CMMC

AI-enabled penetration testing can increase the frequency of technical checks, but it does not replace independent review of CUI boundaries, control implementation, governance, or incident response. Defense contractors should continue aligning with DFARS 252.204-7012 and NIST SP 800-171, maintain accurate CUI and system inventories, and treat the cited testing-cost comparison as illustrative.

Optikos, LLC announced it earned CMMC Level 2 certification after an independent assessment, confirming its cybersecurity controls meet DoD requirements for protecting Controlled Unclassified Information. The credential may strengthen its eligibility for CMMC-covered work, but the announcement names no specific solicitation or contract; about 2,300 of more than 200,000 defense suppliers had achieved Level 2 certification by September 2026.

inDirectIT appointed retired Air Force veteran and former CMMC Level 2 lead assessor Alexy Johnson as Director of Compliance Services. The hire reflects continued contractor demand for CMMC readiness and NIST-aligned support, even as the Pentagon’s planned second phase is suspended and applicable self-assessment and CUI protection obligations remain in effect.

Redspin says it has earned ISO/IEC 17020:2012 accreditation, becoming one of the first accredited CMMC Third Party Assessment Organizations (C3PAOs). For Defense Industrial Base contractors pursuing CMMC Level 2, the milestone adds an independently evaluated assessment option but does not create a contract opportunity or change compliance deadlines.

The House passed seven bipartisan small-business bills on November 11, including measures on veteran-owned businesses, cybersecurity and CMMC information, and domestic manufacturing connections. Senate action is still required; the bills create no immediate contract opportunities or funding, and the cybersecurity proposal expands outreach rather than imposing new CMMC requirements.

The Department of War’s July 13 suspension of CMMC Phase 2 remains in effect, with no restart date or promised review published after the planned 60-day study period. The pause delays the planned third-party assessment pathway; it does not remove existing contract cybersecurity clauses, underlying NIST controls, or applicable self-assessment requirements.

NIST SP 800-171 Revision 3 modernizes CUI safeguards with 97 requirements across 17 families, but DoD Class Deviation 2024-O0013 retains Revision 2 for DFARS 252.204-7012 and CMMC Level 2 until acquisition regulations are updated. Contractors should follow the revision specified in each solicitation and contract rather than assume Revision 3 automatically applies.

Graham Corporation completed Cybersecurity Maturity Model Certification (CMMC) cybersecurity assessments at Graham Manufacturing and Barber-Nichols. As the Department of Defense integrates CMMC into procurement, contractors should verify each unit’s assessment level, scope, and status against specific opportunity requirements; Graham has not disclosed those details.

Marlin Equity Partners made a strategic growth investment in Insight Assurance to support international expansion and growth in federal cybersecurity compliance and AI governance services. The development signals potential growth in independent assurance capacity, including CMMC- and FedRAMP-related services, but does not identify a government solicitation, award, or contract value.

A social-media post claims DoD contracts require applicable CMMC Level 1 self-assessment or Level 2 C3PAO certification before award, with requirements flowing down to subcontractors. It provides no official citation or effective date, so contractors should verify obligations in each solicitation and contract rather than treat the claim as universal.

New Jersey Innovation Institute (NJII) announced it achieved CMMC Level 2 certification on November 4, 2026, validating cybersecurity practices aligned with all 110 requirements in NIST SP 800-171 for protecting controlled unclassified information. The certification may strengthen NJII’s position as a prospective collaborator on defense-industrial-base work, but the announcement names no specific contract, solicitation, or award.

Georgia Southern University’s Talon Secure research environment achieved CMMC Level 2 with a perfect assessment score and no deficiencies across 14 security categories. The certification may help researchers compete for Department of War-funded work and position the university as a research partner or subcontractor, but it does not guarantee eligibility for every opportunity.

SNT Dynamics says it is the first South Korean defense company to earn CMMC Level 2 after an assessment of more than 110 security controls and 320 evaluation objectives. The certification may support eligibility for future U.S. defense MRO and production work, but it is not a contract award or guarantee of procurement access.

Connecticut has committed $2 million to the Defense CyberSecure Program, offering defense manufacturers financial resources and technical support to strengthen cybersecurity and prepare for requirements such as CMMC Level 2. The initiative may also create opportunities for cybersecurity providers through a Qualified Provider Network, though application details and deadlines have not been announced.

The Certified CMMC Assessor (CCA) credential requires an active CCP, an eligible DoD 8140 certification, approved training, documented experience, a passed exam and a Tier 3 determination. C3PAOs should plan hiring and qualification pipelines around these requirements, while contractors should account for assessor availability and certification costs when preparing for Level 2 assessments.

The Department of Defense is considering proposed rules that could raise CMMC Level 2 cybersecurity expectations for firms handling military moves. No new mandate, solicitation, contract value, or procurement deadline is identified; separate agency updates cover employee protections, VA hiring, and Census Bureau research.

