Why We Replaced Our Old CMMC Blog Posts With This Guide

CMMC compliance in Hawaii and Guam has changed so many times since 2019 that most of what we published over the past five years is now out of date. The program went from five levels to three. The rules moved from proposal to final. Phase 1 started in November 2025. Then, on July 13, 2026, the Department of War suspended Phase 2 and opened a review of the entire program.

We wrote more than 60 posts along the way. Each one was accurate when we published it. Read together today, they contradict each other on dates, control counts, and costs. That is not helpful to a contractor trying to make a real decision.

So we made a choice. We redirected every one of our older CMMC posts to this single guide. If you clicked an old link and landed here, that is why. Everything those posts covered is here, updated, in one place, and we will keep this page current as the program changes. Our goal has not changed: to keep educating the local defense community with information you can act on.

There is a second reason for the change. Intech Hawaii is now Intech Pacific. What started in Hawaii in 1991 now supports organizations across Hawaii, Guam, Japan, Alaska, and the mainland. The new name reflects that growth. Hawaii is still our home base and always will be.

Nothing about our service changes. Our team, service levels, email addresses, and phone numbers are all the same. The rebrand and a new website gave us a natural point to clean up years of content and start fresh.

One more thing about me before we start. I have worked in IT, cybersecurity, and compliance since 2000. I spent many years supporting hedge funds, registered investment advisors, and private equity firms in New York, where regulators expected documentation for everything. I joined Intech Pacific in October 2021. Today I am responsible for our clients' compliance, cybersecurity, and the return they get from our managed services. I hold the CMMC Certified Assessor (CCA), CISSP, and CISM certifications, and I have been involved in more than 100 CMMC gap assessments. Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam, and the only MSP in Hawaii and Guam with CMMC Certified Professionals (CCPs) and CMMC Certified Assessors (CCAs) on staff. As of September 2026, we have two of the three CCAs based in Hawaii. We have taken more companies through C3PAO certification than every other company in Hawaii and Guam combined.

This guide is long on purpose. It is written as a reference, not a quick read. Use the table of contents to jump to what you need.

If You Arrived Here From One of Our Older Posts

If a link to one of our older posts brought you here, this list shows where to find that topic now.

• CMMC 2.0 announcement, the three levels, or CMMC 1.0 vs. 2.0: Part 1 and Part 2 (Era 4)
• The 17 CMMC domains or NIST control families: Part 1 and Part 9
• What CMMC and NIST compliance are, or who needs CMMC: Part 1
• The difference between CMMC and DFARS, or what DFARS is: Part 1
• DFARS 7021 and 7025 for Level 1 contractors: Part 1, Part 2 (Era 6), and Part 13
• The CMMC timeline, proposed rules, the final rule, or 48 CFR: Part 2
• CMMC Phase 2, the November 10 dates, or February 2026 updates: Part 2 and Part 3
• The 2026 Phase 2 pause or the cost of the pause: Part 3 and Part 4
• Whether to wait until CMMC is finalized: Part 3
• The False Claims Act or penalties for non-compliance: Part 5
• RP vs. CCP vs. CCA or the RPO badge: Part 6
• Enclaves, enclave vs. all-in approaches, or analyzing contracts for CUI: Part 7
• GCC High, Azure Government, Box, PreVeil, or DIY platforms: Part 7
• Open source software risk or legacy systems: Part 7
• Customer responsibility matrices: Part 7
• Gap analysis, readiness, or compliance checklists: Part 8 and Part 13
• Control 3.11.1 risk assessments: Part 8
• The cost of CMMC certification or Pentagon cost estimates: Part 10
• How Hawaii and Guam businesses are coping with CMMC: Part 11
• Level 1 self-assessments: Part 13
• CMMC Level 3: Part 14
• The benefits of CMMC or common misconceptions: Part 1 and Part 15

A few details in our older posts were superseded by later rules or were simply wrong, and this guide corrects them. The most important corrections:

• Level 1 has 15 requirements, not 17.
• CMMC 2.0 uses 14 NIST requirement families, not 17 domains.
• Level 3 is 110 plus 24 requirements, assessed by DIBCAC, not 130 practices assessed by a C3PAO.
• Level 1 is a self-assessment, not a C3PAO assessment.
• False Claims Act penalties are calculated per false claim plus damages, not per control.
• The POA&M closeout window is 180 days.
• There is no single "October 2026" deadline for full compliance. The phased schedule began November 10, 2025, and Phase 2 is now suspended.

