Status context reviewed November 11, 2026. The July 2026 official program update announced suspension of the planned CMMC Phase II expansion and retained Phase I self-assessments and applicable safeguarding obligations. Read the latest official CMMC program update and the current solicitation and amendments before making an eligibility decision. This archive is not a statement of today's MAPS requirements.
What the original article discussed
RJ Williams' December 18, 2024 commentary discussed CMMC Level 2 (32 CFR Part 170) in the context of the Army's Marketplace for the Acquisition of Professional Services (MAPS) draft procurement. The concern was practical: a contractor could encounter a readiness gate in a draft solicitation before its own security program was ready to support that bid.
The original headline used the phrase “first CMMC Level 2 requirement.” This archive does not repeat that historical claim as an independently verified national first. It also does not carry forward the article's forecast bid or award dates as current deadlines. Draft procurement language can change, and a requirement in one opportunity does not establish the rule for every contractor.
Read the procurement before planning the assessment
The 2024 MAPS industry-day notice provides historical context for the draft process. For an active bid, locate the current notice, attachments and amendments on SAM.gov. Record the requirement that applies to your opportunity, its timing and the evidence the contracting office asks you to provide. Resolve ambiguous instructions with the contracting officer.
The preparation that remains useful
- Define the information and boundary. Identify where Federal Contract Information and Controlled Unclassified Information (CUI) are handled, and which people, services and systems support that work.
- Establish an honest baseline. Compare the actual environment and evidence with the requirements incorporated into your contracts. NIST SP 800-171 Rev. 2 implementation and an assessment score must describe the system you operate.
- Keep documentation tied to implementation. Maintain the System Security Plan, remediation actions and evidence as the environment changes.
- Match assurance to the actual requirement. A self-assessment, a third-party assessment and an agency acceptance decision serve different purposes. Follow current program guidance and the terms of the opportunity rather than an archived forecast.
Use the current plan
The lesson from the original post is to prepare before a procurement makes a gap urgent. Start with the data flow, the contract and a defensible assessment of the current state. The CMMC planning guide explains the site's current status review; the official program guidance and your solicitation remain the primary sources for decisions.
Bring the requirement you actually need to meet.
A strategy call can help organize the scope, evidence and next steps around your current contract requirements.
Email rj@indirectit.com or call 240-331-6256.
Share a high-level summary. Use an approved secure channel for Controlled Unclassified Information (CUI), credentials and sensitive documents.