The twelve actions, honestly rated

Remove November 2026/2027/2028 certification assumptions from operating plans until revised guidance is issued, while continuing funded remediation and evidence development.

Map FCI, CUI, CDI and export-controlled information to contracts, systems, users, suppliers and services. Distinguish clause applicability from generalized data sensitivity.

Reconcile the posted score to the current SSP, scoring methodology, objective-level evidence, POA&Ms and system boundary. Correct unsupported claims through the appropriate process.

Keep the asset inventory, network diagram, SSP, policies, procedures, technical artifacts, interview owners and evidence current even while third-party designations are suspended.

Validate the exact offering's authorization or equivalency, incident terms, forensic access, shared-responsibility matrix, assessment treatment, source allowability and export-personnel model.

Maintain an AIBOM/SBOM covering models, APIs, hosting platforms, agents, libraries, data sources, routing services, embedded integrations, subprocessors and downstream consumers.

Require contract, program, supply-chain and legal review before a new AI or ICT source enters a defense workflow. Do not treat FedRAMP or CMMC eligibility as approval for every contract.

Confirm scope with the contracting officer; preserve incident and audit evidence; export only authorized records; revoke keys; validate retention and deletion; reassess the replacement; document cost and schedule effects.

Use modular integrations, controlled prompt and configuration repositories, portable test suites and multi-vendor contingency plans so a source restriction does not become an operational outage.

Require scope confirmation, control-owner attestation, evidence review, legal/compliance review and documented exceptions before an affirming official submits an annual statement.

Maintain Rev. 2 compliance as the contractual baseline while mapping Revision 3 families, organization-defined parameters and supply-chain requirements for planned uplift.

Track post-review CMMC guidance, the final disposition of the FAR CUI proposal, and any source-restriction direction. Update contract playbooks only when official text or direction changes.