How to Use This Guide

Here is what each part covers:

1. CMMC basics: what CMMC is, FCI vs. CUI, the three levels, who needs certification, and common misconceptions.
2. The complete CMMC timeline: every major event from the 2010 CUI executive order to the September 2026 class deviation, plus the lessons that history teaches.
3. The 2026 Phase 2 pause: what was suspended, what was not, and what it means for your situation.
4. What happens after the pause: the realistic scenarios and my view of where this is heading.
5. Enforcement and the False Claims Act: why the pause increased legal risk instead of reducing it.
6. Who is qualified to sell CMMC services: RP, RPO, CCP, CCA, C3PAO, and why credentials matter more than marketing.
7. Scoping and technology: finding CUI, enclaves, GCC vs. GCC High, FedRAMP, shared responsibility, and DIY platforms.
8. Documentation: SSPs, POA&Ms, policies, risk assessments, incident response, and evidence.
9. The 110 requirements, family by family: what each family covers and where contractors fall short.
10. CMMC cost: realistic budgets for implementation, assessment, and maintenance.
11. CMMC in Hawaii and Guam: what is different about doing this work in the Pacific.
12. How Intech Pacific helps contractors: our services and how they map to different types of companies.
13. Your action plan: step by step, including a Level 1 self-assessment walkthrough and what to expect from a C3PAO.
14. CMMC Level 3 and NIST SP 800-171 Revision 3.
15. CMMC as a cybersecurity program: threats, training, SOC, insurance, and continuous compliance.
16. Lessons from 25 years in the field.

A glossary and a list of frequently asked questions follow the main sections.

A note on names: in September 2025, an executive order authorized "Department of War" as a secondary title for the Department of Defense. The July 2026 pause was issued under the DoW name. In this guide, I use "DoD" for events before September 2025 and "DoW" for events after. They are the same department, and the legal name in statute is still the Department of Defense.

Part 1: CMMC Basics

What Is CMMC?

The Cybersecurity Maturity Model Certification (CMMC) is the DoD program that verifies whether defense contractors actually protect the sensitive information they handle. It does not create new security requirements for most contractors. It checks whether contractors have implemented requirements that already exist in their contracts.

That distinction matters. Since December 31, 2017, contractors with DFARS clause 252.204-7012 in their contracts have been required to implement the 110 security requirements in NIST SP 800-171. For years, the only verification was the contractor's own word. CMMC exists because the DoD found that self-attestation was not working.

CMMC is codified in two federal rules:

• 32 CFR Part 170, the program rule, which defines the levels, assessment types, and the assessor ecosystem. It took effect December 16, 2024.
• 48 CFR (the DFARS rule), which puts CMMC requirements into contracts through DFARS clauses 252.204-7021 and 252.204-7025. It took effect November 10, 2025.

What Is the Difference Between FCI and CUI?

Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Controlled Unclassified Information (CUI) is more sensitive information that the government requires to be safeguarded under law, regulation, or policy.

The type of information you handle determines your CMMC level:

• FCI only: CMMC Level 1.
• CUI: CMMC Level 2, and for a small number of critical programs, Level 3.

Examples of FCI include contract schedules, pricing, delivery details, and internal correspondence about the work. Examples of CUI include technical drawings, specifications, export-controlled data, and information marked CUI under the DoD CUI Registry categories.

When I explain this to a non-technical owner, I keep it simple. Level 1 is for FCI. Because FCI is less critical, it only needs a subset of the Level 2 controls. But some of the harder controls are in Level 1, and you still need documentation to prove you meet them.

The CUI program itself is government-wide. It was created by Executive Order 13556 in 2010, and the National Archives (NARA) maintains the CUI Registry that defines each category.

