Updated September 30, 2026
The letter from your biggest customer says "provide proof of CMMC compliance by Friday." Answer it badly and you slide down their supplier list; answer it well and it takes them one read to check you off. Send one page of facts they can check: which work you're answering for, where that work happens, what you've posted with the government and when, and which contract clause their request relies on. Hold back your security plan, the brochure, and the adjectives.
Some context on why the letter came. The prime is the company that holds the Defense Department contract and buys from you. CMMC is the DoD's cybersecurity program for suppliers, and under a clause called DFARS 252.204-7021 the prime needs your current CMMC status, plus a yearly statement signed by one of your executives, before it can give you the work (7021). Your status lives in SPRS, the DoD's Supplier Performance Risk System. Each assessment you post there gets a 10-character CMMC unique identifier (UID), and the government's contracting officers look statuses up by it (deviation 2026-O0025, Revision 3). A reply that gives the prime that identifier and a date solves their problem.
The reply
Every bracket gets a fact you can prove.
Subject: [Subcontract / PO number] – CMMC status
[Name],
This answers your [date] request for subcontract [number], under which we receive [CUI / FCI only].
That work is performed in our [environment name, e.g. "engineering environment"], which covers CAGE code [code].
Our current status in SPRS is [Final Level 2 (Self) / Conditional Level 2 (Self), score XX of 110], CMMC UID [UID], status date [date]. Our annual affirmation was filed on [date] by [title]. [If Conditional: Our POA&M closes by [date], within the 180-day window.]
Your letter asks for [exact item, e.g. "a Level 2 certificate from a C3PAO by November 10"]. Please point us to the clause or exhibit in our subcontract that requires it, and send any modification issued since the CMMC pause began on July 13, 2026.
[Name, title] will send [specific item] by [date].
[Signature]
What goes in the brackets, if the terms are new:
- CUI / FCI only. CUI (controlled unclassified information) is the drawings, specs, and technical data the government marks sensitive. FCI (federal contract information) is non-public contract details like quantities and delivery dates. If they only send you purchase orders, write "FCI only."
- Environment name. The part of your company the assessment covered, in your own words: "our engineering environment," "the whole company."
- CAGE code. The five-character ID the Defense Logistics Agency assigns your business at its physical address, shown on your SAM.gov registration (DLA).
- Final / Conditional, score. Final means all 110 requirements met. Conditional means a score of 88 or more, with a POA&M (your written plan to close the rest) due within 180 days. How to tell which you have.
- Annual affirmation. The yearly statement your senior official signs in SPRS saying you still meet the requirements.
- C3PAO. An independent firm licensed to issue CMMC certificates. Since July 13, DoD's new contracts ask for a self-assessment instead.
If you don't have an SPRS entry yet, say so in the status paragraph and give the date you'll file. "We will file a Level 2 (Self) assessment by December 15" gets you further than "we're substantially compliant." The second phrase makes a contracts manager nervous. The first gives them a date to write down.
Be exact about what kind of result you have. A mock assessment, a consultant's gap report, and a score from an older NIST self-assessment are all useful, and none of them is a CMMC status. Call each one what it is. Match the scope too. If the assessment covered the engineering environment, the letter says the engineering environment, not "our company." A prime that later finds CUI outside that environment will reread your letter, and so might a lawyer.
Attachments
Most letters need none. If the prime asks for more, such as a full supplier questionnaire, send the smallest thing that answers the question: a one-page scope statement with CAGE codes, a screenshot of the SPRS entry, or a list of POA&M close-out dates. Send the full SSP (system security plan, the document that describes how you protect CUI) only if your signed subcontract requires it, and then through an encrypted channel the two of you agree on. An SSP is a map of your systems and your weaknesses. Treat it like one.
Before it goes out, the person who owns the contract confirms the clause and the ask. The person who owns security confirms the status, UID, date, and scope. Save the sent letter, attachments, approver, and date in the contract file. The next letter will take ten minutes.
Know which kind of ask you're answering before you send it. The government's part during the pause is a Level 1 or Level 2 self-assessment in SPRS that fits what the prime sends you. A certificate is owed only if your signed subcontract says so, or if the prime's own DoD contract still names one and hasn't been modified. Anything else is the prime's preference, and your reply can treat it as one. What a prime can require during the pause →