CMMC 2.0 is live: what the November 2026 deadline actually means for your contracts
The rule took effect on November 10, 2025. Phase 2 brings the C3PAO certification requirement for CUI — here is what to do with the months you have left.
Compliance & defense-security briefings
Insights
Notes from the readiness work — CMMC 2.0, NIST SP 800-171, ITAR, and CUI enclave design, written for the engineers, compliance leads, and program managers who actually have to stand the controls up. No hype, no acronym soup for its own sake.
GCC High or bust? Designing an ITAR-compliant CUI enclave
Why GCC High became the default for ITAR technical data, when the §120.54 encryption carve-out is a real alternative, and the scoping mistakes that quietly widen your boundary.
SPRS scoring explained: how to calculate your NIST SP 800-171 score
The DoD Assessment Methodology, why a control can cost you 3 or 5 points, and how a POA&M affects the number your prime sees.
SSP and POA&M: the two documents every assessor asks for
What a System Security Plan has to prove, how the POA&M is supposed to be used, and the gaps that turn a document review into a finding.
Flow-down: what primes actually require from their subcontractors
DFARS 252.204-7012 and the CMMC clause do not stop at the prime. Where the obligations pass through, and how to answer the questionnaire honestly.
Level 2 assessment day: what a C3PAO actually checks
Walkthroughs, interviews, and evidence sampling across all 110 controls. What "MET / NOT MET / NOT APPLICABLE" means and how to prepare your team.
Reading is not readiness
Turn the briefing into a plan.
A readiness assessment tells you where you actually stand against NIST SP 800-171 and what it will take to reach the level your contracts require. We prepare and remediate; we do not certify.
Request a Readiness Assessment →