CMMC 2.0 Readiness Accelerator

Phase 2 was suspended on 13 July 2026 (memo 26-P-1023), pending a reform review reporting in September. Third-party C3PAO certification is not being imposed during the suspension — but Phase 1 has applied since 10 November 2025, and Level 1 and Level 2 self-assessments with annual affirmation remain pre-award conditions, alongside DFARS 7012's 72-hour DIBNet reporting, the 7019/7020 SPRS score at award, FAR 52.204-21 and prime flow-downs. None of that paused — and neither did the DOJ's Civil Cyber-Fraud Initiative: an inflated SPRS score is a false claim with or without Phase 2. This workbook is the self-assessment, the score, and the evidence behind them.

12-tab architecture (94 formulas, zero errors):

Scope & CUI Identification — FCI vs CUI distinction with contract indicator checklist. The most common early mistake: treating FCI-only contracts as requiring CMMC Level 2.

CUI Data Flow Inventory — CUI lifecycle questions with enclave strategy callout.

Level Determination & Path — 7-question decision tree with nested IF-formula producing Level 1 / L2-Self / L2-C3PAO / L3 recommendation.

NIST 800-171 Controls Tracker — all 110 practices across 14 families, each with the DoD Assessment Methodology SPRS weight (48 × 5pt, 15 × 3pt, 47 × 1pt), status dropdowns, and per-family summary formulas.

SPRS Score Calculator — auto-calculates score from the tracker using SUMPRODUCT deduction formula (starts at 110). Returns PERFECT / STRONG / BELOW POA&M THRESHOLD / DEEP DEFICIT based on score bands.

SSP Builder — 18-section System Security Plan template matching DoD format expectations.

POA&M Tracker — with "cannot POA&M" guidance (some practices cannot be deferred) and 180-day close-out requirements.

Evidence Register — 46 evidence items mapped to specific practices and families.

C3PAO Readiness — 18-point pre-assessment checklist and selection criteria. Keep it ready rather than act on it: certification is suspended, and the reform review may change what it is for.

Included since v2.0 — the "While It's Paused" kit, a second download of seven deliverables built around the suspension: an obligations resolver that tells you what still applies per contract, a Rev 2 self-assessment and SPRS calculator with partial-credit rules and a conditional-status check, an 800-171 §3.12.4 SSP template, a POA&M carrying the 180-day deadline, a DFARS 7012 72-hour clock, and a reform-watch page written to absorb the Task Force outcome the day it publishes. The original 12-tab workbook and its 28-page guide are unchanged and still included — this is added alongside, not in place of.

Where CUI actually lives. Scoping is where most SSPs quietly go wrong. If a managed provider holds your RMM, delegated admin or backups, it is inside the boundary whether the SSP says so or not — the MSP & MSSP Assessment Kit is what you assess it with, and the score you certify inherits its controls. If CUI sits in colocation or a cloud region, the geography, the residency question and the hardware and firmware supply chain are the Data Center Assessment Kit. And an incident starts two clocks, not one: DFARS 7012's 72 hours to DIBNet, and CISA's under the CIRCIA 72/24 Reporting Readiness Pack. The Defense Supplier Pack is this workbook with the provider assessment and the reporting pack, at 20% off.

For the FIPS and CBOM questions arriving underneath all of it, see the Post-Quantum Migration Kit; for what a board should be asking about any of this, the Director's Cyber Oversight Kit.

Flowdown Management — subcontractor registry, key DFARS clauses (252.204-7012, 7019, 7020, 7021), MSP guidance.

User Guide (28 pages, 14 sections): 2026 phased rollout reality, FCI vs CUI determination, why self-assessment is rarely safe at Level 2, CUI enclave strategy, working the 110 controls, SPRS scoring mechanics, SSP/POA&M discipline, C3PAO selection and engagement, flowdown in both directions, MSP/MSSP considerations, 12 common pitfalls, execution timeline.