What Are the Three CMMC Levels?

CMMC 2.0 has three levels. Each level has a defined set of requirements and a defined assessment type.

• Level 1 (Foundational): Protects FCI. Requirements: 15 requirements from FAR 52.204-21. Assessment: Self-assessment. Frequency: Annual, with annual affirmation.
• Level 2 (Advanced): Protects CUI. Requirements: 110 requirements from NIST SP 800-171 Rev 2. Assessment: Self-assessment or C3PAO assessment, as specified in the contract. Frequency: Every 3 years, with annual affirmation.
• Level 3 (Expert): Protects High-priority CUI. Requirements: Level 2 plus 24 requirements from NIST SP 800-172. Assessment: DIBCAC (government-led), after a Level 2 C3PAO certification. Frequency: Every 3 years, with annual affirmation.

A few details that caused confusion in older content, including some of ours:

• Level 1 has 15 requirements, not 17. CMMC 1.0 counted 17 practices at Level 1. The final rule maps Level 1 to the 15 basic safeguarding requirements in FAR 52.204-21, which the FAR overhaul renumbered as FAR 52.240-93 with the same requirements.
• Level 1 does not allow a POA&M. Every requirement must be fully met at the time of the self-assessment.
• Level 2 is assessed against NIST SP 800-171 Revision 2, even though NIST published Revision 3 in May 2024. The DoD issued a class deviation in May 2024 keeping contractors on Revision 2 until further notice.
• Level 3 is assessed by the government, specifically the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), not by a C3PAO. A contractor must hold a Level 2 C3PAO certification before a Level 3 assessment.

How Is CMMC 2.0 Organized?

CMMC 2.0 Level 2 is organized into the same 14 families as NIST SP 800-171. CMMC 1.0 used 17 "domains," including Asset Management, Recovery, and Situational Awareness. Those three were dropped in CMMC 2.0. If you read a guide that talks about 17 domains, it was written for a model that no longer exists.

The 14 families are:

1. Access Control (AC), 22 requirements
2. Awareness and Training (AT), 3 requirements
3. Audit and Accountability (AU), 9 requirements
4. Configuration Management (CM), 9 requirements
5. Identification and Authentication (IA), 11 requirements
6. Incident Response (IR), 3 requirements
7. Maintenance (MA), 6 requirements
8. Media Protection (MP), 9 requirements
9. Personnel Security (PS), 2 requirements
10. Physical Protection (PE), 6 requirements
11. Risk Assessment (RA), 3 requirements
12. Security Assessment (CA), 4 requirements
13. System and Communications Protection (SC), 16 requirements
14. System and Information Integrity (SI), 7 requirements

That adds up to 110. Each requirement is broken into assessment objectives in NIST SP 800-171A, and assessors evaluate every objective. In total, Level 2 has 320 assessment objectives. A single requirement is not met unless every one of its objectives is met. This is one reason contractors who score themselves quickly tend to score themselves too high.

Who Needs CMMC Certification?

Any company that handles FCI or CUI under a DoD contract or subcontract will need CMMC at the level its contract specifies. Company size does not matter. There is no small business exemption.

That includes:

• Prime contractors that hold contracts directly with the DoW.
• Subcontractors at every tier that receive FCI or CUI from a prime or a higher-tier sub. CMMC requirements flow down.
• Service providers that store, process, or transmit CUI on a contractor's behalf, or that provide security protection for the contractor's environment. This includes many MSPs.
• Manufacturers, engineering firms, construction firms, and professional services firms supporting defense programs.

The main exception is for contracts solely for commercially available off-the-shelf (COTS) items.

Here is the conversation I have most often. A contractor tells me CMMC does not apply to them. I walk them through their contracts and point to the DFARS clauses already in them. Then I remind them of the second point: if your prime requires CMMC, it is a requirement for you. The agreement with your prime is a private contract. Your prime can set conditions stricter than the DoW's, and many do.

