CMMC readiness · NIST SP 800-171
Assessment-ready before the assessor calls.
We are CMMC Certified Professionals. We take defense contractors from an unverified SPRS score to a defensible one, and through their C3PAO assessment. We prepare you; we are never your assessor, by design.
CMMC Certified Professional (CCP) · NIST SP 800-171 · DFARS 252.204-7012
- NIST 800-171 practices
- 110NIST 800-171 practices
- Control families
- 14Control families
- CMMC levels
- 3CMMC levels
- Phase 2 suspended
- Jul 13 2026Phase 2 suspended
01 — The situation
What changed, and what didn't
Updated Sep 2026
On July 13, 2026 the Department suspended CMMC Phase 2, which would have required third-party Level 2 certification in new solicitations from November 10, 2026. A Reform Task Force is reviewing the program. Unchanged: DFARS 252.204-7012, NIST SP 800-171, Phase 1 self-assessments, SPRS scores, the annual senior-official affirmation, and your prime flow-downs.
A pause in verification is not a pause in liability. Your SPRS score is still an assertion you have to back with evidence, and your primes are still flowing the requirement down their supply chain.
The contractors who spend this window closing POA&Ms and building real evidence will move fastest when verification returns, in whatever form it takes. That window is the whole argument for starting now.
Read the full CMMC breakdown02 — How we work
Five stages, in order, every time.
- 01
Scope
- 02
Assess
- 03
Remediate
- 04
Rehearse
- 05
Sustain
03 — Who we work with
Small and mid-size contractors
DIB contractors and subcontractors handling FCI or CUI, usually without a full-time compliance function.
Primes raising supply-chain readiness
Programs that need their subcontractors assessment-ready, not just flowed-down to.
Companies entering defense work
Growth-stage firms taking their first contracts that carry CUI obligations.
Start with your scope.
Most cost overruns start with a boundary that was never defined. Tell us what you handle and where it lives, and we will tell you what is actually in scope.
Talk to us