A buyer asks for your company's cybersecurity status. You have heard that CMMC Phase II is paused. You also have a supplier questionnaire waiting in a portal. Your next step is to reconcile those two facts against the work you are being asked to perform.
What the pause changes—and what still needs attention
The Department announced the Phase II suspension on July 13, 2026. Its current CMMC page says Phase I self-assessments remain in place. Check that page again when making an award or renewal decision.
The implementation memorandum limits government CMMC designations during the suspension to Level 1 (Self) and Level 2 (Self), retains DFARS 252.204-7012 obligations, and provides for select government-led assessments. It directs amendments to active solicitations and modifications to existing contracts containing the affected third-party requirements. Obtain the applicable written change from your customer before changing your contract plan.
A separate prime-contractor reporting process can still need your attention. RTX's supplier cybersecurity update, for example, tells suppliers to continue applicable contractual obligations unless formally changed through an authorized amendment or modification. Its instructions also ask suppliers to keep registration and certification information current.
Four decisions to make before you submit
- Identify the work and information.Match the request to a solicitation or order, the buying business unit and your supplying entity. Ask whether the effort involves Federal Contract Information (FCI), Controlled Unclassified Information (CUI), or neither. Identify the systems and service providers involved. Keep uncertainty open until the buyer confirms it.
- Confirm the applicable requirements.Read the clauses, attachments, supplier terms and amendments. Record the required CMMC level and assessment type where specified. If an older request still calls for a C3PAO assessment, ask how the suspension has been reflected in this order and which written instruction now governs it.
- Reconcile the assessment records.Check the assessed entity, CAGE codes, system scope, assessment date, status and affirmation. Establish which record the customer requested: a NIST SP 800-171 assessment score, CMMC status, or both. Compare those records with the systems that will perform the work.
- Confirm the submission route and date.Separate the government SPRS record from the customer's questionnaire or evidence request. Record the assigned form, recipient, deadline and evidence of successful submission. Keep a named owner for corrections and renewals.
For applicable subcontracts, DFARS 252.204-7020 addresses Basic Assessment currency and SPRS scores. It generally uses a three-year assessment window unless a shorter period is specified. DFARS 252.204-7021 separately addresses CMMC status, system identifiers and annual affirmations. An existing Basic Assessment score alone does not establish current CMMC status.
The 7012 clause addresses safeguarding and incident reporting for covered systems and information. Use the clause version incorporated into your order when reviewing your obligations.
Find your prime's instructions
Start with our prime contractor requirements index. Follow each guide to the original documents, then reconcile them with your current customer request.
| Customer | What to investigate | What to confirm |
|---|---|---|
| Lockheed Martin guide → | SPRS status and Exostar CCRA. The July 2 notice reinstates CCRA as the primary form, with Compliance and Risk parts. | Which survey is assigned to your vendor profile, whether a Risk survey is required, and whether the response reflects your current status. |
| RTX / Raytheon guide → | The current cybersecurity page, applicable purchase-order clauses and supplier registration instructions. | The buying business unit's submission process, current required status, and any written order amendment. |
| L3Harris guide → | The guide's Missile Solutions letters and evidence requests. Read their dates and business-unit scope before applying them. | Ask your designated representative for current instructions, especially when an earlier letter requests third-party evidence or gives a date that has passed. |
Use these as starting points for checking applicability. A letter from one business unit does not establish the requirements for every order issued across a corporate group.
A worked example: a Lockheed Martin reporting request
Illustrative scenario: A small manufacturer receives an Exostar reminder while quoting work for Lockheed Martin. Its IT provider points to an existing NIST assessment score in SPRS. The sales team assumes that closes the request.
The review: Check what the record actually represents, which entity and systems it covers, and whether the proposed work involves CUI. Identify the assigned Exostar form. Lockheed Martin's April 6 notice explains that it cannot directly review suppliers' SPRS submissions and therefore needs suppliers to share their status through Exostar. Read it alongside the July CCRA update.
The outcome: The responsible reviewer verifies the current status before answering the assigned CCRA questions. The buyer confirms the quote's applicable requirements and due date. The team retains the submission confirmation and records any unresolved scope question with an owner. The reminder closes when the requested reporting is complete.
The example is fictional. Completing a customer form records a submission; deciding what that submission demonstrates still requires the applicable assessment evidence and system scope.
Five questions to send your buyer
Please confirm the cybersecurity requirements for this solicitation or order:
- What FCI or CUI will we receive, generate or handle, and how will it be identified?
- Which clauses, supplier terms and amendments apply to our entity and this work?
- What assessment type, current status, affirmation and supporting evidence do you require?
- Where should we submit the information, using which form and vendor profile?
- What dates apply to quoting, award, information access, renewal and any open actions?
If earlier instructions have changed following the Phase II suspension, please provide the current written instruction and identify the request it replaces.
Download the review checklist (CSV)
The sheet provides fields for the order, source/version, information scope, assessment record, submission route, deadline, owner and receipt. Keep sensitive evidence in its appropriate repository and record a reference in the worksheet.
Continue your supplier research
Once you understand the customer's request, explore the company context behind it. ViKeLaAi Research brings public company intelligence and supplier relationships into that review.
- Find your supplier guide and check its source documents.
- Explore Lockheed Martin company profiles for available contract context and relationships.
- Compare research plans for the scope of your work.
- Ask about a research plan. Include the companies, research question and intended decision so we can discuss a useful scope.
Public security observations help frame further investigation. Establish a company's assessment status through the relevant records and authorized confirmation.