DoD estimates of how many companies are affected have varied widely over the years. Early figures of about 300,000 came from the CMMC 1.0 era. The December 2023 proposed rule estimated about 76,598 entities would need a Level 2 C3PAO assessment, out of roughly 220,000 total entities across all levels. Use the rule's figures when you see a number quoted, and check where any other figure came from.

What Is the Difference Between CMMC and DFARS?

DFARS is the set of contract rules. CMMC is the program that verifies you follow them. They are not alternatives, and meeting one does not excuse you from the other.

The DFARS clauses that matter most are:

• DFARS 252.204-7012: requires contractors to implement NIST SP 800-171, report cyber incidents to the DoD within 72 hours, preserve images of affected systems for 90 days, and use cloud services that meet FedRAMP Moderate equivalent requirements. This clause has been in contracts since 2013 and has required NIST SP 800-171 since 2015.
• DFARS 252.204-7019 and 7020: created in 2020 to require a NIST SP 800-171 self-assessment score in the Supplier Performance Risk System (SPRS). As of February 2026, the DFARS overhaul removed 7019 and renumbered 7020. I cover this in the timeline.
• DFARS 252.204-7021: the CMMC clause. It requires the contractor to hold the CMMC status specified in the contract, maintain it for the life of the contract, and flow the requirement down to subcontractors.
• DFARS 252.204-7025: a solicitation provision added in November 2025 that tells offerors which CMMC level the contract will require.

Think of 7012 as the "what" and 7021 as the "prove it." The pause affected the "prove it" part. The "what" never changed.

Five Common CMMC Misconceptions

I see the same misconceptions at both ends of the spectrum. Some contractors think CMMC is easy and that they can buy a product that makes them compliant. Others think it is too costly, too difficult, and close to impossible. Both views are wrong.

1. "CMMC is a one-time project." It is not. Certification lasts three years, affirmations are annual, and your environment must stay compliant the entire time. I think of it the way I think about personal health. You do not get healthy once and stop.
2. "We are too small for this to apply." Size is irrelevant. If you handle FCI or CUI, the requirements apply.
3. "CMMC replaces NIST 800-171." It does not. CMMC Level 2 is NIST 800-171 with independent verification.
4. "The pause means CMMC is over." It does not. The contract requirements are still in place. Only the timeline for mandatory third-party assessment was suspended.
5. "A tool or platform can make us compliant." No product covers all 110 requirements. Compliance takes people, process, documentation, and technology working together.

The misconception that frustrates me most is the second half of number five. Contractors pay someone for a "compliance package" and assume they are done. I cover why that goes wrong in Part 6.

Part 2: The Complete CMMC Timeline, From 2010 to the 2026 Pause

The CMMC program is the result of more than 15 years of federal effort to protect sensitive defense information in the supply chain. Understanding that history explains why the program looks the way it does and why I do not expect the underlying requirements to go away.

I have split the history into eight eras. A summary list comes at the end of this part.

Era 1: Building the Foundation (2010 to 2017)

The foundation for CMMC was laid between 2010 and 2017, when the government defined CUI and required contractors to protect it using NIST SP 800-171. Every CMMC Level 2 requirement traces back to this period.

November 4, 2010: Executive Order 13556. President Obama signed Executive Order 13556, "Controlled Unclassified Information." Before this order, agencies used more than 100 different markings for sensitive but unclassified information, such as "For Official Use Only" and "Sensitive But Unclassified." The order created a single government-wide CUI program and named the National Archives as the Executive Agent. It was published in the Federal Register on November 9, 2010.

November 18, 2013: The first DFARS 7012. The DoD published a final DFARS rule creating clause 252.204-7012, then titled "Safeguarding Unclassified Controlled Technical Information." It required contractors to protect technical information using a set of controls drawn from NIST SP 800-53, a framework built for federal agencies, not private companies.

June 2015: NIST SP 800-171 is published. NIST released Special Publication 800-171, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations." It took the federal controls in 800-53 and tailored them for companies. This is the document that would become the core of CMMC Level 2.