FEDCON says contractors and subcontractors handling Federal Contract Information must implement CMMC Level 1’s 15 safeguards, complete an annual self-assessment, and record the score in the DoD’s SPRS. Missing safeguards or records can hinder contract eligibility and awards, making compliance documentation a procurement-readiness priority.

ISACA now manages CMMC Certified Professional training, exams, and certification, while the Cyber AB retains accreditation and Tier 3 investigation responsibilities. Contractors may use CCPs for limited Level 1 verification support, but CCPs cannot make final assessment determinations; certification also requires training, fees, an exam, and a favorable Tier 3 determination.

Cyber AB Registered Practitioners can help contractors prepare for CMMC assessments, but they cannot certify organizations, and prior implementation support bars an individual from assessing that same company. The reported RP fees are $600 for application, training, and testing, plus $500 annually; contractors should confirm the fee schedule and verify current CMMC requirements before budgeting or planning.

Associated Builders and Contractors has released a free roadmap to help Defense Industrial Base firms handling Federal Contract Information or Controlled Unclassified Information prepare for CMMC requirements. Contractors should budget and plan around active Level 1 self-assessment requirements while tracking the Department of Defense’s pause on Level 2 third-party assessments.

The Department of Defense paused part of the CMMC rollout schedule in July 2026, affecting planning for Level 2 assessments of contractors handling Controlled Unclassified Information. Contractors should check current DoD guidance and contract-specific requirements before scheduling a C3PAO assessment; the update specifies no replacement deadline.

A DoD task-force review outlines options for addressing the CMMC pause, including restarting Phase 2 for a narrower contractor population within 90 days and improving CUI marking and assessment guidance. Contractors’ existing NIST SP 800-171 obligations remain in effect, while potential adoption of Revision 3 and changes to POA&M rules remain unsettled.

An Exostar-sponsored Aviation Week article advises small defense suppliers to map controlled unclassified information (CUI) flows before choosing enterprise-wide CMMC controls or a segmented enclave. The reported pause in CMMC Phase 2 third-party assessment requirements changes the near-term assessment path, but does not remove CUI protection duties or applicable Level 1 and Level 2 self-assessments.

The Department of War paused CMMC Phase 2, but current contract-specific cybersecurity obligations remain in effect for defense contractors. A proposed FAR rule could extend CUI safeguards government-wide, including NIST SP 800-171 Revision 3, 72-hour incident reporting, subcontractor flowdowns, and cloud-security requirements—though those proposed provisions are not yet binding.

The Department of Defense received 997 responses to its CMMC request for information, including 509 from the defense industrial base. Respondents highlighted the cost and difficulty of implementing NIST SP 800-171 controls, while the reported average assessment cost was $47,000; DoD’s final recommendations remain pending as Level 2 clauses are expected in contracts beginning in November 2026.

Carahsoft is expanding public-sector access to Hyperproof’s governance, risk and compliance automation and Nothreat’s threat-detection tools through its reseller network and established purchasing vehicles. The announcement creates additional routes to market, including NASA SEWP V and NASPO ValuePoint, but identifies no new award, solicitation, or contract value.

The **Department of Defense** began phasing Cybersecurity Maturity Model Certification requirements into applicable contracts in November 2025, with implementation planned over three years. Reported gaps between small manufacturers’ self-assessments and assessment results underscore the need for documented CUI scoping, early remediation, and prime-contractor oversight of subcontractors.

Eutelsat Network Solutions announced CMMC Level 2 certification after an independent assessment of its internal and external enclaves, validating its ability to handle Controlled Unclassified Information and Federal Contract Information. The milestone strengthens its readiness to compete for U.S. government satellite connectivity requirements that call for the certification, but is not a contract award or guarantee of eligibility for a specific procurement.

Ariento and Carahsoft have partnered to distribute Enclave One, a bundled CMMC Level 2 offering for Defense Industrial Base organizations, through Carahsoft’s reseller network. Starting at $499 per month, the package includes a managed environment, Microsoft 365 GCC or GCC-High licensing, documentation, security operations, and an independent C3PAO assessment; eligible organizations may onboard in as little as 72 hours and reach certification reflected in SPRS within 90 days.

The Pentagon's recent suspension of Phase II of the Cybersecurity Maturity Model Certification (CMMC) has created confusion among Indiana's defense suppliers. While the requirement for compliance regarding cybersecurity controls remains, the postponement of external verification may lead to decreased urgency among small contractors, impacting their readiness and capacity.

Forvis Mazars LLP has achieved C3PAO accreditation under the Cybersecurity Maturity Model Certification program, enabling it to perform Level 2 assessments. This milestone is critical for assisting Department of Defense contractors in meeting stringent cybersecurity requirements essential for federal contract eligibility.

