DCMA DIBCAC Medium and High assessments: what to expect

What happens when DCMA DIBCAC assesses your NIST 800-171 program

DCMA DIBCAC runs Medium or High NIST SP 800-171 assessments using SP 800-171A and the 32 CFR 170.24 scoring method, and your organization must provide access to facilities, systems and personnel when it does. Once a DoD contract carries DFARS 252.204-7012, the Government may assess your nonfederal systems at any time, and the result takes precedence over any other assessment. DoD offers 14 business days to rebut or add information before the summary score is posted to SPRS. Your organization owns its controls. An implementation partner can prepare systems, documentation and evidence for the assessors, but only the Government issues the assessment result. Your readiness work should be planned around that split of responsibilities. The answer varies by contract, system scope and evidence maturity. The contract determines which clauses apply and which systems are in scope, and a broad boundary with many components takes longer to demonstrate than a tightly scoped enclave. Evidence maturity matters most: a Medium assessment reviews your system security plan, while a High assessment tests implementation against SP 800-171A, and assessors may ask for recent scanning results, system inventories, configuration baselines and multi-factor authentication demonstrations. Confirm with your contracting officer which clause version governs your contract, because the current DoD guidance on which revision applies has changed during 2026.

Ask your team three questions now. Can you produce a current system security plan, an accurate inventory and a configuration baseline for every in-scope system within days, not weeks? Can an engineer demonstrate multi-factor authentication and recent scan results without rebuilding the evidence? Who in your organization will coordinate access requests and manage the 14-business-day rebuttal window? Any gap you find in these answers is a risk to plan for, because a rebuttal can add information but cannot replace evidence that does not exist. Treat the assessment as a test of how well your program runs day to day, and fix the weakest documentation first.

Medium versus High: what each assessment looks at

The Basic Assessment is a self-assessment that the contractor performs and posts to the Supplier Performance Risk System (SPRS). It produces low confidence in the score because the government does not verify the answers. It is the starting point for the higher levels, and it is the score that a Medium or High assessment will replace or confirm. Contractors should treat it as a record they must be able to defend, since an inaccurate self-score can carry as much exposure as a poor result in a formal review.

Self-scored: the contractor scores each requirement against the DoD Assessment Methodology without government review.
Low confidence: the score tells the government what the contractor claims, not what an assessor has confirmed.
Feeds SPRS: the posted score is visible to contracting officers before award decisions.
Baseline for later levels: a Medium or High review checks whether the self-assessment matches the system.

Before relying on any self-score, confirm that the system security plan and the posted result describe the same environment.

Which evidence and demonstrations assessors ask for

A High assessment tests whether the artifacts you hold match what your system security plan claims. The six categories below cover what assessors typically request, and each maps to the SP 800-171A determination statements it supports. Confirm the exact artifact list with the assessing DCMA team and against your own environment before assuming any of it.

System security plan and currency

The system security plan is the first document assessors read, and it is the baseline for every other artifact. Check that it names the actual boundary, the systems inside it, the responsible owners and the implementation status of each requirement, and that it reflects the environment as it runs today. Assessors compare claims in the plan against what they observe, so a plan that describes a retired system or an unimplemented control will undermine the rest of the evidence. Confirm the required revision date and format with the DCMA team.

System and asset inventory

An inventory shows which hardware, software, cloud services and devices fall inside the assessed boundary. Assessors use it to test whether every component that stores, processes or transmits CUI is accounted for and covered by the plan. Gaps usually appear as unlisted endpoints, shadow cloud accounts or service accounts that never reach the inventory. Ask the assessing team what level of detail and which data fields they expect, because inventory formats vary between environments.

Configuration baselines and change records

Assessors ask for the approved configuration baseline for each system class, along with evidence that deployed systems match it. Change records showing how deviations were reviewed and approved support the claim that configuration is managed rather than assumed. Expect requests that link a baseline to a sample of live settings, which is where undocumented changes tend to surface. Confirm which hardening standard the assessing team will accept as a reference.

