CMMC Deadlines: Current Policy and Contract Requirements
A contractor’s CMMC deadline depends on current implementation policy and the requirements in its solicitation or contract. The original phased schedule is not a universal deadline after the Phase II suspension. Check the applicable clauses, amendments, assessment status, and information scope before making an assessment booking or a commitment to a customer.
Key Takeaways
- •The original rollout schedule and current implementation policy are different references.
- •Confirm the requirements in the actual solicitation, amendments, and contract.
- •Keep safeguarding, accurate evidence, and remediation ownership in place.
For readiness planning, review vCISO support for government contractors and CMMC certification timing.
What changed after the original phased schedule?
Phase II was suspended, according to the Department’s CMMC policy. Distinguish those implementation instructions from the original phased structure in the CMMC Program final rule.
For the current assessment discussion, use the Phase II and contractor readiness guide. An earlier rollout table should not be used alone to decide whether a particular solicitation requires an assessment.
Which requirement determines a contractor’s actual plan?
The applicable solicitation and contract, read with current official implementation policy, determine the required actions. Review clauses and amendments rather than assuming that every company handling government work has the same assessment deadline.
| Planning item | Reference to confirm |
|---|---|
| Information scope | Agency designation, contract, and authorized information categories |
| Safeguarding | Applicable clauses and referenced security requirements |
| Assessment status | Solicitation or contract requirement and current policy |
| Reporting and affirmation | Applicable contractual and program instructions |
| Subcontractors | Flow-down requirements and actual information access |
What work should continue while policy changes?
Continue operating the safeguards, evidence, and incident responsibilities required by the contract. DFARS 252.204-7012 addresses safeguarding and reporting where it applies; a changed rollout milestone should not be read as removing unrelated contractual duties.
Maintain an accurate system security plan and a candid record of gaps. Assign remediation owners and keep the information boundary current as systems and service providers change.
How should you confirm a disputed deadline?
Ask the contracting officer to identify the governing requirement and any current amendments or implementation instructions. Keep the clarification with the compliance plan, including its date and the system or contract it concerns.
Separate that external requirement from internal readiness targets and provider scheduling. A team can continue useful control work without representing an unconfirmed assessment date as a legal fact.
Frequently Asked Questions
Is the original Phase II schedule unchanged?
Does the suspension eliminate safeguarding duties?
Where should a contractor verify its deadline?
Tyler Carbone
Managing Director and Cofounder
Tyler Carbone is a Managing Director and Cofounder of Agency and one of the industry's leading voices on governance, risk, and compliance. He holds degrees from Harvard and a JD/MBA from the University of Virginia, and previously worked in cybersecurity at Deloitte. Tyler has helped hundreds of companies operate SOC 2, ISO 27001, HIPAA, and GDPR programs.
LinkedIn
