Even if your technical proposal is outstanding, you’re stuck at score ‘4’ for compliance and potentially out of the competition. This no-fault failure happens because teams launch an 11th-hour effort to incorporate security control answers into a submission already constrained with hard due dates.
Start With The CUI Question, Not The Framework
First things first: Is the contract in contact with controlled unclassified information? That one classification decision dictates nearly your entire process. If CUI is not in scope, you’re likely at CMMC Level 1, which requires only a self-assessment against a smaller subset of practices. If CUI is in scope, you’re in Level 2 land, and that larger string of requirements, including potential third-party assessment, becomes part of the puzzle.
Too many bid teams jump over this step or make an assumption based on the last contract they touched rather than the current one. Go get the answer from the contracting officer, or read the solicitation language yourself. Guessing wrong at this step means hoping against hope that you can build your entire milestone plan off a different assessment pathway.
Work Backwards From The RFP Date
Once you know the classification, build the plan in reverse. Take the expected RFP release date and count backward through every task that has to happen before submission: gap analysis, remediation, evidence collection, self-assessment, SPRS submission, and – if applicable – third-party assessment scheduling.
Most compliance timelines fail because they’re built forward instead. A forward plan starts with “let’s do a gap assessment” and hopes everything fits before the deadline. A backward plan starts with the deadline and forces every task into a slot that actually has room for it. If there isn’t room, that’s useful information during bid/no-bid, not a surprise three weeks before submission.
Run The Gap Assessment Early, Not As A Formality
The gap assessment against NIST SP 800-171 needs to happen during the bid/no-bid phase and not after you’ve decided to pursue the contract. Many teams get this wrong because they see the assessment as a checkbox and not as the determination of the bid’s viability.
The gap assessment should show you which of the 110 controls are already in place, which are partially in place, and which don’t exist. This matters because controls that are only partially in place usually require less work for teams to complete than they think, while controls that don’t exist, especially those related to access management or incident response, can require months of work. Scoping also plays a role here: define the systems, users, and data that are actually in the scope of the assessment before you even start estimating the effort, because an overly broad scope will inflate both the cost and the timeline.
Turn The Gap List Into A POA&M With Real Owners
A gap assessment without a POA&M is only an issue log. The POA&M defines the schedule for the milestone plan. For every deficient control there needs to be an owner, a target date, and a collection task: policies, configuration screenshots, training records, or whatever indicates the control is operational and not just on paper.
Regular weekly or biweekly check-ins against the POA&M identify slippage while there’s still time to react. If a control owner misses a second milestone, that’s a factor for issue escalation or reassignment, not an indication to bump to the next sprint.
Schedule The Self-Assessment With Margin, Not Exact Timing
The point in time where it all goes wrong, if it’s going to, is the self-assessment. Teams schedule it against the RFP deadline, assuming they’ll have their scorecard nailed down by then. They often don’t. You need to block out at least two weeks between the self-assessment and submission of your score to the Supplier Performance Risk System, and another two weeks between that submission and the proposal deadline. If you don’t give yourself that cushion, you can’t hold up the final proposal as evidence that, yes, we have submitted our score for the SPRS, would you like us to include a copy of our confirmation with the RFP?
If you want the specific details of the mechanical portions – i.e., how do you generate that score, what specific evidence do you need to maintain, how are Level 1 expectations different from Level 2 expectations – it’s worth reading a full breakdown of the cmmc assessment process before you lock in your internal dates. This is what it’s going to take to pull together all the documentation.
Don’t Forget The C3PAO Or DIBCAC Lane For Level 2
If the contract has Level 2 with third-party certification in scope, the first milestone of course has to be that C3PAO start date or the DIBCAC application finish date, but getting there involves multiple other steps: Requirements review, policy tailoring and implementation, a full cycle of process evaluation, potentially the same for your tools, a pre-assessment security interview, and of course the Level 2 pre-assessment itself.
All of those things need to finish the necessary number of weeks before the C3PAO visit (the actual assessment is a minimum of three weeks) to leave enough time for planning the visit and wrapping up the reported results. Post-assessment negotiations can take some time, so the investigation of your compliance isn’t finished until the C3PAO or DIBCAC says it is and your Plan of Action and Milestones is finalized.
That’s not all, though. The CMMC rules specify that you have to call in your chosen independent assessor and get on their calendar before the RFP even drops. If you miss that milestone, you’ll end up waiting six months for the re-compete decision to roll around next year.