The article
On 13 July 2026 the Pentagon, whose notices now carry the name Department of War, suspended Phase II of CMMC: the third-party assessments due to start on 10 November 2026. If you read that headline and put your preparation on hold, read the memo too. It keeps the self-assessments, the yearly affirmations and the contract clause that requires NIST SP 800-171 safeguards.
I run 26 Lines of Code, a software company of 70+ specialists, and this is how our CMMC compliance services work after the suspension: what applies today, what to prepare, who assesses whom and what the work costs.
CMMC compliance services: the short version
| Question | Answer, as of October 2026 |
|---|---|
| Who needs CMMC | Defense contractors and subcontractors whose contracts carry the CMMC requirement |
| What applies now | Level 1 or Level 2 self-assessments with results in SPRS, and an affirmation by a senior official every year |
| What is suspended | Phase II: contracts may not require Level 2 assessments by a C3PAO or Level 3 assessments by DIBCAC |
| What never paused | DFARS 252.204-7012: NIST SP 800-171 safeguards and cyber incident reports within 72 hours |
| What we do | Scoping, a gap review of your systems against 800-171, the system security plan, the plan of action, controls in your systems and the evidence |
| What we do not do | Assess or certify you; we are not a C3PAO |
| Price | Estimated before work starts; the first call and the rough estimate are free |
What the July suspension changed
The suspension removed the third-party layer for now. During the pause, a contract may only ask for a self-assessment, at Level 1 or at Level 2. Solicitations and contracts that named a Level 2 assessment by a C3PAO, one of the accredited outside assessors, or a Level 3 assessment by DIBCAC, the government's own assessors, are being amended to remove it. A task force had 60 days to recommend changes; as I write in October 2026, the department's CMMC pages still show the program paused in Phase 1.
What stayed in force
Four things did not change:
- Level 1. A self-assessment against the 15 requirements of FAR 52.204-21 every year and an affirmation every year, with no plan of action allowed.
- Level 2 (Self). Every three years your own people score all 110 security requirements that 800-171 lists (revision 2) and enter the score in the Defense Department's SPRS database; a senior official affirms it then and once a year in between.
- the DFARS 7012 clause. The safeguards, and a report of any cyber incident within 72 hours of discovery.
- Government checks. During the pause the department enforces 800-171 through companies' own self-assessments and, for some, assessments it leads itself.
A self-assessment is not a lighter standard. It is the same 110 requirements, scored by your own people and affirmed by one of your company's senior officials, who states that they are implemented and will stay that way.
Of five CMMC service pages Google showed me for this search in October 2026, one mentions the July pause, in a single line of a timeline; none mentions the 72-hour reporting rule, which never paused. Five pages are a small sample, but read any CMMC advice with its date in mind.
Which level you need
The level follows the information you handle, and your contract names it.
| Level | The information | Requirements | Assessed by, as of October 2026 |
|---|---|---|---|
| Level 1 | Federal contract information (FCI) | 15, as FAR 52.204-21 lists them | You, every year, plus a yearly affirmation |
| Level 2 | Controlled unclassified information (CUI) | The 110 of 800-171 (its second revision) | You, every three years, plus a yearly affirmation; C3PAO assessments are suspended |
| Level 3 | CUI in the most sensitive programs | Level 2 plus added requirements | DIBCAC; suspended as a new contract requirement |
FCI is contract information the government does not publish: what it gives you, or what you produce for it, under a contract. CUI is unclassified information that a law, a regulation or a government-wide policy says must be protected or kept to the people who need it. Your contract tells you which you receive; the work starts with finding where it actually lives.
Scope first: which systems hold FCI and CUI
Scoping decides how much of your company has to meet all 110 requirements, so it comes before anything else. The CMMC rule sorts every asset into groups:
- CUI assets hold or handle CUI, and every Level 2 requirement is assessed on them.
- Security protection assets protect them, like the identity system or the log server, and are assessed against the requirements their function touches.
- Contractor risk managed assets could hold CUI but are kept from it by your policies; they are documented, and the assessor reviews how.
- Specialized assets, such as test equipment, factory machines and connected devices, are documented and managed under your own risk policies.
- Out-of-scope assets are separated from CUI, so they can neither hold nor handle it. A laptop that reaches CUI only through a virtual desktop, passing nothing but screen, keyboard and mouse, counts as out of scope.
