CMMC Trigger Events: A Triage Guide for Contractors

Nobody reads a compliance article for entertainment. If you are here, one of the nine CMMC trigger events on this page landed on your desk this week. A questionnaire from your prime. A drawing with a CUI banner on it. An award notice carrying a clause you did not price. An email telling you that an eleven year supply relationship is about to end unless you can produce something you have never heard of.

This page triages all of them. Find your situation in the table, make the first move, then read the article that covers it in full. For the contract language sitting underneath all of it, start with DFARS and FAR Cybersecurity Clauses: What Each One Actually Requires.

Three things hold true across every one of these CMMC trigger events, and they are worth saying before anything else:

• The clock started before you found out. The obligation attached when the contract was signed or when the data arrived, not when somebody noticed.
• The certification audit is suspended. The liability is not. DFARS 252.204-7012, NIST SP 800-171, SPRS reporting and the annual affirmation are all still live.
• What you say in writing is the risk. A wrong answer on a questionnaire or an inflated SPRS score is a False Claims Act problem. The gap itself usually is not.

What changed in July 2026, and what did not

On July 13, 2026, the Department of War suspended the CMMC Phase 2 assessment requirements that were scheduled to take effect on November 10, 2026, and stood up a CMMC Reform Task Force with a 60 day reporting deadline. The suspension covers the certification assessment mechanism for Levels 2 and 3, meaning the C3PAO audit and the DIBCAC led assessment.

It does not touch the underlying obligations. Here is the split, because almost every panicked call starts with somebody getting this wrong:

The practical read is straightforward. You cannot currently be forced to hold a certificate, and you cannot currently obtain one either. Everything that creates legal exposure, meaning the score you posted, the affirmation you signed and the safeguards you claimed, is untouched. The detail on which clause does what is in DFARS 252.204-7019 vs 7020 vs 7021: What Each Clause Triggers.

The nine CMMC trigger events, and the first move for each

These are the nine CMMC trigger events that put a small contractor into an urgent compliance decision. Find yours, make the first move today, then read the full article.

The first 72 hours

All nine CMMC trigger events share the same opening moves. Do them in this order.

1. Establish what you have already said. Pull your SPRS record. Note the score, the assessment date, which must be no more than three years old to be considered for award under 7019, the scope description, and who affirmed it. That record is the government’s version of your security posture, and it is what a prime, a contracting officer or an investigator reads first.
2. Find the clauses. Search your active contracts and subcontracts for 252.204-7012, 7019, 7020, 7021 and FAR 52.204-21. Note which contracts carry them and which do not. Do this before anyone in your company starts talking about our CMMC requirement, because there may not be one.
3. Locate the data. Identify where CUI and FCI live right now. Email, file shares, laptops, the ERP, the shop floor PC running the CAM software, the personal Dropbox somebody set up in 2019. You cannot scope what you have not found. The CUI Scoping Workbook walks this.
4. Hold the line on written statements. Until the first three steps are done, nobody answers a questionnaire, signs an affirmation, updates a score or tells a prime that you are compliant. Written answers are the liability. Three days of quiet are not.
5. Score yourself honestly. A real NIST SP 800-171 self assessment, all 110 requirements, using the DoD scoring methodology. If the number is ugly, that is information rather than a problem. A low posted score is defensible. An inflated one is not.

What you can actually fix in the time you have

The honest version, because urgency makes people buy the wrong thing.

The single biggest lever on all of these is scope. Reducing the number of systems that touch CUI is faster and cheaper than hardening every system you own, and it is the difference between a 90 day answer and a two year program.

Four questions that decide your path out of any of these

1. Do you actually have CUI, or only FCI? FCI puts you at FAR 52.204-21 and fifteen requirements. CUI puts you at DFARS 252.204-7012 and 110. People assume the harder answer and spend accordingly. Check the markings and the contract before you assume. See What is Controlled Unclassified Information (CUI)?
2. Is the requirement contractual or commercial? A clause in your contract is a legal obligation. A prime’s supplier policy is a business relationship. Both can end your revenue, and they are negotiated in completely different ways.
3. Is your CUI in a place that can ever be compliant? Commercial Microsoft 365 was not built to meet the 7012 cloud conditions. If that is where your CUI lives, no amount of policy writing fixes it. The data has to move.
4. Who signs the affirmation? Identify that person now. They are personally attesting, and they should see the score, the plan and the POA&M before their name goes on anything.

The mistakes that turn CMMC trigger events into real problems

• Answering fast to look responsive. A prime would rather get an accurate answer on Friday than a wrong one on Tuesday.
• Posting a score you cannot document. The score is only as good as the assessment behind it. No worksheet, no defense.
• Assuming the suspension cancelled something. It suspended the audit. Your 7012 obligations, your posted score and your affirmation are unchanged.
• Letting the service provider answer for you. The obligation belongs to the contractor. A provider saying you are covered is not evidence, and it does not transfer liability.
• Deleting CUI you should not have received. Destroying data that arrived in error can turn a paperwork issue into a spoliation issue. Isolate first, then ask the sender in writing.
• Buying a tool before deciding scope. Tooling bought before scoping gets thrown away after scoping.

Next step

Every one of these CMMC trigger events starts from the same place, which is a number you can actually defend. The SPRS Score Calculator walks all 110 NIST SP 800-171 requirements using the DoD scoring methodology and gives you a score with the worksheet behind it. It is free, and nothing you enter leaves your browser.

If you already have a score posted and you are not confident it would survive scrutiny, run the SPRS Score Reality Check instead.