How the DIBCAC Assessment Works: Selection, Notification, and Execution of the Government's CMMC and NIST SP 800-171 Assessments

A Growing Assessment Center

DIBCAC operates within the Defense Contract Management Agency. When DCMA established the center in 2019, it opened with 42 employees. By August 2024 the agency described a center of approximately 135 personnel, and the FY2027 budget documentation shows the trajectory continuing.

How Selection Concentrates

Exposure begins with the contract. DFARS 252.204-7012 obligates a contractor handling covered defense information to implement NIST SP 800-171, and DFARS 252.204-7020 requires the contractor to provide access to its facilities, systems, and personnel when the government conducts a Medium or High assessment. Any contractor holding the clause can lawfully be selected, and consent isn't part of the process.

The raw odds are low. Against a Defense Industrial Base of approximately 220,000 entities, of which roughly 80,000 handle CUI, DIBCAC's volume runs in the low hundreds of assessments per year, an undifferentiated base rate below one percent. That figure is a ceiling for the population rather than a probability for any particular company, because selection isn't random. A capacity measured in hundreds can't be spent randomly across a population measured in tens of thousands and still produce useful oversight, so selection concentrates where program criticality, CUI volume, and supply chain position intersect.

The Notification Starts a Clock

No official template of a DIBCAC notification letter is published, and the pattern practitioners report reflects the accounts of assessed contractors rather than a government publication. The notification generally arrives as official DCMA correspondence, commonly by email to an executive or point of contact associated with the company in the System for Award Management. It directs the contractor to acknowledge receipt and designate a technical point of contact within a few business days, and it requests the current SSP, the POA&M, and network architecture diagrams. For Medium Assessments, assessed contractors have described document requests due within roughly one to two business weeks. For High Assessments, reported notice generally runs about 30 days. Because the access requirement is a contract term, the assessment itself isn't negotiable. The variables available to the contractor are scheduling details and the quality of what it produces.

The Evidence, Including the Truth About Log Retention

The full paper catalogs eleven evidence categories assessors consume, from the core documents through configuration baselines, audit logs, external provider documentation, and FIPS 140 validation certificates. It also settles a question that circulates with a wrong answer attached: no fixed number of years of log retention exists in the governing documents. The assessor scores retention against the period the contractor's own SSP defines. The only hard figure in the regime is the 90-day preservation of system images and packet capture data after a cyber incident report, and the six-year figures in industry guidance trace to the False Claims Act limitations period rather than to any log requirement.

How the Assessment Ends

Scoring follows the DoD Assessment Methodology: 110 requirements weighted at five, three, or one point, deducted from a perfect 110 with a floor of negative 203, verified against the assessment objectives in NIST SP 800-171A. The Department posts Medium and High summary scores to SPRS beside the self-reported Basic score, and the government's number is the one contracting officials weigh. Before posting, the contractor receives the score with an opportunity for rebuttal and adjudication, including 14 business days to provide additional evidence. The paper also explains how CMMC Level 3 assessments under 32 CFR part 170 differ from the Medium and High assessments that make up the bulk of DIBCAC's contractor-facing work.

A Test Any Executive Can Run

The paper closes with a one-day self-test. Ask the IT lead or managed service provider for four items within one business day: the current SSP, the POA&M, the network and CUI data flow diagrams, and audit logs covering a recent 30-day window. The request should arrive without advance warning, because a DIBCAC notification arrives the same way. Documents delivered within the day and consistent with the reported SPRS score indicate a company that would meet a real notification on its own terms. Documents that can't be produced at all indicate a reported score resting on implementation the company can't currently evidence, which is precisely the condition a Medium or High Assessment converts into a recorded government score.