As 2026 comes to a close, defense contractors have an opportunity to review their CMMC readiness and make informed decisions about the year ahead. Are your security practices, documentation, and remediation plans keeping pace with your business?
November is a timely checkpoint. CMMC Phase II was originally scheduled to begin November 10, 2026. That phase remains suspended, while Phase I self-assessment requirements remain in place. The suspension concerns the rollout phase; it does not eliminate Level 2 or the cybersecurity obligations in your contracts.
A focused year-end review can help your team identify unfinished work, confirm customer expectations, and build a realistic 2027 plan. Start with these five questions.
1. Does your System Security Plan reflect your current environment
Your System Security Plan (SSP) should explain the environment you actually operate and how you implement applicable security requirements. If your organization has changed since the document was last reviewed, it is time to check for gaps.
Consider new employees, remote access arrangements, cloud services, business applications, and outside IT providers. Have those changes affected where Controlled Unclassified Information (CUI) is processed, stored, or transmitted? Are system boundaries, responsibilities, and connections still accurately described?
For example, if employees have started sharing project files through a new collaboration platform, confirm whether those files contain CUI and whether the platform belongs within your assessment scope.
Year-end action: Review your SSP alongside your current system inventory and CUI data flows. Assign an owner to resolve discrepancies.
2. Can you support your self-assessment with evidence
A completed worksheet is a starting point. Your team should also be able to show how security requirements are implemented and maintained.
Review a sample of requirements and locate the supporting records. Depending on the requirement, those records might include access reviews, configuration settings, training records, security logs, or evidence that a procedure is being followed. Check whether the evidence matches the systems and people currently in scope.
When applicable, review the assessment information entered in the Supplier Performance Risk System (SPRS), along with your affirmation obligations and due dates. Assessment validity periods and annual affirmation requirements are separate considerations, so avoid assuming that a valid assessment means no further action is needed.
Year-end action: Have someone other than the original preparer trace several assessment findings to their supporting evidence. Investigate missing, outdated, or inconsistent records.
3. Are remediation items moving toward completion
An unresolved security gap can remain on a task list for months when no one owns the next step. Review outstanding items and identify what is preventing progress: funding, technical decisions, vendor coordination, or limited staff time.
Give each item a responsible owner, a target date, and a clear way to verify completion. Prioritize work according to security risk and applicable assessment or contractual requirements.
If your organization uses a Plan of Action and Milestones (POA&M), distinguish your internal remediation schedule from the formal CMMC rules. A POA&M does not automatically make an unmet requirement acceptable. CMMC limits which requirements can be deferred, and permitted POA&Ms associated with conditional status require closeout within 180 days.
Year-end action: Review overdue work with both IT and leadership. Confirm which gaps must be resolved before an applicable assessment or customer milestone.
4. Have you confirmed customer expectations
Use your year-end review to examine current contracts, upcoming bids, and communications from prime contractors. Where CMMC requirements apply, the required level, assessment type, and flowdown obligations matter.
Ask customers to clarify any readiness milestones, evidence requests, or certification expectations that affect your work. Record the source and date of each requirement so your team can distinguish a contract obligation from a planning assumption.
Your organization may support customers with different expectations. A single companywide target date may not capture every obligation.
Year-end action: Maintain a short list of customer requirements, affected systems, responsible contacts, and relevant dates. Resolve uncertainty before committing to a project timeline.
5. Does your 2027 budget support the work ahead
Turn the findings from your review into a budget that reflects the work your organization actually needs. Depending on your gaps, that may include technical improvements, documentation support, employee training, outside expertise, or assessment preparation.
Also account for ongoing work such as reviewing access, monitoring security tools, updating evidence, and maintaining policies. Assign time as well as money. A funded project can still stall if the people responsible have no capacity to carry it out.
Year-end action: Bring leadership a prioritized plan showing the work, expected cost, internal owner, and dependencies. Review progress regularly throughout 2027.
Build a clearer CMMC plan with SME
A useful year-end review gives your team a clearer understanding of what is complete, what needs attention, and what to do next.
SME, Inc. helps defense contractors evaluate readiness, review and prepare SSPs, organize documentation, address security gaps, and manage their compliance programs over time. Our team can help turn your findings into a practical action plan aligned with your environment and business needs.
Schedule a no-cost consultation with SME to discuss your CMMC readiness.
