CMMC Phase 2 Is Paused. Your NIST 800-171 Affirmation Isn't. We Get Defense Contractors Evidence-Ready in 6 Weeks — Not 6 Months.

Readiness services prepare you for the assessment — gap analysis, SSP review, evidence building, and remediation guidance. Certification is performed by an authorized C3PAO (third-party assessment organization). STG prepares you; the C3PAO certifies you.

A Managed CUI Enclave is a secure, isolated environment specifically designed for handling Controlled Unclassified Information. It dramatically reduces your assessment scope, allowing you to achieve CMMC compliance in as little as 60 days. Start with an enclave, then expand to full organizational compliance over time.

Any organization that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) as part of DoD contracts. This includes prime contractors and subcontractors at every tier of the supply chain.

NIST 800-171 is already in your contracts through DFARS 252.204-7012, and CMMC self-assessment requirements are already in solicitations. Without an accurate, evidence-backed score you can't bid credibly — and signing an inaccurate one is a False Claims Act risk. It isn't optional; it's the cost of doing business with the Department of Defense.

Key documents include a System Security Plan (SSP), Plan of Action and Milestones (POA&M), network diagrams, asset inventories, and evidence of implemented security controls across all 110 NIST 800-171 requirements.

The readiness assessment typically takes 4–6 weeks. Full remediation can take 3–6 months depending on your current posture. Need it faster? Ask about our Managed CUI Enclave — compliance in as little as 60 days.

DoD suspended CMMC Phase 2 — the requirement to hold a third-party (C3PAO) Level 2 certification as a condition of award, which had been scheduled for November 10, 2026 — and launched a CMMC Reform Task Force with a 60-day review. Phase 1 is unchanged: Level 1 and Level 2 self-assessments, SPRS score submission, annual executive affirmation, and DFARS 252.204-7012/7019/7020 all remain in force. The CMMC 2.0 Final Rule (32 CFR Part 170), effective December 16, 2024, was not withdrawn. Existing C3PAO certifications stay valid, and primes can still require them.

No. Your current contracts already require NIST 800-171 and an accurate SPRS score; primes are setting their own deadlines; and every plausible outcome of the review rests on the same 110 controls, so the work transfers. If Phase 2 returns, roughly 100 authorized assessors will face 100,000+ contractors — companies with evidence ready go first.

The Department of Defense established CMMC, and the Cyber AB (formerly the CMMC Accreditation Body) manages the ecosystem including C3PAOs and Registered Providers like STG.

No. CMMC Level 2 is built directly on NIST 800-171 — the same 110 controls. The difference is that CMMC adds verification — self-assessment with executive affirmation today, third-party certification when Phase 2 returns.

Gap Assessments start at $7,500 for straightforward CUI environments. The Gap Assessment is the entry point; your full readiness scope and fee are quoted before any further engagement — no hourly billing, no surprise invoices.

Your IT team is critical to implementation, but CMMC assessment requires specific expertise in NIST 800-171 control mapping, evidence packaging, and audit preparation — the same evidence a C3PAO, DIBCAC, or prime will ask for — that most IT teams don't have.