Scanning results and remediation records

Recent vulnerability scan output supports the claims about vulnerability monitoring and flaw remediation. Assessors look for scan scope that matches the inventory, a dated history rather than a single report, and tickets or change records showing how findings were prioritized, fixed or accepted with a documented reason. A scan that never covers a server in the boundary is a finding in itself. Confirm the scan frequency and retention period the team expects from your plan.

Multi-factor authentication demonstrations

For High assessments, assessors may request a live or recorded demonstration of multi-factor authentication for privileged and remote access, rather than only a written statement. They check whether the factor is enforced at the system, not merely configured in a policy document, and whether exceptions are approved and tracked. Prepare a walk-through of the login path for each in-boundary system, including administrative consoles and remote access gateways. Confirm with the assessors whether they will run the demonstration themselves or observe yours.

Incident and personnel records

Incident records show whether the incident-handling capability works in practice, while personnel records show that screening, training and access removal happen when people join, change roles or leave. Assessors typically sample tickets, training completion logs and access termination records to test the requirement text against real events. Gaps often appear as a plan that names roles nobody filled or access removal that took weeks. Ask the team how far back they will sample and which personnel categories they consider in scope.

What access you must provide and how the 14-day rebuttal works

Contractors must give DCMA assessors access to facilities, systems and personnel for a Medium or High assessment. Under clause 252.240-7997 in the current class deviation, the Government may still run these assessments using SP 800-171A and the 32 CFR 170.24 scoring methodology, and the contractor is expected to provide that access. DFARS 252.204-7020 sets the same expectation for the assessment itself. Before the assessment starts, confirm with the contracting officer and DCMA who will be on site or on the call, which facilities and system boundaries are in scope, and which personnel must be available to answer questions. Access for a High assessment can include reviewing evidence or demonstrations rather than network access, so agree on the format early.

After a Medium or High assessment, the contractor has 14 business days to provide more information or rebut findings. DFARS 252.204-7020 gives this window, and the class deviation says DoD offers the same 14 business days before it posts summary scores to SPRS. Treat this window as a fixed deadline. Name one response owner who can approve or reject each finding, and assign a backup. Build an evidence index before the assessment, mapping each requirement and each organization-defined parameter value to the file, screenshot, configuration export or policy that supports it, with the owner and date. A finding that is answered with a specific, dated artifact is far easier to contest than one answered with a general statement.

Plan for the rebuttal to be a documentation exercise, not a rebuild. Rebuttal responses should point to evidence that already existed when the assessment took place, such as scan results, configuration baselines, inventories and access reviews. Avoid creating new artifacts that suggest a control was not operating at the time. Ask your assessment support provider or internal counsel to review any response that concerns a finding with compliance or contract consequences. Confirm with your contracting officer the exact submission channel and format for the response, because the deadline runs from the notice you receive, and the methods for providing additional information are set by the Government.

How a DIBCAC Medium or High assessment unfolds

The sequence moves from notice and scheduling through document review or evidence sessions to scoring, a 14-business-day rebuttal window and posting of a summary score to SPRS, so each phase ends with a defined output you can prepare for.

