CMMC readiness, including what to do now that Phase 2 is suspended.
End-to-end support for defense contractors handling Federal Contract Information (FCI) or Controlled Unclassified Information (CUI). Our team worked on the CMMC standard at the Department of Defense in 2019.
- — A prime is still flowing CMMC requirements down to you regardless of the suspension.
- — Your SPRS score was aspirational, on the theory an assessor would eventually force the work.
- — You paused everything when Phase 2 was suspended and are unsure what still applies.
- — You need to know which clauses in your contract actually survived the suspension.
Level 1, 2, and 3 Certification
On July 13, 2026 the Department of War CIO suspended the CMMC Phase 2 transition and held all pending CMMC implementation milestones in abeyance pending a 60-day review. During the suspension, program managers may designate only Level 1 (Self) or Level 2 (Self) assessments, not Level 2 (C3PAO) or Level 3 (DIBCAC), and solicitations carrying those requirements are being amended to remove them.
What did not change is the part that carries actual legal exposure. DFARS 252.204-7012 safeguarding and 72-hour incident reporting remain explicitly in effect. NIST SP 800-171 Rev 2 is still enforced through self-assessment. And False Claims Act liability still attaches to the SPRS score you affirmed — no breach required, no assessor needed. The certification event paused; the obligations did not.
That makes this an unusually good window. The deadline pressure is off, C3PAO scarcity is no longer the binding constraint, and the work can be done properly rather than compressed. We design the compliance architecture, build the technical controls, author the policy library, produce assessor-grade evidence, and train the internal team, so that whatever the reform review produces, you are ready for it rather than reacting to it.
- ✓ Scoping and asset categorization — the decision that drives the whole program cost
- ✓ Gap assessment against all 110 NIST 800-171 Rev 2 requirements, with an honest SPRS score
- ✓ CUI enclave and technical control design and implementation
- ✓ Full policy and procedure library written to assessor standard
- ✓ Evidence pipeline designed as a byproduct of operations, not an assessment-time scramble
- ✓ SPRS score remediation and affirmation support (the live False Claims Act exposure)
- ✓ Readiness review / dress rehearsal, and assessment support when third-party assessment returns
- Case study CMMC Level 2 certification with a perfect 110/110 assessor score for a defense subcontractor
- Case study Zero to CMMC Level 2 certification in six months: greenfield IT buildout for a venture-backed startup
All engagements are anonymized. We do not publish client names.
- CMMC Level 2: what it actually costs — engagement, tools, C3PAO assessment, and year 2
- CMMC Level 2 timeline: what 6 to 9 months actually looks like
- CMMC Phase 2 is suspended: what the July 13 memos actually say — and what still binds you
- CMMC self-assessment vs C3PAO: which path applies, and when it matters
Start with a scoping conversation.
No obligation and no pitch deck. We will tell you what the engagement actually involves, what it depends on, and whether we are the right firm for it — including when we are not.