO authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB, performs the certification assessment. A solicitation naming this level signals third-party review before award. The Department of War suspended CMMC Phase II on 13 July 2026, the phase that would have required this certification for applicable contracts, so confirm with the contracting officer whether this level still applies. Conditional status can support award at this level.
Level 3 (DIBCAC)
Level 3 (DIBCAC) adds selected NIST SP 800-172 requirements, with parameters assigned by DoD, to the CUI requirements. DCMA DIBCAC performs the certification assessment, so the offeror cannot use a C3PAO for this level. A solicitation naming it signals a program handling the most sensitive CUI. Level 3 can also hold Conditional status, so the award decision depends on the status date recorded in SPRS and the remaining time on that status.
When a higher CMMC status satisfies a lower requirement
A higher CMMC status satisfies a lower one for the same assessment scope. Under 32 CFR 170.16(a) and 170.17(a), a Level 2 (C3PAO) status also satisfies Level 1 (Self) and Level 2 (Self), and a Level 2 (Self) status also satisfies Level 1 (Self). So if a solicitation under DFARS 252.204-7025 asks for Level 1 (Self) or Level 2 (Self), an offeror holding a current Level 2 (C3PAO) status on the same systems can meet that requirement without a second assessment. The reverse does not hold: a Level 1 result cannot stand in for a Level 2 requirement, and a self-assessment cannot stand in for a C3PAO assessment when the solicitation names Level 2 (C3PAO).
An organization may hold a higher status than a solicitation asks for because it bid on or performs work across several contracts, or because a prime or customer required it earlier. Before relying on that, confirm three things in your own records: the status and its status date in SPRS, the CMMC UIDs tied to that status, and whether the assessed scope covers every system that will process, store or transmit FCI or CUI for the contract. The solicitation's required level is what the contracting officer checks, but the scope recorded in SPRS and listed in your proposal is what determines whether your status applies to the work.
Scope usually matters more than the label. A Level 2 assessment that covers a corporate enclave but excludes the engineering network, a CUI file share, or a remote access path that touches CUI does not satisfy a solicitation for those systems, however high the status. Ask your assessor or consultant to show, in writing, the asset list, the enclave boundary and any systems excluded from scope, and check that each system your proposal names appears inside that boundary. A mismatch here is a common reason an otherwise strong status fails to support an award decision.
Who does what before a bid
The organization bidding on the contract owns everything the solicitation asks for. It owns its security controls, its system security plan and its evidence, and it is the party whose name, UIDs and status appear in SPRS. Under DFARS 252.204-7025, the offeror must hold the CMMC status the solicitation requires for each system that will process, store or transmit FCI or CUI, and it must list the CMMC UIDs for those systems in its proposal. The organization also decides who signs the affirmation of continuous compliance, and that signature is a statement of its own compliance, not a vendor's.
- Controls and scope: Defining which systems handle FCI or CUI and keeping those boundaries current is the organization's decision and its responsibility.
- SPRS entries: The organization or its authorized representative enters self-assessment results and status information in SPRS.
- UID list: The organization collects the UIDs SPRS issues for each in-scope system and includes them in the proposal, then updates the list when new UIDs are generated.
- Affirmation: A named official affirms continuous compliance in SPRS, and that person must be able to stand behind the statement.
- Proposal: The bid, including the UID list and any representations, is the organization's submission.
Before bidding, confirm which CMMC level the solicitation states, which systems fall in scope, and who inside the company will sign.
An implementation partner such as DeployOpen helps the organization prepare its environment and the records that show it works. The partner can build or harden the self-hosted platforms inside the client's own infrastructure, configure logging and access controls, write or update the system security plan and related documentation, and organize evidence so the organization can review it. Work is usually fixed-scope, with deliverables agreed in writing before work starts. The partner prepares systems and evidence. It does not decide the organization's compliance status, and it does not enter results or sign affirmations on the organization's behalf.
- Environment preparation: Configuring in-scope systems to the requirements the solicitation's level covers, within the client's own cloud accounts, data centers or air-gapped networks.
- Documentation: Drafting the system security plan, policies and procedures for the client to review, approve and maintain.
- Evidence: Producing configuration exports, logs, scan results and other artifacts in a form the organization can present to an assessor.
- UID workflow: Helping the organization build a repeatable process for recording SPRS UIDs and updating the proposal list when new UIDs are generated.
- Handover: Documenting how the organization operates the environment after the engagement ends.
Confirm in the statement of work that the partner's role excludes issuing results, entering attestations and signing affirmations.
