For defense contractors, receiving a Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) assessment notification can raise immediate questions. What will assessors review? How much evidence will they request? What happens if they identify gaps? And how will the results affect your Supplier Performance Risk System (SPRS) score?
Unlike a self-assessment, a DIBCAC assessment involves government assessors independently evaluating an organization’s implementation of NIST SP 800-171 security requirements.
During CyberSheath’s October 2026 webinar, No Tricks, No Treats, Just the Facts: DIBCAC Assessments, Andrew Zoppi, Sr. Director of Compliance Operations, drew on his firsthand assessment experience to explain what contractors can expect and how to prepare.
Here’s what defense contractors need to know.
What Is a DIBCAC Assessment?
The Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) operates within the Defense Contract Management Agency (DCMA) and conducts government-led cybersecurity assessments of defense contractors.
These assessments evaluate how organizations implement applicable NIST SP 800-171 security requirements and provide the Department of Defense (DOD) with greater confidence in contractors’ reported cybersecurity posture.
Under the DFARS 252.204-7019 and 252.204-7020 assessment framework, contractors may be subject to government review of their implementation of the security requirements associated with DFARS 252.204-7012.
The purpose is to determine whether the security measures an organization reports are supported by its documentation, technical configurations, and actual operating practices.
An assessment can identify discrepancies between a contractor’s reported SPRS score and the controls that can be independently verified.
DIBCAC Medium vs. High Assessments: What’s the Difference?
DIBCAC Medium and High assessments differ primarily in how thoroughly assessors verify a contractor’s cybersecurity implementation.
Medium Assessment
A Medium assessment primarily involves reviewing documentation and information provided by the contractor.
Assessors may examine:
- The System Security Plan (SSP) and documented system boundary.
- Policies and procedures supporting NIST SP 800-171 requirements.
- Supporting evidence and shared responsibility documentation.
- Explanations of how security controls are implemented.
The resulting assessment provides a medium level of confidence in the organization’s implementation of applicable security requirements.
High Assessment
A High assessment involves a more comprehensive examination of the organization’s cybersecurity environment.
In addition to reviewing documentation, assessors may interview personnel, observe processes, and require technical demonstrations.
For example, if an SSP states that a system automatically locks after a specified period of inactivity, an assessor may ask an administrator to demonstrate that configuration.
The distinction matters because a control that appears satisfactory in documentation may not operate as described when tested.
High assessments provide a greater level of confidence because they include direct verification of implementation.
What Happens During a DIBCAC Assessment?
While individual engagements may vary, Andrew outlined several stages contractors can generally expect.
Assessment Notification and Initial Evidence Requests
DIBCAC initiates the assessment process by contacting the contractor and requesting information about its cybersecurity environment.
Initial requests may include the SSP, supporting documentation, system details, and evidence associated with NIST SP 800-171 requirements.
Contractors may be asked to complete an assessment workbook and securely submit requested materials.
An important first step is ensuring the notification reaches the individuals responsible for cybersecurity and compliance. Andrew described situations where notifications initially reached business contacts who did not promptly route them to the appropriate team.
Delays at this stage can reduce the time available to organize evidence and coordinate internal resources.
Opening Briefing and Control Review
Assessors typically conduct an opening briefing to establish the assessment process, expectations, and schedule.
The team then works through applicable security requirements and assessment objectives.
The NIST SP 800-171 Rev. 2 framework contains 110 security requirements, with 320 associated assessment objectives identified in NIST SP 800-171A Rev. 2.
Contractors need to account for the individual objectives associated with each requirement. Satisfying the general intent of a requirement does not necessarily establish that every assessment objective has been met.
Interviews, Evidence Review, and Technical Demonstrations
Assessors may request additional documentation, interview personnel, and ask administrators to demonstrate how security controls operate.
This can include examining identity and access management configurations, reviewing audit logs, validating multifactor authentication, or checking whether documented security settings are enforced.
Consistency is critical.
If an SSP describes one configuration, a policy requires another, and the administrator demonstrates something different, assessors may identify a discrepancy.
Organizations should ensure the people participating in the assessment understand their responsibilities and can explain how the relevant controls operate.
Daily Readouts and Outstanding Evidence
During an assessment, the government team may provide daily updates identifying controls that have been satisfied, remain under review, or require additional evidence.
Andrew described how contractors sometimes need to retrieve documentation after an assessment session and submit it for subsequent review.
Having a centralized evidence repository, clearly assigned control owners, and personnel available to answer follow-up questions can make this process more manageable.
Contractors should also avoid rushing to provide an answer when clarification is needed. An accurate response supported by evidence is more useful than an immediate response that later needs to be corrected.
Final Findings and SPRS Results
At the conclusion of the assessment, the DIBCAC team reviews its findings and communicates identified deficiencies.
Contractors may have opportunities to provide additional information or challenge findings through the applicable assessment process.
Final assessment results can affect the organization’s recorded cybersecurity assessment information in SPRS.
Identified gaps may also require documented remediation activities, with deadlines and follow-up requirements determined by the applicable contractual and assessment framework.
Understanding these obligations before an assessment begins helps organizations prepare for both the evaluation and any necessary corrective action.
What Do DIBCAC Assessors Look For?
Although assessments examine individual security requirements, several areas deserve particular attention.
An Accurate System Security Plan
An SSP should reflect the organization’s actual cybersecurity environment.
Andrew cautioned against documenting planned implementations as though they were already operational.
Assessors need to understand which systems are included in the assessment boundary, how requirements are implemented, and who is responsible for maintaining the relevant controls.
An SSP that no longer reflects the environment can create findings even when substantial cybersecurity work has already been completed.
