The letter usually arrives from someone in supply chain, cites a DFARS clause number, and asks for a score by a date that feels close. The instinct is either to ignore it until it is repeated or to reply immediately with something reassuring. Both are expensive.
Day one: read what they actually asked
- Which clauses are cited? DFARS 252.204-7012 concerns safeguarding and incident reporting; -7019 and -7020 concern the assessment and its submission; -7021 concerns the CMMC requirement itself.
- Which level did they name — 1 or 2? If they did not name one, that is your first question back.
- What is the date, and is it a contract condition or a survey? These are very different letters wearing the same clothes.
- Does it apply to work you already do, or to a program you are bidding? The second gives you more room.
Day two: find out whether CUI is really here
Search your mail and file shares for the markings. Ask whoever receives drawings which customer packages carry distribution statements. This determination sets everything downstream, and getting it wrong in either direction is costly — over-scoping buys you an assessment you did not need, under-scoping buys you an affirmation you cannot defend.
Day three: get a real number
Score yourself against the 110 requirements using the official weights. Expect it to be negative. That is not a reason to delay the reply; it is the content of the reply.
What primes want is not a perfect supplier. It is a supplier who knows their own number and has a dated plan — because that is what the prime has to report upward about you.
Day four: reply like a professional
A good response is three short paragraphs: what information you hold and therefore which level applies, your current self-assessed score with the date it was taken, and the dated milestones for closing the gaps. Attach nothing you cannot evidence. Ask them, plainly, whether the contract will require a certification assessment and by when — the answer changes your timeline more than anything you control.
If the honest version of that letter is uncomfortable to write, that discomfort is the actual signal. It is far cheaper to be early and behind than late and surprised.