Receive notice and schedule the assessment
DCMA, the Defense Contract Management Agency, notifies the contractor that a Medium or High NIST SP 800-171 DoD Assessment will take place, and the two sides agree on the assessment method and the people and systems in scope. The contractor's job at this stage is to name a point of contact, confirm which systems hold or process CUI, and confirm which facilities are covered. The step is complete when the scope and the schedule are agreed in writing, and you should ask for that written confirmation before work starts.
Submit the system security plan for review
For a Medium assessment, assessors review the system security plan and related documentation without visiting or connecting to your systems. The plan should describe each system in scope, its boundary, how each requirement is implemented, and any plan of action and milestones. The output is a set of documentation findings and questions that the assessors send back to you. Confirm with the assessing office exactly which documents they expect, because the plan must match the environment that actually exists.
Provide evidence and host demonstrations
For a High assessment, assessors request evidence or demonstrations, such as recent vulnerability scanning results, system inventories, configuration baselines and multi-factor authentication settings, and they may review them in a session. The DoD Assessment Methodology states that assessors do not need network access for this step. Staff who run each control should be available to walk through how it works. The output is a body of evidence mapped to the requirements, and you know the step is done when the assessors confirm they have what they need for each requirement.
Answer follow-up questions during the review
Assessors often return with specific questions about a requirement, a missing artifact or an inconsistency between the plan and the evidence. Response time and the quality of answers affect how cleanly the assessment closes, so route questions to the named owners quickly and keep a log of what was asked and answered. The output is a reconciled record in which each requirement has either supporting evidence or a stated gap. Confirm that every question has a written response before scoring begins.
Score findings under 32 CFR 170.24
Assessors apply the scoring methodology in 32 CFR 170.24 to the requirements they assessed, using SP 800-171A as the assessment procedure. Each requirement is judged as met or not met, and the result is a summary score for the assessed environment. The output is a draft summary that you will see before it is finalized, so compare each finding with your own records. Ask for the scoring worksheet if you cannot follow how a particular requirement was scored.
Respond within the 14-business-day rebuttal window
The contractor has 14 business days after the assessment to provide more information or rebut findings. This is the only fixed deadline in the process, and it runs from the point the contractor receives the summary. Rebuttals work best when they cite specific evidence for a requirement that was scored as not met, or when they correct a factual error about the environment. The output is either an accepted scoring or an updated score reflecting the additional information, and you should keep a copy of everything submitted.
Post the summary score to SPRS
After the rebuttal window, DoD posts the summary score for the assessment to the Supplier Performance Risk System (SPRS). Under the DFARS 252.240-7997 clause in the February 2026 class deviation, DCMA results for Medium or High assessments take precedence over any other assessment. The output is a posted score that contracting officers can see, and you should check SPRS to confirm it matches the final result. Any later changes to your environment may require your own update to the score.

How DCMA results override other scores and how often assessments happen

A Medium or High assessment conducted by DCMA takes precedence over any other assessment of your NIST SP 800-171 implementation. Under clause 252.240-7997 in the current class deviation, DoD posts the summary score from a DCMA Medium or High assessment to SPRS after giving you 14 business days to rebut. That posted score is the one a contracting officer will see, so a Basic Assessment you posted earlier, even one you believe is accurate, may no longer be the figure that counts. Before the assessment starts, confirm with your contracts team which score is currently in SPRS for each covered system, and compare it with the score your own System Security Plan would support. Any gap between the two is the first thing to resolve, because the government's result will override the self-reported number once it is posted.

DFARS 252.204-7021(c) says CMMC assessments will not duplicate other comparable DoD assessments, except in rare cases such as indications of cybersecurity or CMMC compliance issues that make a reassessment necessary. The DoD Assessment Methodology anticipates that contractors with DFARS 252.204-7012 will be assessed about once every three years, unless program risk or a security-relevant change calls for a different frequency. Practically, a clean recent result gives you a defensible position for that window, but a significant change to the boundary, a new hosting provider or a serious incident can justify an earlier review. Keep a dated record of such changes and what you did about them, since that record is what shows the reassessment was not a duplicate.

How to get ready before DIBCAC arrives

A DIBCAC Medium or High assessment tests whether your documented controls match what your systems do today. The six areas below connect because each one produces evidence an assessor will ask to see, and gaps in one usually show up as findings in another. The organization owns its controls and attests to them; an implementation partner can help prepare systems and evidence, but only the assessing government team issues results.

A current, accurate SSP

The system security plan is the first document an assessor reads, and it must describe the system as it runs now, not as it was planned. Check that each requirement has a stated implementation, a responsible role, and a reference to where the evidence lives. Confirm the plan's revision date matches the last change to the environment. Assessors often compare the SSP line by line against screenshots and configuration exports, so any statement that cannot be shown should be corrected before the visit.