One way to shrink the scope is an enclave: a smaller, separated environment where CUI lives, so the rest of the company stays outside it.
Your cloud and your IT providers are in scope too
Two kinds of outside help land inside your scope. A cloud service that holds or handles CUI has to be FedRAMP Moderate authorized or meet equivalent requirements, and your side of its customer responsibility matrix goes into your SSP. An IT provider that administers systems holding your CUI or its security data, such as logs and configurations, is assessed within your scope and described in your plan. That includes us, whenever our engineers run such systems for you.
One more question belongs at the very start. Our delivery team works from Europe, so before anyone outside the United States gets access to a system with CUI, ask your compliance advisor whether export-control rules allow it for your information.
CMMC compliance assessment services, step by step
- Scope. Where FCI and CUI are stored and sent, every asset in its group, and the network diagram of the scope.
- Gap assessment. Each 800-171 requirement checked against how your systems actually work.
- System security plan (SSP). How each requirement is met, system by system, including what your cloud and IT providers do.
- POA&M. Dated milestones for the gaps that remain, where the rule allows one at all: never at Level 1, and at Level 2 only under the conditions of 32 CFR 170.21, closed in 180 days or less.
- Controls in your systems. Our engineers close the technical gaps: access, logging, encryption and backups.
- Evidence and the affirmation. The score and the records, ready for SPRS. Your Affirming Official reads them and signs; we never sign for you.
Before your senior official signs: a self-check
Forward this to whoever will sign the affirmation. Every "no" is a gap to close before the signature, not after.
| Check | Why it matters |
|---|---|
| Is there a list of every asset that holds or handles CUI, and of the security tools guarding it? | The assessment scope is built from it |
| Does the SSP answer, one by one, how the 110 requirements are met? | It is where each requirement gets its answer |
| Does your SPRS entry show the current scope and every CAGE code it covers? | Both must be in a Level 2 entry |
| Is any POA&M item near its 180 days? | A conditional Level 2 (Self) status expires when the plan is not closed in time |
| Is each cloud service that holds CUI FedRAMP Moderate authorized, or equivalent to it? | The CMMC rule asks for it, and so does DFARS clause 252.204-7012 |
| Who reports a cyber incident, and can they do it within 72 hours? | That is what "rapidly report" means in the DFARS 7012 clause |
| Are your IT providers and the systems they run in the SSP? | Their services are assessed within your scope |
| Has your Affirming Official read the results? | The affirmation states that the requirements are met and will stay met |
Our work
Neither of the projects below is a defense contract, but both show the engineering CMMC asks for. For AI Call Center in the UAE, call data may not leave the country, so all AI processing runs on local servers with locally hosted models. On RxPhoto, a platform for clinics where we worked on the backend, the web front end and the API behind the mobile app, an audit log lets administrators follow every user action: the kind of record an assessor asks for.
What the price depends on
CMMC work is estimated before it starts, and the estimate depends on:
- how many people and systems touch FCI or CUI, and whether an enclave can shrink that;
- what exists already: an SSP, policies, a past SPRS score;
- your cloud: whether your services already have FedRAMP Moderate or an equivalent standing;
- how many requirements need engineering work, and whether we also run the systems afterwards, which puts us inside your scope.
The first call and the rough estimate are free. If you need an NDA, we sign it before you share any contract details.
Who assesses you, and what a CMMC compliance company can do
A company like ours prepares you; it cannot certify you. If the department brings Phase II back, Level 2 certification assessments come from C3PAOs and Level 3 assessments from DIBCAC. Today the signature that matters is your Affirming Official's, and the department can still run an assessment of its own. Our job is to have the scope, the SSP and the evidence ready for both.
Next to CMMC
CMMC is one of the rules in our regulatory compliance services, and compliance consulting sorts out which rules apply when you are not sure. The 72-hour clock is easier with incident response planned in advance, and the cloud side is in cloud compliance. If a client also asks for ISO 27001, much of the evidence overlaps: see ISO 27001 certification consulting.
Tell us about your contracts: the clauses they carry, the information you receive and the systems it touches. We answer new requests within 30 minutes on weekdays, 9 am to 6 pm Miami time, and the level you likely need and the rough estimate are free.
