DIBCAC Assessment Support

Start by triaging the findings immediately, validating what is actually deficient, and determining whether each issue is even eligible for POA&M treatment. Under the CMMC rule, POA&Ms are limited, some controls cannot be deferred, and any conditional status must be closed out within 180 days if a POA&M is allowed.

From there, focus on building a response that is specific, consistent with your SSP and evidence, and realistic enough to support closeout later.

There is not one public standard notice period. DCMA publishes pre-assessment materials, which is why contractors should stay ready to respond quickly. You may have less than a week to submit a response, so the safest approach is to assume notice may be shorter than you want and to stay audit-ready.

The audit depth increases with the level. Low assessments are usually virtual, focusing on the NIST SP 800-171 cybersecurity controls. Medium assessments involve more comprehensive evidence requests and thorough reviews of documents like your System Security Plan. High assessments are the most rigorous, often conducted onsite, requiring you to prove that your security controls are fully implemented and effective in your actual office and network environment.

Auditors will verify that your system matches your System Security Plan. They will ask for technical demonstrations, not just documentation. You might be asked to pull up Active Directory to verify user setup or show VPN configurations to confirm encryption. Be prepared for some assessors to be highly technical and others to ask foundational questions. The key to a faster onsite experience is thorough, control-organized evidence that you can present on-demand.

If you’re compliant with the mandatory items but have deficiencies, DIBCAC will typically provide a remediation window, no longer than 180 days after the assessment. You may need to submit a POA&M or remediation plan, and the auditors may come back to verify your fixes. This is not a failure, but it does mean you will need to organize a plan to address the remaining gaps quickly.

Resubmitting is typically only required if the DIBCAC assessment results lead to changes in your environment, a corrected score, or a new compliance date.

Common pitfalls include putting ineligible controls on the POA&M, using vague remediation language, failing to tie actions to real evidence, and assuming that “we’re working on it” is enough. Officially, some controls are not POA&M-eligible at all, and closeout must occur within 180 days where POA&Ms are permitted.

For CMMC Level 2 and Level 3, POA&M closeout must be confirmed within 180 days of the Conditional CMMC Status Date. If closeout does not happen in that timeframe, the conditional status expires.

That is a common reason organizations seek support. Documentation is critical because assessors are looking for evidence that is clear, traceable, and aligned with what your environment actually does. The CMMC rule also makes clear that the System Security Plan is not something you can simply defer onto a Level 2 POA&M, which raises the stakes for documentation quality.

If your company handles sensitive defense information and represents compliance, the prudent position is to act as though your posture may be examined.

Possibly. Depending on the assessment path and your status, there may be follow-on submissions, evidence updates, POA&M closeout activity, and required affirmations after assessment or closeout. Contractors must also maintain current status and annual affirmations, and reassessment can occur in some cases.

At minimum, that mismatch can raise serious credibility and compliance concerns. More seriously, inaccurate cybersecurity representations can create contractual and legal exposure. In the MORSECORP case announced by DOJ in March 2025, the contractor agreed to pay $4.6 million to settle allegations related to cybersecurity noncompliance and a submitted SPRS score that did not reflect reality.

That is why score accuracy, documentation integrity, and remediation transparency are vital.

Audit-ready organizations know where their CUI lives, what their SSP says, and which artifacts support their controls. Audit-surprised organizations discover incomplete SSPs, scattered evidence, and unclear control ownership during the assessment.