AffirmTrail is self-service documentation software based on user-supplied answers. It is not legal advice, not a C3PAO assessment, and not consulting. AffirmTrail never submits assessments or affirmations to SPRS on your behalf. Your Affirming Official remains solely responsible for the accuracy of any SPRS entry under applicable law, including the False Claims Act. TRNSFRM is a separate Cleveland and Columbus, Ohio cybersecurity and compliance partner (https://trnsfrm.tech).
Start with the award and the information, not the questionnaire
A prime contractor letter is a prompt to inspect the actual subcontract, its incorporated clauses and the information your company will receive. A purchase order for a finished commercial item can have a very different cybersecurity scope from a machining job that includes controlled technical drawings. Do not select a CMMC level solely because a supplier portal offers a convenient checkbox.
Keep the letter, relevant purchase order and clause list together. Ask the prime to identify the information categories, required status, in-scope CAGE codes and the contractual deadline. Record who answered and when. A verbal assurance that drawings are “not sensitive” is not a substitute for confirming whether they are FCI or CUI.
The COTS carve-out is narrow
FAR 52.204-21 excludes acquisitions of commercially available off-the-shelf items from its prescribed applicability. CMMC flow-down rules likewise require careful treatment of COTS purchases. The exception is about the actual acquisition, not a permanent exemption for the whole company. A manufacturer selling both catalog products and custom defense parts must evaluate each award and the associated information.
Document the basis for a COTS-only conclusion and obtain written confirmation about the information the prime will share. If controlled drawings, specifications or other covered information enter your workflow, reassess the scope before transferring them into ordinary email, shared drives or shop-floor devices.
FCI usually points to Level 1; CUI changes the analysis
FCI is nonpublic information provided by or generated for the government under a contract, excluding public information and simple transactional data. Level 1 addresses the 15 basic safeguarding requirements in FAR 52.204-21. The result is binary and every applicable requirement must be met. There is no Level 1 conditional POA&M route.
CUI requires a Level 2 analysis and the applicable NIST SP 800-171 safeguards. Level 2 Self applies only when permitted by the applicable procurement requirements; do not assume that identifying CUI automatically authorizes a self-assessment instead of a certification assessment. Scope every system, person and location that stores, processes or transmits the information, including cloud services and external service providers.
Current rollout: Phase I remains in force
The DoD CIO CMMC About page announces that Phase II requirements were immediately suspended on July 13, 2026, ahead of the previously scheduled November 10, 2026 start. It also states that Phase I self-assessment requirements remain in place. Treat this as a rollout announcement, not a repeal of CMMC, DFARS safeguards or existing subcontract obligations.
Before relying on relief, review the official announcement, applicable implementing memorandum and your actual contract with the prime. A deployment-phase change does not by itself erase a requirement already written into an award or authorize an inaccurate affirmation. Keep a dated copy of the applicable guidance with your scope decision.
A defensible first response to the prime
Reply with the confirmed data category, the proposed system boundary, the official responsible for the assessment and the work still outstanding. Ask for clarification where markings or clause requirements are inconsistent. Do not promise that an assessment is complete when you have only purchased software or written a draft policy.
Use the free checker to organize the initial scope discussion. If CUI implementation exceeds your internal capacity, request turnkey help from TRNSFRM, based in Cleveland and Columbus, Ohio and serving defense contractors nationwide. AffirmTrail organizes self-supplied documentation; it does not replace contractual advice or implement your controls.
Frequently asked questions
Does a prime letter automatically mean Level 2?
No. Inspect the contract, COTS applicability and the FCI/CUI actually involved. The required assessment type also depends on procurement requirements.
Did the Phase II suspension remove Phase I?
No. The DoD CIO July 13, 2026 announcement says Phase I self-assessment requirements remain in place.
Can AffirmTrail submit my response to SPRS?
No. Your authorized Affirming Official is responsible for all SPRS submissions and affirmations.