DIBCAC comes up constantly in conversations about CMMC and DFARS 7012 enforcement, usually as a name attached to a warning: a DIBCAC review found a mismatch, a DIBCAC review triggered a False Claims Act referral. What rarely comes with it is an explanation of what a DIBCAC review actually is, who conducts it, or what happens during one. That gap makes the whole thing feel more mysterious than it needs to be. 

What DIBCAC Is 

The Defense Industrial Base Cybersecurity Assessment Center, DIBCAC, operates under the Defense Contract Management Agency and is responsible for conducting the government’s own Medium and High NIST SP 800-171 assessments, the two tiers above the Basic Assessment most contractors self-conduct and self-report to SPRS. A Basic Assessment is exactly that: a contractor evaluates its own environment and submits the resulting score. A DIBCAC-conducted Medium or High Assessment is performed by government assessors and carries more weight in SPRS specifically because it isn’t self-reported. The two aren’t separate systems; a DIBCAC review is often the mechanism that checks whether a contractor’s own Basic Assessment score holds up. 

What Triggers a Review 

There’s no single trigger, which is part of why the possibility of a review is worth planning for rather than reacting to. A contracting officer can request one as part of a specific procurement. DCMA runs its own audit cycles independent of any single contract. A whistleblower complaint under the False Claims Act can prompt DOJ to request one directly. And in some cases, a self-reported score that looks statistically unlikely for a company of a given size or history draws attention on its own, a suspiciously perfect 110 being the most common example. 

What Happens During a Review 

A DIBCAC review isn’t a single-day audit. Assessors request documentation, primarily the System Security Plan and Plan of Action and Milestones, along with evidence supporting specific controls: configuration exports, access logs, policy documents, interview notes with the people who actually run the systems in question. That evidence gets compared directly against what the contractor self-reported in SPRS. The process typically runs over several weeks, not a single site visit, and a contractor with disorganized or outdated documentation feels that timeline stretch considerably, since assessors will simply keep asking for evidence that should have been ready from the start. 

What a Mismatch Means 

A DIBCAC review produces a pass/fail outcome on the specific controls examined, not a percentage grade or a list of suggestions. Where the review turns up a real mismatch, a control claimed as fully implemented that isn’t, a POA&M item marked resolved with no evidence behind it, that mismatch is not treated as an administrative correction. Submitting an inaccurate score to the government is a false statement under the False Claims Act, independent of whether the inaccuracy was intentional, and DOJ has referred and settled multiple cases against defense contractors this year on exactly that basis. 

Preparing Before a Review Ever Happens 

The organizations that get through a DIBCAC review without incident are rarely the ones scrambling to assemble evidence after a request letter arrives. A pre-assessment readiness review, walking through the same documentation and evidence a DIBCAC assessor would actually ask for, before anyone asks for it, is the difference between a review that confirms what’s already true and one that turns into a weeks-long fire drill. 

  • Could you produce evidence for any single control on your SSP within a day of being asked, not just point to the SSP itself? 
  • Does every closed POA&M item have a documented artifact behind it, or just a status change? 
  • If your current SPRS score were being verified tomorrow, who on your team would actually be able to walk an assessor through it? 

Common Questions About DIBCAC Reviews 

Is a DIBCAC review the same as CMMC certification? No. A DIBCAC review is a government-conducted verification under the existing DFARS 7012 self-attestation system, independent of the third-party CMMC certification program. A DIBCAC review can happen whether or not a contractor has pursued CMMC certification at all. 

How much advance notice do you get before a review? Notice periods vary by trigger and aren’t standardized publicly; the practical takeaway is that documentation and evidence need to be current on an ongoing basis, not assembled reactively once notice arrives. 

What’s the practical difference between a Medium and a High Assessment? Both are government-conducted rather than self-reported; a High Assessment generally involves more extensive on-site verification and technical testing than a Medium Assessment, reflecting a higher assurance requirement for certain contracts. 

Can a contractor request a review voluntarily? Contractors don’t typically initiate a DIBCAC review themselves; the closest equivalent is a third-party or internal pre-assessment readiness review, built to mirror what a DIBCAC review would actually check. 

Contact us to schedule a scoping call, or read the full readiness guide for a practical framework covering every stage from scoping through ongoing monitoring.