Reconciled boundary and inventory

Assessors test the scope of the assessment before they test the controls. Reconcile your asset inventory against the network diagrams, cloud accounts and identity directory so that every system that stores, processes or transmits CUI appears inside the boundary, and every out-of-scope system has a documented reason. Look for shadow tools, unmanaged endpoints and cloud subscriptions that finance or engineering created outside the normal process. A boundary that changes between the SSP and the live environment is one of the fastest ways to lose credibility.

Evidence that controls operate

A policy proves intent, but an assessment checks operation. For each requirement, collect records from the period under review: access reviews that were signed, audit logs that were reviewed, patch reports, change tickets with approvals, and training completions. Confirm that the evidence covers a sustained period rather than a single week prepared for the visit. Where a control is manual, identify who performs it and how a second person verifies the result. Gaps here commonly appear as requirements that are documented but cannot be demonstrated.

ODP values assigned and documented

Rev. 3 requirements contain organization-defined parameters that NIST does not fill in. If the federal agency did not specify a value, your organization must assign one for the requirement to be complete. Build a register that lists each parameter, the value you chose, the rationale, and the system where it is enforced, such as a session timeout or an audit retention period. Make sure the configured settings match the documented values, because an assessor will check the running system against the number written in the plan.

Named access and rebuttal owner

Assessors need a single person who can grant access to facilities, systems and personnel, and who can answer follow-up questions quickly. Name a primary owner and a backup, and give them authority to pull engineers into interviews. The same owner should manage the 14-business-day window for rebuttal, tracking which findings you dispute, what additional evidence you will send, and who signs off on each response. Without a clear owner, rebuttal deadlines pass while records sit in different teams.

Mock evidence walkthrough

Before the assessment, run a dry run in which an internal reviewer who did not build the controls asks for evidence for a sample of requirements. Time how long it takes to produce each artifact, note where the answer depends on one person, and confirm that screenshots and exports are dated and attributable. Include interviews with system administrators, help desk staff and personnel who handle CUI, because they must describe their duties consistently with the written procedures. Record every gap as a remediation item with an owner before the real assessment begins.

Who does what: your team, a partner and the Government

Your organization owns the controls, the system security plan (SSP), the access granted to assessors and the accuracy of every score posted to SPRS. No outside party can accept those responsibilities for you. NIST states that application and implementation of SP 800-171, and any compliance issues, rest with the federal agency that holds the contract, and your leadership signs the statements that go into the record.

Controls and operation: Your staff must actually run the safeguards in the SSP, not only describe them.
System security plan: Your SSP must match the systems that exist today, including the boundary, the people with access and the external services used.
Access for assessors: You must provide access to facilities, systems and personnel when the Government assesses you, so plan who will answer questions and demonstrate each control.
The 14-day rebuttal: Your team decides whether to submit more information or rebut findings within the window offered after a Medium or High assessment.
SPRS accuracy: Your executives are responsible for the score DoD posts and for any update you make to it.

Before any assessment, confirm which person in your organization holds each of these duties and who can approve a rebuttal.

Questions buyers ask about DIBCAC assessments

Can a consultant attend a DIBCAC assessment or represent our company?

Yes, an outside advisor can help you prepare, and many organizations have one present during sessions, but the company remains responsible for its own answers and evidence. The assessment is a Government activity run by DCMA, and the contractor must provide access to facilities, systems and personnel under clause 252.240-7997. Agree in writing before the assessment who speaks for the company, who holds the system security plan, and who approves what is shared. An implementation partner prepares systems and evidence but does not issue findings, scores or reports; only the Government posts results to SPRS.

Does DIBCAC need direct network access to our systems?

It depends on the assessment level. A High assessment can be conducted on-site or virtually using SP 800-171A, and the DoD Assessment Methodology describes High assessments that review evidence or demonstrations such as recent scanning results, system inventories, configuration baselines and multi-factor authentication, without requiring network access by the assessors. Medium assessments review your system security plan. Ask the assessing team early which evidence method they will use, how screen-sharing or remote demonstrations will be run, and which accounts they will need, so that access is granted with least privilege and logged.

How does a Medium DIBCAC assessment differ from a High assessment?