Only an independent assessor issues CMMC results. For Level 2 certification assessments, the assessment is performed by a C3PAO authorized or accredited by the CMMC Accreditation Body, currently The Cyber AB. For Level 3, the assessment is performed by DCMA DIBCAC. Level 1 and Level 2 self-assessments are performed by the organization itself. The assessor tests the organization's systems against the assessment objectives in NIST SP 800-171A and decides whether each requirement is met on the evidence presented. Because the assessor must be independent of the party it assesses, it cannot design the controls it later tests, and an implementation partner cannot stand in for it.
- Who performs it: A C3PAO for Level 2 certification, DIBCAC for Level 3, and the organization for self-assessments.
- What it decides: Whether each applicable objective is satisfied with evidence in final form.
- What it issues: Results and certification outcomes flow through the proper channels, not through a consultant's report.
- Independence: The same firm should not both build the controls and assess them.
- Fees and timing: Confirm the assessor's engagement terms, scheduling and fee arrangements directly with the assessor.
Before engaging anyone, ask each party in writing which deliverables it produces and which decisions it does not make.
Which clause schedule applies to your solicitation
This table compares the original DFARS 240.371-5 clause schedule for clause 252.204-7021 with the July 2026 Phase II suspension and the conflicting texts as of 17 October 2026. Read each row as a question to put to the contracting officer, because the schedule that governs your solicitation depends on which source the contracting office follows.
| Item | What the original schedule says | What to confirm with the contracting officer |
|---|---|---|
| Clause 252.204-7021 before 10 November 2028 | Goes into contracts only when the program office or requiring activity specifies a CMMC level | Whether the solicitation names a CMMC level and, if so, which one |
| Clause 252.204-7021 from 10 November 2028 | Applies whenever contractor systems will process, store or transmit FCI or CUI | Whether the contract runs past that date and how a later modification would add the clause |
| COTS-only contracts | Excepted from the clause under the original schedule | Whether every deliverable is a commercial off-the-shelf item as defined in the solicitation |
| Phase II status (13 July 2026) | Suspended, along with the required Level 2 C3PAO certification milestone and later implementation milestones | Whether the solicitation still lists Level 2 (C3PAO) and how the suspension affects the requirement |
| Phase I obligations | Self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 remain in place | Which Level 1 or Level 2 (Self) entries and affirmations the offeror must hold before award |
| eCFR 32 CFR 170.3(e) text | Still contains the original four-phase schedule | Whether the contracting office is working from the eCFR text or from later DoW guidance |
| DoW CIO About CMMC page (17 October 2026) | Says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2 | Whether the page reflects the current requirement for this solicitation |
Preparing the proposal: UIDs, SPRS entries and evidence
Before a proposal goes in, the offeror needs a complete list of CMMC UIDs for every system that will process, store or transmit FCI or CUI for the work described in the solicitation. Under DFARS 252.204-7025(d), that list must appear in the proposal, and SPRS issues each UID only after the self-assessment results are entered. Start with a system inventory that matches the boundary in the System Security Plan, then confirm for each system that a UID exists and that its CMMC status and affirmation are current in SPRS. Check the status date and the affirmation date against the proposal due date and the level the solicitation names, because an expired or missing affirmation makes the offeror ineligible for award under DFARS 252.204-7025(b)(2) regardless of the score behind it. Confirm these details in SPRS directly rather than relying on an internal tracker.
The UID list is a living document. Assign one owner to reconcile it against the system inventory each time a system is added, retired or moved to a new environment, and before any proposal revision. Each new self-assessment that generates a new UID means the list changes, and the proposal must reflect the update, so a partner can build a simple check that compares the inventory, the SPRS entries and the proposal table on the same day the bid is finalized. Where a subcontractor will handle FCI or CUI for the work, request its UIDs and status in the same way and keep them in the same file.
A partner can prepare the evidence for the self-assessment ahead of the bid, but the evidence must be in final form, not drafts. Under 32 CFR 170.24(b), a requirement counts as MET only when every applicable NIST SP 800-171A assessment objective is satisfied with evidence that is final. In practice this means approved policies with version and approval dates, a current System Security Plan, signed Plans of Action and Milestones where they apply, exported configuration baselines, and screenshots or logs that show the control operating. Ask the partner to state in writing which artifacts it will prepare, which ones the organization must approve itself, and which ones only an assessor can accept. Preparing evidence does not replace the organization's own affirmation or the independent assessment, and the partner should not be the person who signs either.
Questions buyers ask about CMMC solicitation requirements
What does DFARS 252.204-7025 require an offeror to hold before award?
The provision tells offerors which CMMC level the solicitation requires, and the offeror must hold that status before award for each system that will process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). The choices are Level 1 (Self), Level 2 (Self), Level 2 (C3PAO) or Level 3 (DIBCAC). Under the provision, an offeror is not eligible for award unless the required current status is entered in the Supplier Performance Risk System (SPRS), along with a current affirmation of continuous compliance. The offeror also lists the CMMC Unique Identifiers (UIDs) for each in-scope system in its proposal. Confirm the exact level and any system scope with the contracting officer in the solicitation text, since the level can differ between solicitations for the same program.