Cybersecurity professionals emphasize the need for clear scoping documentation in CMMC Level 2 assessments. Precise boundary definitions help streamline compliance efforts and reduce costs by focusing resources only on the relevant environments.

Diné Development Corporation (DDC) has achieved Cybersecurity Maturity Model Certification (CMMC) Level 2, enhancing its ability to secure federal contracts, particularly with the Department of War. This certification signals to procurement professionals that DDC is a robust partner for mission-critical projects requiring high cybersecurity standards.

SecurityMetrics has introduced CMMC Assess, a self-assessment tool aimed at aiding Level 1 and Level 2 contractors with Cybersecurity Maturity Model Certification (CMMC) compliance. This tool streamlines the compliance process, potentially enhancing the competitiveness of contractors navigating multiple CAGE codes.

VirtualDojo has teamed up with Carahsoft to provide robust quoting and contract management solutions to federal contractors. This collaboration focuses on streamlining compliance with CMMC cybersecurity standards and can enhance procurement efficiencies throughout the public sector.

The DoD has suspended Phase 2 of the CMMC program to review cybersecurity standards for contractors. This delay underscores the need for defense companies to continue compliance efforts, as any updated requirements will affect procurement eligibility and contract awards.

The Department of War has postponed the CMMC Phase II certification requirements, initially set for November 10, 2026. During this review period, defense contractors must continue to adhere to existing cybersecurity standards, emphasizing the necessity for robust cybersecurity protocols within the defense industrial base.

The Department of Defense has clarified that subcontractors must obtain Cybersecurity Maturity Model Certification (CMMC) Level 2 when processing Controlled Unclassified Information (CUI). This guidance highlights potential compliance challenges for small businesses and emphasizes the importance of contract clauses in managing cybersecurity responsibilities.

A study reveals defense contractors' cybersecurity scores have peaked, but confidence in their accuracy has dropped significantly. This raises alerts over reliance on self-attestation, underscoring the need for robust verification processes in cybersecurity compliance as future procurements approach stricter scrutiny.

The DoD has paused the rollout of CMMC Phase II to reassess compliance demands for contractors. This 60-day review allows industry feedback to shape future cybersecurity regulations, providing contractors an opportunity to adjust their compliance strategies accordingly.

Intech Hawaii has become the first managed service provider in Hawaii and Guam to achieve CMMC Level 2 certification, with Terence Tang serving as a Certified CMMC Assessor. This local expertise will significantly aid Department of Defense contractors in meeting their cybersecurity compliance needs, streamlining the pathway to certification.

Ocean Power Technologies has achieved Cybersecurity Maturity Model Certification (CMMC) Level 2, enhancing its competitiveness for U.S. Department of War contracts. This certification enables the company to safeguard Controlled Unclassified Information (CUI), essential for supporting advanced defense programs in autonomous maritime systems.

Inseego Corp. has attained CMMC Level 2 certification for its subscriber lifecycle management platform, Inseego Subscribe. This milestone ensures that communication service providers can effectively comply with the Department of Defense's cybersecurity mandates, streamlining government wireless service deployments.

Starting in 2026, federal agencies will begin phased assessments under the CMMC 2.0 framework. Contractors must achieve this certification to maintain federal contract eligibility, creating new demand in cybersecurity service sectors.

The Department of Defense has suspended CMMC Phase II third-party assessments, addressing small contractors' cost concerns. Despite the pause, compliance with existing cybersecurity mandates remains essential, presenting both challenges and opportunities for defense contractors.

The defense contracting sector is increasingly focused on **CMMC 2.0** and the **CPCSC** to ensure compliance with heightened cybersecurity requirements. This focus is crucial for maintaining eligibility for government contracts and reflects a growing demand for robust cybersecurity practices among suppliers.

The DoD has paused the Cybersecurity Maturity Model Certification Phase II implementation set for November 2026. This decision addresses rising compliance costs and barriers for small and mid-sized defense contractors while permitting self-assessments to remain effective in the interim. A 60-day feedback review period is now underway to reassess compliance requirements.

The Department of Defense is integrating cybersecurity into aerospace quality management systems, aligning IA9100 with CMMC mandates. Aerospace contractors must adapt to the combined framework to ensure compliance and bolster supply chain resilience while facing updated procurement requirements.

The Department of Defense is advancing stringent cybersecurity compliance requirements for defense contractors, notably with upcoming CMMC and DFARS deadlines. Contractors must align with these standards to ensure they remain eligible for DoD contracts and effectively manage supply chain risks.

The Department of Defense is mandating CMMC Level 2 certification for subcontractors on its contracts by November 2026, primarily for those managing Controlled Unclassified Information (CUI). This shift impacts subcontractor eligibility and emphasizes the importance of compliance in maintaining contract opportunities.