A Medium assessment reviews your system security plan, which gives medium confidence in the results, while a High assessment examines the implementation itself using SP 800-171A and gives high confidence. The DoD Assessment Methodology describes both as Government-conducted, and both are scored using the 32 CFR 170.24 methodology. A High assessment asks for demonstrations and evidence that controls work as described, such as recent scan results, configuration baselines, inventories and authentication settings. Plan for a High assessment as if every SSP statement will be tested against a live system or a dated artifact.

How long should we prepare before a DIBCAC assessment?

The preparation period depends mainly on how far your environment already matches your system security plan. The main drivers are the accuracy of the SSP and its scope, whether evidence such as scan reports, inventories and baselines exists and is current, the number of systems that handle CUI, and how many requirements rely on organization-defined parameters that you must assign yourself. Start by comparing your SSP against each requirement in SP 800-171 Rev. 3 or the Rev. 2 requirements your contract cites, then identify gaps and their remediation effort. Ask any advisor for a written plan tied to those gaps rather than a fixed duration.

Can we prepare for a DIBCAC assessment without outside help?

Yes, a contractor can prepare internally, and the NIST FAQ places responsibility for implementation and compliance on the company and its federal agency, regardless of size. Internal teams need people who can map each requirement to a control, collect dated evidence, and explain it to a technical assessor. Outside help is most useful when gaps are unknown, when systems are complex, or when staff lack time to run a mock assessment. Whatever you choose, have someone who did not write the SSP walk through each requirement to see whether the evidence supports it.

How often does DCMA perform these assessments?

The DoD Assessment Methodology anticipates assessing contractors with DFARS 252.204-7012 once every three years, unless program risk or a security-relevant change calls for another frequency. DFARS 252.204-7021(c) also says assessments will not duplicate other comparable DoD assessments, except in rare cases such as indications of cybersecurity or CMMC compliance issues. Treat the three-year anticipation as a planning baseline, not a guarantee, and keep your SSP and SPRS posting current between assessments, because a security-relevant change can trigger a reassessment sooner.

What should we do if our DIBCAC score comes back low?

Use the 14-business-day window to respond. Under DFARS 252.204-7020, you have 14 business days after a Medium or High assessment to provide more information or rebut findings, and under clause 252.240-7997 DoD posts summary scores to SPRS after that rebuttal period. Review each finding against the evidence you can produce, correct any SSP inaccuracies, and document what is factually wrong or missing. Do not rewrite the SSP to match a score after the fact without evidence that the control existed at the time. Ask counsel to review any submission that touches contract representations.

How DeployOpen prepares your evidence before a DIBCAC assessment

DeployOpen plans, builds and documents the self-hosted open-source platforms that hold your CUI, inside your own infrastructure, so your team can show assessors working controls and current records. We prepare systems and evidence for a DIBCAC assessment; the Government conducts the assessment and issues the results.

How we scope

We agree the written scope with you before work starts, naming the systems, enclaves and boundaries that handle CUI.
We map each in-scope environment against the SP 800-171A requirements and flag where the system security plan no longer matches reality.
We confirm with your contracting officer or sponsor which assessment level and organization-defined parameter values apply, since the Government may specify them.

How we build

We configure identity, logging, encryption, boundary controls and patching on your platforms so each requirement produces a record an assessor can examine.
We set up recurring scan, inventory and configuration baseline reports so the most recent results are ready on request.
We test that multi-factor authentication, access reviews and incident procedures work as documented, and we fix gaps before the assessment window opens.

How we hand over

We deliver the system security plan, plan of action and milestones, and evidence index in formats your team owns and can update.
We prepare short walkthrough scripts so your staff can demonstrate controls live, including where each record is stored.
We document what was changed, who approved it and what remains open, so your team can answer rebuttal questions within 14 business days.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the written engagement ends.
We can re-check evidence when a security-relevant change occurs, since assessment frequency may shift with program risk.
Your organization keeps ownership of its controls, and independent assessors remain the only parties who issue results or reports.