CMMC and NIST 800-171 readiness for defense contractors
Georgia’s defense industrial base is large, and so is the target it presents. If you handle Federal Contract Information or Controlled Unclassified Information, your contracts already carry cybersecurity obligations. We help you understand exactly where you stand and build a defensible path to compliance, whatever the CMMC timeline brings next.
Where CMMC stands (September 2026)
CMMC Phase 1 took effect November 10, 2025, requiring self-assessments in applicable contracts. In July 2026, the Department suspended the planned Phase 2 rollout of third-party Level 2 assessments pending a program review. The underlying obligations remain: DFARS 252.204-7012, NIST SP 800-171 controls, and self-assessment scores submitted to SPRS. Contractors who keep preparing now will be ready however the program is reshaped.
Our readiness services
Practical preparation focused on the controls that matter most:
- Scoping of FCI and CUI, including enclave options
- NIST SP 800-171 gap assessment
- SPRS score calculation and validation
- System Security Plan (SSP) development
- Plan of Action & Milestones (POA&M)
- Technical remediation: MFA, logging, encryption, access control
- Microsoft 365 GCC High and cloud environment guidance
- Readiness review before a C3PAO assessment
A note on independence: we prepare you for compliance and strengthen the controls behind it. We are not a law firm, CPA firm, QSA, or C3PAO, and we don’t issue certifications or attestation reports — we’re glad to work alongside the counsel and assessors who do.
Can you certify us for CMMC Level 2?
No. CMMC Level 2 certification assessments are performed by C3PAOs authorized by the Cyber AB. We prepare you for that assessment and support the self-assessments currently required.
Does the Phase 2 suspension mean we can stop preparing?
No. DFARS 252.204-7012 and NIST SP 800-171 obligations still apply to contractors handling CUI, self-assessment scores must still be submitted to SPRS, and inaccurate attestations carry legal risk. The suspension affects the timing of third-party assessments, not the requirement to protect CUI.
What is an SPRS score?
The Supplier Performance Risk System score summarizes your NIST SP 800-171 self-assessment on a scale up to 110. Contractors handling CUI must submit a current score, and primes increasingly review it when selecting subcontractors.
Find your gaps before someone else does.
Talk directly with a senior security practitioner about where you’re exposed and what to fix first — no sales script, no obligation.