In 2022, DCMA performed a review of NIST SP 800-171 Basic (self-attested) scores reported in SPRS against the DIBCAC Medium assessments performed on those entities. The result?
There was a 113-point delta between what defense contractors attested to and what DIBCAC found.
And the delta was not in the contractors’ favor.
The average self-assessed score was 56.
The average DIBCAC finding was -57.
That is not close to conforming to 800-171 compliance. CMMC assessment has a higher evidentiary bar, and higher stakes for noncompliance.
The pause of Phase II of the CMMC program held off mandatory third-party assessment and the rollout for Level 3. However, it did not pause the legal requirement to achieve and affirm CMMC compliance. A self-attested CMMC compliance score requires the same implementation a third-party assessment does, but it carries a lower level of assurance. This time, DIBCAC is watching. Are you prepared for that?
With the legal obligations that come with the Affirming Official’s SPRS affirmation, you want the same insights, assurance, and support that would accompany a third-party validated score. DIBCAC Medium and High assessments are still a possibility for your organization once you have entered your score in SPRS.
Let’s talk about your plan to achieve CMMC readiness and make sure you have the details you need to stay out of the red when you get called for a DIBCAC High assessment.