You don't hold a DoD contract yet. You're pursuing one - maybe eyeing a prime's subcontract, maybe planning to bid directly as a prime, maybe watching a solicitation that fits what your shop does. And you've heard you'll eventually need CMMC Level 1. So the question lands: do you get ready now, before you've won anything, or wait until an award is actually in hand?
It's a real strategic question with a non-obvious answer, and most CMMC content ignores it entirely because it assumes you already have the contract. Here's the honest case for preparing early, the honest case for waiting, and how to tell which one is you.
The case for getting ready now
Three forces push toward early preparation, and they're stronger than they first appear.
Whoever you'd contract with increasingly checks posture before they award. If you're chasing a prime's subcontract, flowdown makes the prime responsible for its supply chain's compliance, and the sharper ones have stopped waiting until after selection to find out whether a sub can meet the requirement. "Show us your SPRS status" is creeping earlier into the process - sometimes into the qualification stage, before you're even shortlisted. If you're bidding directly as a prime, the check comes from the other side: SAM registration and a defensible SPRS entry are eligibility conditions for award, not paperwork you sort out afterward. Either way, a shop that can answer "here's our Level 1 self-assessment" while a competitor says "we'd need a few months" has a real edge, and it's an edge that exists precisely at the moment work is being handed out.
The government-portal lead time ambushes first-timers. This is the one nobody warns you about. Before you can submit anything to SPRS, you need an active SAM registration and the right PIEE access - and for a company that's never contracted directly with the government, those can take days to weeks, not minutes. If you plan to hold the contract directly as a prime, this isn't just lead-time friction - an active SAM registration and CAGE code are a hard eligibility gate: no award is possible without them. If you wait until you've won the work to start, the paperwork clock and the "we need your status now" clock are running at the same time, and they're not on your side. Getting the registrations and roles sorted while there's no deadline turns a scramble into a formality.
Ready-when-the-RFQ-lands beats scrambling-after-the-award. The actual Level 1 work - the assessment, closing a couple of gaps, standing up the evidence habit - is a few weekends for most small shops. Doing it calmly, in advance, is a fundamentally different experience than doing it under a signed contract's compliance clause with a delivery schedule already ticking.
The pattern we see most: a shop that prepared early treats their first covered contract as a submission. A shop that waited treats it as an emergency. Same work, very different week.
The honest case for waiting
Preparing early isn't free of downside, and pretending otherwise would be the kind of thing this guide exists to avoid. Two real reasons to hold off:
Your environment will change before the contract lands. If you're a year or more away from realistically winning covered work, and you're about to migrate email platforms, open a second location, or overhaul your network, some of today's assessment work gets redone. Compliance describes your environment as it is; if the environment's about to shift substantially, early prep can mean assessing a setup that won't exist when it matters.
You're not actually sure you're pursuing this work. "It'd be nice to do defense work someday" is not the same as an active pipeline. If DoD contracting is a maybe rather than a plan, the time is better spent on the pipeline than on compliance for contracts you haven't decided to chase. Get the intent solid first; the Level 1 work is fast enough that it won't be your bottleneck.
How to tell which one is you
A quick decision test. Prepare now if two or more of these are true:
- You have an active bid, a named prime, or a specific solicitation you're pursuing in the next 6-12 months.
- Your systems are stable - no major platform migration or facility change coming.
- You've never registered in SAM or used PIEE (meaning the portal lead time will hit you, and it's better to absorb it now).
- You expect to hold the contract directly rather than sub - registrations are a gate, not a delay, and you can't be awarded without them.
- A prime has already asked, or hinted, about your compliance posture - or you're preparing to bid directly and the contracting officer will.
Wait if the work is genuinely hypothetical, or if you're mid-transition on the systems that would be in scope. And if you're somewhere in between - interested, probably pursuing, systems mostly stable - lean toward preparing, because the downside of early prep is small (a few weekends, possibly redone) and the downside of waiting is large (losing a bid, or scrambling under a live clock).
The low-commitment first step
You don't have to decide the whole thing today. The cheapest possible move is to find out where you'd stand if a contract landed tomorrow - which gaps you'd have to close, whether it's a weekend or a bigger lift. That costs you nothing and makes the prepare-or-wait decision concrete instead of abstract. If it turns out you're already in good shape, early prep is trivial and you'd be silly not to. If it turns out you have real gaps, better to learn that with runway than under a deadline. Our free 5-question check is built for exactly this - a two-minute read on your posture before you've committed to anything, contract or compliance work alike.
Where does your shop stand right now?
Five yes/no questions, instant grade, no email required. Know before you're asked.
Take the free 5-question check