THE SIGNAL
The DFARS rule implementing the Cybersecurity Maturity Model Certification (CMMC) program took effect November 10, 2025, starting Phase 1. Contracting officers must check the Supplier Performance Risk System (SPRS) and cannot award to an offeror without a current CMMC status posted there.
On July 13, 2026, the Department suspended the Phase II requirements that were scheduled for November 10, 2026. Its CMMC page is explicit that "All Phase I self-assessment requirements remain firmly in place." At Level 2 (Self), that means a self-assessment every three years against the 110 requirements of NIST SP 800-171 Revision 2, plus an annual affirmation. The assessment lapses if the annual affirmation is missed.
BEFORE
Hypothetical: a machining subcontractor finishes its Level 2 self-assessment. The score is ready to enter in SPRS. The affirmation has to come from the Affirming Official, the senior representative with authority to affirm continuing compliance, who is traveling. The prime's proposal deadline is Friday.
The file is ready. The person who can release it is not.
WHAT THE WAIT COSTS
Without a current status, the subcontractor cannot be in the award. The prime picks a supplier whose status is posted. The work to protect the information was done, and the business is lost anyway, on a calendar problem.
AFTER
The packet is assembled before the deadline: the score, any open plan of action items with their closeout dates, and the system boundary. The Affirming Official reviews a one-page summary and affirms on time.
The next annual affirmation date is set the same day, with a named owner who prepares the packet a month early.
HOW WISDOMTWIN FITS
WisdomTwin.ai is building a sovereign judgment layer for regulated enterprises in banking, healthcare, legal, government, pharma and defense. It is designed to run inside your own environment, assemble the decision packet with the evidence attached, route it to the named person who holds the authority, and keep a record of who released the decision and why.
We don't replace judgment. We remove the wait.
TRY THIS THIS WEEK
Find your CMMC status date and the date your next annual affirmation is due.
Name your Affirming Official and the person who prepares the packet.
Check every open bid's expected award date against those two dates.
SOURCES
Federal Register, DFARS final rule, Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041), published September 10, 2025, effective November 10, 2025: https://www.govinfo.gov/content/pkg/FR-2025-09-10/html/2025-17359.htm
DoD CIO, About CMMC (Phase II suspension notice dated July 13, 2026): https://dodcio.defense.gov/cmmc/About/
32 CFR Part 170, definition of Affirming Official (170.4): https://www.govinfo.gov/content/pkg/CFR-2025-title32-vol1/pdf/CFR-2025-title32-vol1-part170.pdf
Examples in this issue are hypothetical, and nothing here describes a customer result.
Book a 20-minute call: https://calendly.com/romanbodnarchuk/20min
Roman Bodnarchuk, Co-Founder and CEO, WisdomTwin.ai