August 26, 2015: DFARS 7012 is rewritten. A DFARS interim rule renamed 7012 "Safeguarding Covered Defense Information and Cyber Incident Reporting." It required NIST SP 800-171 and extended the 72-hour cyber incident reporting requirement, first introduced in 2013, to all covered defense information. That requirement is still in effect today.

December 30, 2015: The deadline moves to December 31, 2017. A second interim rule gave contractors until December 31, 2017 to implement NIST SP 800-171 in full.

September 14, 2016: 32 CFR Part 2002. NARA published the rule implementing the CUI program across the government. It took effect November 14, 2016.

October 21, 2016: DFARS 7012 final rule. The DoD finalized the 7012 clause.

December 2016: NIST SP 800-171 Revision 1.

December 31, 2017: The compliance deadline. Contractors handling covered defense information were required to have NIST SP 800-171 implemented. Verification was self-attestation only. Contractors told the government they were compliant, and in most cases, nobody checked.

This date matters more than most contractors realize. If your contract includes DFARS 7012, you have been required to meet all 110 NIST SP 800-171 requirements since the end of 2017. CMMC did not create that obligation. It is the verification mechanism for an obligation that has existed for almost nine years.

Era 2: The Self-Attestation Problem Becomes Clear (2018 to 2019)

By 2019, the DoD had evidence that self-attestation was not working. Contractors were signing contracts that required NIST SP 800-171 while leaving basic controls unimplemented.

The clearest evidence came from the DoD Inspector General. On July 23, 2019, the IG released report DODIG-2019-105, an audit of how contractors protected DoD CUI. The IG reviewed a sample of contractors and found:

• Multifactor authentication was not implemented.
• Weak passwords were in use.
• Known vulnerabilities were left unmitigated.
• Removable media was not protected.

The IG also found that the DoD did not know how much of its information was held by contractors.

At the same time, high-profile breaches of the defense supply chain were attributed to nation-state actors. Adversaries were not attacking the Pentagon's best-defended networks. They were going after subcontractors with weaker security and access to the same technical data.

When I think back to my years in New York finance, this is where the defense world and the financial world differed. In finance, regulators expected documentation and reporting for everything, and they checked. The defense industrial base had requirements on paper but very little enforcement. CMMC was the DoD's answer to that gap.

Era 3: CMMC 1.0 (2019 to 2021)

CMMC 1.0 was the DoD's first attempt at mandatory third-party verification. It was ambitious, complex, and ultimately replaced before it took full effect.

2019: CMMC is announced. The Office of the Under Secretary of Defense for Acquisition and Sustainment, led on this effort by Katie Arrington, announced CMMC in mid-2019 and released draft versions through the fall.

January 2020: The CMMC Accreditation Body is formed. A nonprofit, the CMMC Accreditation Body (CMMC-AB), was established to build and manage the assessor ecosystem. It later rebranded as The Cyber AB.

January 31, 2020: CMMC Model 1.0 is released. The first model had:

• 5 maturity levels
• 17 domains
• 171 practices at Level 5
• Maturity "processes" layered on top of technical practices

Version 1.02 followed in March 2020.

September 29, 2020: The DFARS interim rule. The DoD published an interim DFARS rule, effective November 30, 2020, that created three new clauses:

• 204-7019: notice that offerors must have a current NIST SP 800-171 assessment on file.
• 204-7020: the DoD Assessment Requirements. Contractors had to complete a Basic self-assessment using the DoD Assessment Methodology and post the score in SPRS.
• 204-7021: the first CMMC clause.

The DoD Assessment Methodology scores a contractor from 110 (everything implemented) down to as low as -203. Each unmet requirement subtracts 1, 3, or 5 points depending on its weight. For the first time, contractors had to put a number in a government system. That number would later become central to False Claims Act cases.

2020 to 2021: Pilots and problems. The DoD planned to phase CMMC 1.0 into a limited number of pilot contracts. Industry raised serious concerns about cost, the complexity of five levels, the maturity process requirements, and the small number of assessors. In March 2021, the DoD began an internal review.

Era 4: CMMC 2.0 (2021 to 2023)

CMMC 2.0 simplified the model by aligning it directly with existing federal standards rather than adding requirements on top of them.

