CMMCpedia
Work with me

Terms / Assessment

DCMA DIBCAC

The Government team that assesses defense contractors directly. It performs Level 3 assessments and the High assessments under DFARS 252.204-7020.

Also called DIBCAC, Defense Industrial Base Cybersecurity Assessment Center.

Official Source Material

DCMA DIBCAC High Assessment means an assessment that is conducted by Government personnel in accordance with NIST SP 800-171A Jun2018 and leveraging specific guidance in the DoD Assessment Methodology that: (i) Consists of: (A) A review of a contractor's Basic Assessment; (B) A thorough document review; (C) Verification, examination, and demonstration of a contractor's system security plan to validate that NIST SP 800-171 R2 security requirements have been implemented as described in the contractor's system security plan; and (D) Discussions with the contractor to obtain additional information or clarification, as needed; and (ii) Results in a confidence level of “High” in the resulting score. (Source: 48 CFR 252.204-7020).

Source: 32 CFR 170.4, eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

This is the Government assessing you directly, rather than a company you hired.

The Defense Industrial Base Cybersecurity Assessment Center sits within the Defense Contract Management Agency. It performs Level 3 certification assessments, and it conducts the Medium and High assessments that DFARS 252.204-7020 obliges you to allow. You do not choose it and you do not pay it.

A High assessment verifies what your plan claims, rather than reading it.

The definition describes a review of your own assessment, a thorough document review, and verification, examination, and demonstration that the requirements are implemented as your system security plan describes. That is the difference from a Basic assessment, which is your own review. A plan that overstates your environment is discovered here.

You owe access, and your contracts with providers must allow it.

The clause requires you to provide access to facilities, systems, and personnel. If your environment is operated by an external service provider, your agreement with that provider needs to permit the same access. Check this before an assessment is scheduled rather than during one.

You can rebut a score before it is posted, and you should read the findings closely.

The clause gives you the summary score and an opportunity for rebuttal and adjudication before it goes into the Supplier Performance Risk System. Compare each finding against your plan and your evidence, and answer in writing where an assessor misread what you implemented.

What falls short

  • An environment that differs from the plan describing it. Verification is the point of a High assessment.
  • A provider agreement that prevents Government access. The clause makes the access your obligation.
  • A rebuttal that argues about the requirement rather than the finding. Answer the objective, and cite the evidence.

Edge cases

  • Your contract names Level 3. This team performs that assessment, after a Level 2 certification assessment by a C3PAO.
  • You hold a Conditional Level 3 status. This team performs the closeout assessment too.
  • A prior Government assessment already covers your system. The CMMC assessments are not meant to duplicate a comparable DoD assessment, except in rare circumstances.

Over-engineering

  • Preparing for a High assessment on a contract that requires a self-assessment. Prepare accurately, and the preparation transfers if the situation changes.
  • A rehearsal assessment run by a consultant before a Government one. Your own evidence against the objectives is what is examined.