CMMC Program Update
Last updated July 27, 2026.
On July 13, 2026, the Department of War suspended the November 10, 2026 transition to CMMC Phase II and began a 60-day review of the program. Phase I self-assessment requirements remain in effect, and contractors must continue meeting applicable NIST SP 800-171 and DFARS safeguarding requirements.
CMMC Support for Defense Contractors
CMMC can affect a defense contractor’s eligibility for certain Department of War contracts and subcontracts. The required level and assessment type depend on the information the organization handles and the terms of the contract.
CISO Global helps contractors determine where they stand, define the assessment boundary, close security and documentation gaps, and prepare for the required self-assessment or independent certification assessment.
Organizations that handle CUI generally fall under Level 2. The contract determines whether Level 2 requires a self-assessment or a C3PAO certification assessment.
Level 1
Level 2
Level 3
Current Level 2 assessment status
During the Phase II suspension, procurement documents may require only Level 1 Self or Level 2 Self assessments. Level 2 C3PAO and Level 3 DIBCAC assessments may not be designated as contract requirements during the review. However, C3PAO Level 2 certification assessments remain operational and available to organizations that choose to pursue certification voluntarily.
CMMC Services
CISO Global provides CMMC readiness, advisory, and ongoing compliance support. TalaTek LLC, a wholly owned subsidiary of CISO Global and a Cyber AB-authorized C3PAO, conducts independent CMMC Level 2 certification assessments. Engagements are structured to follow applicable independence and conflict-of-interest requirements.
Readiness and Advisory Services
CMMC Gap
Assessment
Compare your current program against CMMC and NIST SP 800-171 requirements to identify gaps, priorities, and next steps.
Readiness and
Advisory Support
Prepare for assessment with support for SSPs, POA&Ms, policies, evidence collection, and remediation planning.
Mock CMMC
Assessment
Test readiness before the official assessment by reviewing documentation, evidence, and likely assessor questions.
CMMC Assessment
Support
Organize documentation, respond to evidence requests, and coordinate internal teams during an assessment conducted by an independent C3PAO.
Independent Level 2
Assessment
TalaTek LLC, a wholly owned subsidiary of CISO Global and a Cyber AB-authorized C3PAO, conducts independent CMMC Level 2 certification assessments in accordance with applicable program and independence requirements.
Ongoing CMMC
Readiness
Keep controls, documentation, evidence, and remediation work current between assessments and annual affirmations.
When CMMC Services Are the Right Fit
- A solicitation or contract includes a CMMC requirement
- Your organization handles FCI or CUI
- The CUI boundary or assessment scope is unclear
- Your SSP, POA&M, SPRS score, policies, or evidence need work
- A Level 1 or Level 2 self-assessment is approaching
- Voluntary Level 2 certification would support a customer or supply-chain requirement
Choose Your CMMC Starting Point
Start with the support that matches your current position, whether you are defining scope, preparing for an assessment, pursuing independent certification, or maintaining readiness.
Determine Your Current Status
Define your scope and compare your program against CMMC and NIST SP 800-171 requirements.
Prepare for Assessment
Close priority gaps and organize the policies, procedures, documentation, and evidence assessors will review.
Complete an Independent Level 2 Assessment
Organizations may continue to pursue voluntary Level 2 certification during the Phase II suspension. TalaTek conducts CMMC Level 2 certification assessments as a Cyber AB-authorized C3PAO in accordance with applicable CMMC and Cyber AB conflict-of-interest requirements.
Maintain Ongoing Readiness
Keep required safeguards, documentation, evidence, affirmations, and remediation work current as systems and contract requirements change.
Maintain Readiness Between Assessments
Cybersecurity responsibilities continue after assessment results are submitted. Contractors must keep required controls operating, update their SSP and evidence as systems change, complete applicable affirmations, and prepare for future contract or assessment requirements.
CISO Global helps organizations manage this work through ongoing control tracking, evidence management, reporting, and remediation support.
Prepare for Your CMMC Requirements
Understand your current requirements, address gaps, and move forward with a clear CMMC plan.
Frequently Asked Questions
What is CMMC?
The Cybersecurity Maturity Model Certification (CMMC) is a federal program for assessing how defense contractors protect Federal Contract Information and Controlled Unclassified Information. The required level and assessment method depend on the terms of the applicable contract.
What CMMC level applies to my organization?
The required CMMC level depends on the information your organization handles and the requirements in the applicable defense contract.
- Level 1: For organizations handling Federal Contract Information (FCI). Validated through self-assessment.
- Level 2: For organizations handling Controlled Unclassified Information (CUI). Requires implementation of NIST SP 800-171 controls and may require certification through a C3PAO assessment.
- Level 3: Applies to a small number of high-risk programs and is assessed by the U.S. government.
Many defense contractors that handle CUI should expect CMMC Level 2 requirements, depending on the contract.
What is a C3PAO?
A Certified Third-Party Assessment Organization (C3PAO) is authorized to conduct formal CMMC assessments. TalaTek LLC, a wholly owned subsidiary of CISO Global, is a Cyber AB-authorized C3PAO.
When is a C3PAO assessment required?
Under the CMMC program model, certain Level 2 requirements may call for certification through a C3PAO assessment. During the current Phase II suspension, Department of War guidance does not permit Level 2 C3PAO assessments to be designated as procurement requirements. C3PAO assessments remain available to organizations that choose to pursue independent Level 2 certification.
How is CMMC different from NIST SP 800-171?
NIST SP 800-171 defines the security requirements for protecting CUI. CMMC uses those requirements and adds an assessment and certification process to verify that the required practices are implemented.
Can CISO Global help before the official assessment?
Yes. CISO Global can help with gap assessments, readiness planning, documentation, evidence collection, mock assessments, remediation guidance, and assessment support before a formal C3PAO assessment.
How often must organizations maintain CMMC compliance?
The cycle depends on the required CMMC level and assessment type. Level 1 requires an annual self-assessment and affirmation. Level 2 requires either a self-assessment or C3PAO certification assessment every three years, as specified by the contract, plus annual affirmations. Level 3 requires a DCMA DIBCAC assessment every three years, continued Level 2 certification, and annual affirmations.
What does the CMMC Phase II suspension mean for contractors?
The July 13, 2026 action suspended the planned November 2026 expansion to Phase II while the Department conducts a 60-day review. During the suspension, procurement requirements may include Level 1 Self or Level 2 Self assessments, but not Level 2 C3PAO or Level 3 DIBCAC assessments. NIST SP 800-171 and DFARS safeguarding requirements remain in effect, and contractors should continue reviewing their contracts and maintaining required safeguards. C3PAO Level 2 assessments remain available on a voluntary basis.