Straight answers to CMMC questions

Yes. DoD suspended Phase 2 (third-party certification rollout) on July 13, 2026 while it reviews the program. Phase 1 remains fully in force: Level 1 and Level 2 self-assessments in new solicitations, SPRS scores, and annual affirmations. NIST SP 800-171 obligations under DFARS 252.204-7012 never paused.

Usually one of three things: they want your SPRS score on file, they need you to self-assess at Level 1 or 2 under a flow-down, or they are getting ahead of future certification requirements. We help you find out exactly which, then meet it — nothing more, nothing less.

Level 1 if you only handle Federal Contract Information (basic contract data). Level 2 if you receive Controlled Unclassified Information — controlled drawings, specs, and technical data. Most companies making DoD parts or assemblies handle CUI and need Level 2.

If a prime sends you controlled technical data — drawings marked with distribution statements, export-control markings, or CUI banners — yes. Even unmarked technical data can qualify. This determination drives your whole scope, so we make it carefully during intake.

The Supplier Performance Risk System score is your NIST SP 800-171 self-assessment result, from -203 to 110, posted to a DoD system. Contracting officers and your primes can check it. A missing or stale score is a red flag that costs suppliers work.

Typically 3–9 months depending on starting point, company size, and how much CUI scoping we can tighten with an enclave. The site walk and gap snapshot in week one give you a real timeline, not a guess.

It depends on gap size and scope. An enclave approach often cuts cost dramatically by shrinking what has to comply. We publish honest cost breakdowns on the blog, and your gap snapshot comes with a fixed work plan — no open-ended billing surprises.

Machines in scope need protection appropriate to what they are. Legacy controllers that cannot run modern tools are handled with segmentation, restricted access, and compensating controls — documented properly in your SSP. Nobody is installing an agent on your 1998 controller.

For Level 1, generally yes. For Level 2 with CUI, it depends on your data and contracts — some organizations need GCC High, many can architect around commercial M365 plus an enclave. We assess before anyone pays for a migration they may not need.

Annual affirmations are certifications to the government. Inaccurate ones carry False Claims Act exposure, and enforcement on cybersecurity representations is active. This is why we collect evidence continuously — every affirmation you sign should be supportable on demand.

No — and be wary of anyone who says they can. When third-party assessment applies, it is done by an independent authorized assessor. We do everything before and after: implement, prepare, maintain, and support.

Monitoring across endpoints, identity, and network; drift and incident alerts; patch and firmware cadence; evidence collection; annual self-assessment and affirmation prep; and a support desk with SLAs — all visible in your portal.

Great — he gets a portal login too. We handle the compliance layer and heavy lifting; he keeps doing what he does, with our monitoring and documentation behind him. Most shop IT folks are relieved, not threatened.

A physical walkthrough of your facility: every workstation, server, controller, network device, and door lock. Compliance built on an inaccurate inventory fails assessments and audits. We start from what is actually in your environment.