Verify the requirements
The rollout changed. Review your solicitation, contract, amendments and applicable self-assessment requirements with your contracts lead.
A readiness resource for defense-company leaders
CMMC is still
a thing.
Know what your contract requires now. Then connect the evidence, the people and the next decisions.
Phase II is suspended. Applicable Phase I self-assessment and information-safeguarding obligations remain. Start with the requirements that apply to your actual work.
Policy checked November 6, 2026. Read the official sources and scope.
What changed—and what to check
Bring the contract, security and operating teams together.
Examine the evidence
Ask what supports the answers your company is giving. Clarify the information, systems, providers and responsibilities involved.
Fund and assign the work
Give each unresolved action an owner, a completion standard and a review date. Identify decisions that require leadership attention.
Free planning resources
Get the guide.
Put it to work.
The kit includes the October 2026 guide and workbook, with a November 6 policy note. Downloads become available here after your request is saved.
You can also use the assessment without a form. It produces a prioritized action list from your reported answers.
These are planning resources, not an official CMMC assessment, certification or SPRS score. Have qualified security and contracts professionals validate requirements and evidence.
Your request is saved
Your resources are ready.
Download the guide PDF · Read the November policy note
Start the interactive assessment →
Discuss your next decision.
If responsibilities, resources or coordination are blocking progress, review your priorities with Dan. A conversation can establish whether a scoped company plan would help.
Book a 20-minute conversation →Requesting a kit does not book a call. Downloads are shareable; we cannot identify everyone who receives a forwarded copy.
Current guidance · November 6, 2026
Read the source. Verify your contract.
The September 3 Revision 3 deviation carries forward the directions allowing Level 1 and Level 2 self-assessments and retaining NIST SP 800-171 Revision 2 under DFARS 252.204-7012. Affected solicitations and contracts change through their actual amendments and modifications. No replacement Phase II start date was verified in this review.
- September 3, 2026 official deviation memo, pages 2–3
- Current CMMC program information
- July 13, 2026 official suspension announcement
This page is a dated management resource. Requirements may change. It makes no representation about your company's official status.