"Select Government-Led Assessments" — The Three Words Everyone Skipped

Two weeks after the Department of War suspended CMMC Phase II, the small-contractor community has mostly settled into one of two readings. The first — "CMMC is dead, I can stop" — is wrong, and we've already dismantled it. The second — "self-assessment is the only path now" — is right, and we covered why that's actually good news.

But there's a third piece of the announcement that almost nobody has stopped on. It's a single phrase describing how the Department will enforce NIST SP 800-171 Rev 2 during the interim period. The mechanism is self-assessments — and:

Read that again, slowly, because those three words are the interim enforcement model — and they change the job your documentation has to do.

The headlines said the audits went away. That's not what happened. Assessment did not disappear. The third party did. What was suspended is the C3PAO pathway — the private, scheduled, hire-your-own-assessor model. What was retained, explicitly and in writing, is the government's own ability to assess you directly.

And a government-led assessment is a very different room to be in.

Three Words, Unpacked One at a Time

Regulatory language is chosen carefully. Each of these words is doing work.

Put the three words back together and the interim model becomes clear: you assess yourself, you attest to the result, and the government reserves the right to check your work directly.

What "Self-Assessment + Government-Led Assessment" Actually Means

Here's the shift most coverage missed. Under the old Phase II model, a Level 2 contractor would prepare for a C3PAO assessment — often with a consultant beside them, an assessor who walks through the binder with them, a scheduled date circled on the calendar, and months of runway to get the story straight.

A government-led assessment removes every one of those cushions. If you're selected:

• There is no consultant beside you. Nobody is in the room to reframe a weak answer or promise a follow-up memo.
• There is no assessor walking you through your binder. The government reviews what exists. It doesn't help you assemble it.
• There is no negotiated timeline. "Select" means the schedule isn't yours.
• Your self-assessment score is already on record in SPRS. The question isn't "are you compliant?" — it's "does the evidence support what you already attested to?"

This is worth sitting with, because it inverts the instinct most contractors had on July 13. The suspension felt like pressure coming off. For documentation, the pressure went the other direction. A C3PAO assessment was a conversation. A government-led assessment is a records review. And records reviews are won or lost long before anyone shows up.

The Department has been consistent on this point. The security expectation stands. What changed is who verifies it — and "you, with the government checking select work directly" is a model that rewards exactly one thing: documentation that holds up without you in the room.

The Three-Layer Test: Policy → Procedure → Evidence

So what does documentation that holds up actually look like? Every practice — whether it's one of the 15 at Level 1 or the 110 at Level 2 — needs three layers, and most contractors have exactly one of them.

Here's the uncomfortable arithmetic: policies prove intent. Evidence proves operation. Only one of those survives scrutiny — and it's the layer most "completed" self-assessments don't have. What we see constantly in the field is a self-assessment that is, in substance, a spreadsheet of yes/no answers with a folder of downloaded, lightly edited policies behind it. Every "yes" is sincere. Almost none of them can be demonstrated.

That gap was survivable when nobody was checking. It is not the posture you want to hold while "select government-led assessments" is the enforcement mechanism of record.

What a Government Assessor Actually Asks For

The single best way to pressure-test your own documentation is to hear the difference between the question contractors prepare for and the question assessors actually ask.

Notice what the second question does. It doesn't ask about your rules — it asks for dated, recurring operational records. It assumes the policy exists and skips straight to whether it runs. Four quarterly reviews means a year of demonstrated operation. You cannot produce that record retroactively, and an assessor knows it — which is exactly why it's the question.

Across the practices, the same pattern repeats. These are the recurring operational records that most small contractors never generate — not because they're hard, but because nobody told them these are the compliance:

Why last year's screenshot doesn't count

A common objection: "I have evidence — I screenshotted our settings when we set everything up." That's a start, but a single capture from last year proves one thing: that the control existed on one day. Ongoing evidence has three properties that a setup-day screenshot doesn't:

• Dated — every record carries the date it was produced, so operation can be placed on a timeline.
• Recurring — the record repeats at the cadence your procedure names. One review is an event; four quarterly reviews are a practice.
• Attributable — the record shows who performed the action and who approved it. Anonymous evidence is weak evidence.

Dated, recurring, attributable. If a record has all three, it survives scrutiny without you. If it's missing any of them, it's a supporting detail, not proof.

The Fix Isn't More Effort. It's Structure.

Here's the good news buried in all of this: the evidence layer is not technically difficult. A quarterly access review takes minutes. A disposal log takes one line per device. Training records generate themselves if the training is tracked. The reason most contractors don't have these records isn't capability — it's that nobody defined what to collect, how often, and where it goes.

That's the exact problem the Evidence Locker in our Turnkey L1 Package was built to solve. Every one of the 142 artifacts across the 15 Level 1 practices is defined in advance — what the record is, what cadence it recurs on, and what "done" looks like — so evidence lands in an organized structure as you operate, instead of being reconstructed in a panic later. Everything is date-stamped, current, and exportable: if a request ever comes, your documentation walks into that room organized, and it walks in alone with confidence.

The same discipline runs through the L2 CUI Enclave Package for contractors handling CUI: 110 practices mapped to 182 defined artifacts, with a pre-filled SSP, POAM framework, Risk Register, and an evidence checklist that tells you exactly which recurring records your enclave needs to generate — implementable part-time, with no Active Directory, no SIEM, and no enterprise IT.

Will You Actually Be Selected? An Honest Answer.

We'd be doing exactly what we criticize in others if we ended this piece implying a government assessor is on their way to your office. So here's the straight version:

And that's the real point of the three words everyone skipped. They aren't a threat. They're a clarification of what kind of compliance the interim period rewards: not attested compliance, demonstrated compliance. The contractors who internalize that now — while their competitors are still celebrating the end of audits that didn't actually end — are the ones whose documentation will be an asset instead of a liability, in every scenario the Task Force could produce.

The Bottom Line

The Department suspended the third-party audit. It kept assessment — and named itself the assessor. In that model, your documentation doesn't get a spokesperson, a coach, or a scheduled date to be ready by. It stands alone, whenever it's asked to.

Policies prove intent. Evidence proves operation. Build the layer that survives the room.