Finish Before the Report: The L1 + L2 Sprint That's Right in Every Outcome

By Rob Maupin, founder of Overwatch Tools and author of the CMMC Practical Guides series — Book 1 · CMMC Level 1 and Book 2 · CMMC Level 2

Sometime around the middle of September, the CMMC Reform Task Force delivers its findings.

We don't know what those findings will say. We're not going to guess, and we'd be careful with anyone who does. The Department of War suspended Phase II on July 13 and put a review in motion; officials were explicit that a range of outcomes remained on the table, up to and including significant changes to the program itself. Everything past that is speculation dressed up as insight.

So this piece isn't a prediction. It's a schedule.

Because there's a version of mid-September where you're refreshing the news with a knot in your stomach, and there's a version where you read the headline over coffee, note what changed, and go back to work — because your self-assessment is already finished, packaged, and dated. The difference between those two versions of you is roughly three weeks of mapped work that you could start on Monday.

What We Actually Know

Strip out the speculation and a short list of facts survives every scenario:

• DFARS 252.204-7012 is contract law, not a CMMC artifact. It predates CMMC and it outlives any decision the Task Force makes. If you handle covered defense information, you are contractually obligated to safeguard it today.
• NIST SP 800-171 is the standard the Department said it will enforce during the interim. Work you do against 800-171 is not work you do against a program that might be reorganized.
• Phase I self-assessment requirements remain firmly in place — at Level 1 and Level 2 both. What Phase II would have added for CUI handlers is what got suspended.
• Primes are still gating awards. Your subcontract's flow-down language is an agreement between you and your prime. A Department rollout phase going into abeyance doesn't amend it.
• "Select government-led assessments" continue. If you're one of the selected, your documentation is the only thing in the room.

That argument is a year old in this series and it hasn't needed revision. What's new is that you've now watched the entire method get built.

The Sprint Is Realistic Because It's Mapped

"Finish your self-assessment in three weeks" is an absurd thing to say to someone staring at a blank page. It's a reasonable thing to say to someone holding a map. Over the last five pieces, that's what this series has been handing over — piece by piece, the shapeless thing got a shape.

1. MP1 — Start While It's Quiet. The first 30 minutes: run the free gap assessment, get a prioritized roadmap, and replace the blank page with a starting point.
2. MP2 — The Map, Unfolded. Fifteen practices decomposed into 142 checkable artifacts across policy, procedure, and evidence. Ambiguity, not volume, is what burns the hours.
3. MP3 — The Settings Are the Evidence. Device and network configuration guides: what to change on a Windows laptop, a phone, a router — and how the screenshot becomes the proof.
4. MP4 — From Folder Chaos to a Date-Stamped Package. What "done" actually looks like: organized evidence, a system description, MET/NOT MET recorded against every practice, and an affirmation filed in the Supplier Performance Risk System (SPRS).
5. MP5 — A Small Enclave Beats a Big Migration. For CUI handlers: shrink the boundary instead of hardening the company. 110 practices against a contained scope, with time estimates on every task.

Read end to end, those five pieces are the whole method. Nothing is being withheld for the sales call. The reason a sprint is possible in the weeks that remain is that none of the weeks get spent deciding what to do — which is where DIY implementations historically lose a month before writing a single policy.

The Sprint Calendar

Here's what the remaining window looks like laid out against a calendar, starting from the week this publishes. Level 1 on top, the Level 2 track running alongside it.

If You Handle CUI, the Sprint Starts With a Decision, Not a Build

Level 2 doesn't compress the way Level 1 does, and we're not going to pretend otherwise. But the part of Level 2 that determines everything else is a decision, and a decision fits inside this window comfortably.

That decision is scope. As MP5 laid out, the difference between a Level 2 effort that a small business can carry and one that eats a year is whether Controlled Unclassified Information lives in a dedicated enclave or is scattered across the whole company. Draw the boundary small and 110 practices apply to a contained environment. Skip that step and they apply to everything you own — including systems that never needed to be in scope, which is where most wasted Level 2 spending goes.

What fits in the weeks between now and the report:

• The scoping decision. Where CUI actually enters your business, who touches it, and what the smallest defensible boundary around it looks like.
• The platform variant choice. Microsoft 365 GCC High or Google Workspace — each with its own dedicated enclave configuration guides.
• The device decision. Which dedicated CUI-only machines the enclave runs on. We supply the configuration guides; you supply and configure the hardware.
• The build, started. Working from a pre-filled System Security Plan, a POAM framework, a Risk Register, and an evidence checklist — with a time estimate attached to every task so the work schedules against evenings and slow afternoons instead of demanding a dedicated project team.

Which Sprint Is Yours?

Three honest lanes. Most readers of this series are in the first one.

If You Need Both

Some contractors carry FCI on one contract line and CUI on another. For those businesses, the two packages stack.

Waiting Is a Choice, and It Has a Price

We'll say this once and calmly, because the alternative is the kind of manufactured panic this series was written against.

Nothing bad happens to you on September 15 if you haven't started. There's no penalty attached to that date and no assessor on a plane. What happens is quieter: the awards being gated on compliance right now go to somebody else. Primes are still asking. Solicitations are still asking. Roughly half your competition read the July announcement as permission to stop, and they will spend the autumn re-reading it while you're bidding with a finished package.

There's a cost angle worth being precise about, too. In its July 13 analysis, the Small Business Administration put total compliance costs at as much as ~$388,600 for firms eligible for self-assessment and as much as ~$593,800 for firms requiring third-party assessment. Those are upper-bound total compliance costs — remediation, tooling, platform migration, documentation, and internal labor — not assessment fees, and not typical invoices.

The number that matters for you is the first one, and here's what's actually inside it: labor and rework. Evenings. Documentation written three times because nobody knew what "done" looked like. Systems hardened that never belonged in scope. That figure is not the price of compliance — it's the price of compliance without a map. Structure is what collapses it, which is the argument this entire series has been making in six installments.

What Happens After the Report

Two things, and we'll commit to both now.

We'll publish our read either way. Whatever the Task Force delivers — streamlined program, replacement framework, cancellation, or something nobody's predicting — we'll write the plain-English version of what actually changed and what it means for a 20-person shop, exactly as we did on July 14. If the news is inconvenient for what we sell, we'll say so.

Your package doesn't expire when the news changes. A finished self-assessment is a description of how your business protects federal data, backed by evidence that the controls run. That artifact answers a prime's questionnaire, satisfies DFARS 252.204-7012, supports a government-led assessment, and maps cleanly onto whatever the program becomes — because it was built against NIST SP 800-171, not against a rollout schedule. Programs get restructured. Documented security posture doesn't stop being documented security posture.

The Map Exists. The Only Variable Left Is Whether You Walk It

Six pieces ago this series started with a specific reader: someone who agreed the self-assessment mattered and hadn't started, because the work had no shape. The shape has now been drawn in public — the starting point, the artifact map, the configuration layer, the finished package, the enclave.

What's left isn't information. It's a calendar with three or four weeks on it and a decision about whether this is the month.

Mid-September is coming either way. The only thing you control is what you're holding when it gets here.