Does my subcontractor's CMMC status affect whether I can win the award?
Yes, if the subcontractor will handle FCI or CUI for the work. The offeror's eligibility depends on the systems that will process, store or transmit that information, and those systems can belong to a subcontractor or an external service provider. Each organization that handles covered information needs its own status and affirmation, so a prime cannot rely on a subcontractor's assessment to cover its own systems. Ask each subcontractor for its SPRS status and CMMC UIDs before you list them in the proposal, and confirm in writing which party's systems carry which information. Flowdown terms belong in the subcontract, and the contracting officer will look at the status entries as well as the proposal list.
How long does CMMC preparation take, and what drives the timeline?
Durations are not stated in the researched facts for this topic, so treat any number you hear as unverified until it is in writing. The main drivers are the size of the environment that handles FCI or CUI, how many of the 110 Level 2 requirements already have evidence in final form, how many systems and enclaves are in scope, and whether the work includes remediating gaps before the assessment or self-assessment. Organizations with mature documentation and logging usually move faster than those that must build a System Security Plan and collect evidence from scratch. Ask any assessor or implementation partner for a written scope that lists the systems, deliverables and milestones, and treat that scope as the basis for the timeline.
Can we prepare for CMMC internally, or do we need outside help?
You can do much of the preparation internally, because the organization owns its controls and the self-assessment is performed by the organization. Outside help is most useful for gap analysis, system hardening, documentation, evidence collection and independent review before an assessment. A Level 2 (C3PAO) status requires an assessment by a certified third-party assessment organization (C3PAO) authorized through The Cyber AB, and no implementation partner can issue that result. DeployOpen prepares systems, controls and evidence inside the client's own infrastructure under a fixed, written scope, but it does not issue assessment reports or certifications. Whichever route you choose, the Affirming Official must be an employee who can make the attestation, and the decision should rest with your leadership.
What does the work need from our technical and management staff?
The work needs named owners for each control family, people who can explain how the systems run, and time from administrators who must provide configurations, logs and access records. Engineers will need to answer questions about boundaries, identity, encryption and change control, and managers must approve the System Security Plan and the Plan of Action and Milestones (POA&M). Staff responsible for the Affirming Official role should understand what each affirmation states before they sign it. Expect ongoing involvement after the status is posted, since affirmations recur and changes to in-scope systems must be reflected in UIDs and records. Ask any partner to name the internal roles it expects you to fill in the written scope.
What changes if the CMMC Phase II suspension ends?
The Department of War suspended CMMC Phase II on 13 July 2026, and it had been scheduled to start 10 November 2026 with a requirement for Level 2 C3PAO certification on applicable contracts. The suspension started a 60-day review by a CMMC Reform Task Force, and Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The Department also said it will enforce NIST SP 800-171 Rev. 2 in the interim. If the suspension ends, the timing and scope of third-party assessment requirements may change, so check the solicitation text and the current DoW CIO guidance before each bid. Plan for the controls and evidence now, since they serve every level, and confirm the current phase with the contracting officer.
How DeployOpen prepares systems and evidence for a CMMC bid
DeployOpen plans, implements and documents the self-hosted open-source platforms that hold controlled information inside your own infrastructure, so the systems and evidence behind a CMMC status are ready before a bid. DeployOpen prepares the environment and records; your organization owns its controls and its affirmations, and only an independent assessor issues a certification result.
How we scope
- Scope starts with the systems that will process, store or transmit FCI or CUI for the solicitation's required level.
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work begins.
- Ask for the written scope to name each in-scope system, its CMMC UID placeholder and the Level 1 or Level 2 requirements it must meet.
How we build
- Platforms are deployed and hardened inside your cloud accounts, data centers or air-gapped networks, not in a DeployOpen-hosted environment.
- Controls are configured against the Level 2 requirements, with configuration baselines and access settings recorded as they are set.
- Security testing of applications, APIs and infrastructure can be run to check the controls before any self-assessment is scored.
How we hand over
- Deliverables include system documentation, configuration records and evidence mapped to requirement IDs such as AC.L2-3.1.1.
- Evidence is delivered in final form, since a requirement is only met when its assessment objectives are satisfied with finished evidence.
- Ask for a handover list that shows which artifacts your assessor will review and who holds each one after the engagement closes.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Support can cover keeping evidence current for annual affirmations and for updating UID lists when new UIDs are generated in SPRS.
- Confirm with DeployOpen, in writing, which post-award tasks sit inside a retainer and which fall to your internal team.
