Verification continues during the policy pause
As reviewed on September 12, 2026, the Department’s CIO guidance says Phase II implementation is suspended while self-assessments and selected government-led assessments continue. Current CIO guidance.
The implementing instructions limit new requirement designations during the suspension to Level 1 (Self) or Level 2 (Self). They direct amendments to active solicitations carrying Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. For existing contracts, removal is directed before the next option exercise or during the next scheduled administrative modification.
Check which amendment or modification applies to your work. A policy notice alone does not show that your contract has changed. Level 1 remains tied to FAR basic safeguards. Level 2 remains tied to NIST SP 800-171 Rev. 2. DFARS 252.204-7012 requirements continue.
DCMA’s DIBCAC describes its role in contractor NIST SP 800-171 assessments and provides resources for Medium and High assessments. Its page remains a useful reference for that role, although the page itself carries a July 2025 date. DIBCAC.
Use current implementation direction and the actual contract to identify the required route. A forecast about future reform is not a substitute for that check.
Supplier statement
What the supplier says about the work and systems in question.
Assessment or status record
The result of a specific process, with its scope and date.
Supporting evidence
Records that help show how the supplier has put a requirement into practice.
Current operating record
Changes, open work, and reviews since the last checkpoint.
Each contributes something different. A prime’s routine review does not create a formal assessment status. A past assessment also does not answer every later question about changed work, systems, or subcontract terms.
Ask about scope and the basis of the answer
For an illustrative example, a supplier provides the required status information and confirms it covers the subcontract work. Your team checks the required record and date, then records its conclusion. A detailed control review is not the default next step.
If the supplier later says the work will move to a separate test system, ask whether the status still covers it. That change creates a specific reason to request clarification and, if needed, supporting detail.
Use an authorized way to obtain and review the necessary information. DFARS 252.204-7020(f) describes protected access to NIST assessment summary scores. It does not establish unrestricted buyer access to every supplier’s score or evidence. Read the access provisions.
Keep assurance connected to supplier work
Buyers need useful information between formal checkpoints. Record changes and ask specific follow-up questions. If a supplier has an implementation gap, identify the work and the help it needs.
Deep Fathom connects the supplier’s tasks and evidence with the records used for review. Flowdown records how and when a reviewer checked a response. Your team judges whether the response supports its decision. The platform does not grant a formal assessment status.
Evaluate the supplier assurance workflow, or prepare your supplier record for continued use.