A Clearly Defined CUI Boundary
Contractors must understand where Controlled Unclassified Information (CUI) is stored, processed, and transmitted.
That requires examining more than the primary file storage location.
Email, collaboration platforms, endpoints, connected systems, external service providers, and physical handling processes may all affect the scope of an organization’s cybersecurity obligations.
Consider a contractor that establishes a dedicated CUI enclave but later begins receiving CUI through an employee’s commercial email account outside that boundary. The documented scope may no longer reflect the actual flow of information. Identifying these situations before an assessment is essential.
Evidence That Controls Are Operating
Policies and procedures establish expectations, but assessors may also need evidence that required security measures are functioning.
Depending on the requirement, evidence could include system configurations, access reviews, vulnerability scan results, patching records, audit logs, incident response exercises, or other records.
Andrew emphasized the importance of maintaining dated evidence and updating it regularly.
When an assessor requests proof of implementation, contractors should be able to retrieve relevant records without reconstructing their compliance history.
Alignment Between Documentation and Implementation
Security documentation needs to evolve alongside the technical environment.
A firewall replacement, new cloud service, revised access policy, or change in identity management can affect how a control is implemented.
Even when the replacement technology provides comparable security capabilities, its settings and operational procedures may differ.
Contractors should validate those differences and update their SSPs, policies, and supporting evidence accordingly.
DIBCAC vs. C3PAO Assessments
DIBCAC assessments and CMMC assessments conducted by Certified Third-Party Assessment Organizations (C3PAOs) share important technical foundations, but they serve different purposes.
DIBCAC assessments provide government-led evaluation and confidence in contractor implementation of applicable cybersecurity requirements.
C3PAOs are authorized third-party organizations that conduct CMMC assessments under the program’s certification framework.
A contractor cannot request a DIBCAC assessment as a substitute for selecting and engaging a C3PAO.
Likewise, contractors should not assume that a new DIBCAC High assessment automatically satisfies CMMC Level 2 third-party certification requirements.
Andrew emphasized that organizations should prepare against the underlying security requirements rather than rely on one assessment process replacing another.
A well-maintained cybersecurity program supports readiness for either type of evaluation.
How to Prepare for a DIBCAC Assessment
Contractors can begin strengthening assessment readiness well before receiving a government notification.
- Validate your CUI scope. Trace how CUI enters the organization, where it travels, who accesses it, and which systems and service providers are involved.
- Review your SSP. Confirm that documented boundaries, technologies, responsibilities, and control implementations reflect the current environment.
- Assess against individual objectives. Review applicable NIST SP 800-171A assessment objectives and verify that each is supported by implementation and evidence.
- Organize supporting evidence. Maintain a secure, accessible repository with dated records that demonstrate how controls operate.
- Validate your SPRS score. Ensure reported assessment information reflects the applicable assessment scope and actual implementation status.
- Maintain actionable POAMs. Identify deficiencies, assign responsible owners, establish remediation milestones, and track progress.
- Reassess after significant changes. Acquisitions, new facilities, technology replacements, organizational changes, and changes in CUI handling should trigger reviews of relevant compliance documentation and controls.
Andrew also recommends conducting regular internal reviews rather than waiting for an assessment notification.
These activities help organizations identify discrepancies while they still have time to investigate and address them.
Frequently Asked Questions About DIBCAC Assessments
What triggers a DIBCAC assessment?
DIBCAC assessments are initiated by the government rather than requested by contractors. Selection can involve government assessment priorities and concerns about a contractor’s cybersecurity implementation. Contractors should maintain assessment readiness because they generally cannot determine when DIBCAC will initiate a review.
What is the difference between a DIBCAC Medium and High assessment?
A DIBCAC Medium assessment primarily evaluates documentation and supporting information to provide a medium level of confidence in a contractor’s cybersecurity implementation. A High assessment involves more extensive verification, including interviews, examination of evidence, and technical demonstrations to determine whether security controls operate as documented.
Can a DIBCAC High assessment replace a CMMC Level 2 certification?
A new DIBCAC High assessment does not automatically replace a CMMC Level 2 certification assessment conducted by a C3PAO. Although both evaluate related NIST SP 800-171 security requirements, they operate under different assessment frameworks. Contractors should evaluate their applicable contractual obligations rather than assume one assessment satisfies the other.
What evidence should contractors prepare for a DIBCAC assessment?
Contractors should prepare an accurate System Security Plan, supporting policies and procedures, system inventories, access control records, security configurations, vulnerability scan results, audit logs, and other evidence relevant to applicable NIST SP 800-171 assessment objectives. Evidence should demonstrate how controls are implemented and maintained.
What happens if a contractor fails to meet requirements during a DIBCAC assessment?
DIBCAC may identify deficiencies that affect the contractor’s recorded assessment results in SPRS. The organization may need to document corrective actions, establish remediation milestones, and provide additional evidence or undergo follow-up review. Specific consequences depend on the assessment findings and applicable contractual requirements.
Make Assessment Readiness Part of Your Cybersecurity Program
DIBCAC assessments examine whether contractors can substantiate their cybersecurity representations through documentation, evidence, and operational implementation.
Preparing effectively requires coordination across IT, security, compliance, leadership, and the business functions that handle CUI.
Organizations that maintain accurate SSPs, validate their controls, document remediation efforts, and regularly review their SPRS submissions are better positioned to respond when government assessors request evidence.
CyberSheath helps defense contractors implement and maintain cybersecurity and compliance programs aligned with DFARS, NIST SP 800-171, and CMMC requirements.
Want to learn more about the DIBCAC assessment process? Watch our on-demand webinar, No Tricks, No Treats, Just the Facts: DIBCAC Assessments, featuring Andrew Zoppi, Sr. Director of Compliance Operations at CyberSheath.