November 4, 2021: CMMC 2.0 is announced. After the internal review, the DoD announced CMMC 2.0. The changes were significant:

• Five levels became three.
• Level 2 was aligned exactly with the 110 requirements of NIST SP 800-171. The 20 additional practices from CMMC 1.0 were removed.
• The maturity processes were eliminated.
• Level 1 moved to annual self-assessment.
• Some Level 2 contractors would be allowed to self-assess.
• Limited use of POA&Ms would be allowed.
• The CMMC 1.0 pilots were suspended.

November 17, 2021: Advance notice. The DoD published an advance notice in the Federal Register explaining that rulemaking would be required before CMMC 2.0 could be enforced.

October 6, 2021: The DOJ Civil Cyber-Fraud Initiative. A month before CMMC 2.0 was announced, Deputy Attorney General Lisa Monaco launched the Civil Cyber-Fraud Initiative. It committed the Department of Justice to using the False Claims Act against contractors that misrepresent their cybersecurity. This is the enforcement side of the story, and I cover it in Part 5.

2022 to 2023: Rulemaking. The DoD spent roughly two years drafting the rule. During this period, many contractors waited. Others, including many of the contractors we work with in Hawaii and Guam, started preparing. The ones who prepared are the ones who were ready when Phase 1 started.

This was also the period when I joined Intech Pacific, in October 2021. The CMMC 2.0 announcement came one month later. We were a general MSP at that point. Over the next several years, we became a compliance-first and cybersecurity-first company, largely because our clients needed us to be.

Era 5: The Proposed Rule and the Final Program Rule (2023 to 2024)

Between December 2023 and October 2024, CMMC went from a policy announcement to a binding federal regulation.

December 26, 2023: The proposed 32 CFR Part 170 rule. The DoD published the proposed program rule. Comments were due February 26, 2024. The proposed rule included detailed estimates:

• About 139,201 entities would need a Level 1 self-assessment.
• About 4,000 would qualify for a Level 2 self-assessment.
• About 76,598 would need a Level 2 C3PAO assessment, 95 percent of all Level 2 entities.
• About 1,487 would need Level 3.

It also estimated costs per assessment. For a small business, a Level 2 C3PAO assessment was estimated at about $104,670 over the three-year cycle. Those estimates covered assessment and affirmation. They did not include the cost of actually implementing the controls, which is where most of the money goes. I cover real-world costs in Part 10.

May 2, 2024: The DoD keeps Revision 2. NIST published SP 800-171 Revision 3 on May 14, 2024. Anticipating this, the DoD issued a class deviation on May 2, 2024 requiring contractors to continue using Revision 2 until further notice. CMMC Level 2 is still assessed against Revision 2 today.

August 15, 2024: The proposed DFARS rule. The DoD published the proposed 48 CFR rule that would put CMMC into contracts.

October 15, 2024: The final 32 CFR Part 170 rule. The DoD published the final program rule, effective December 16, 2024. Key provisions:

• Three levels as described in Part 1.
• Conditional status with a POA&M. A Level 2 contractor can receive conditional certification if it scores at least 88 of 110 (80 percent) and the only items on its POA&M are eligible lower-weight requirements. All POA&M items must be closed within 180 days, and a closeout assessment must confirm them.
• No POA&Ms at Level 1.
• Three-year validity for Level 2 and Level 3 certifications.
• Annual affirmations by a senior official of the company, attesting to continued compliance.
• A four-phase rollout tied to the effective date of the DFARS rule.
• Requirements for service providers, including cloud service providers and External Service Providers.

With the program rule final, the only thing left was the DFARS rule that would put CMMC clauses into contracts.

Era 6: The DFARS Rule and Phase 1 (2025)

In 2025, CMMC moved from regulation to contracts.

September 5, 2025: The Department of War title. Executive Order 14347 authorized "Department of War" as a secondary title for the Department of Defense in non-statutory use. The order was published in the Federal Register on September 10, 2025.

September 10, 2025: The final DFARS rule. On the same day, the DoW published the final 48 CFR rule, effective November 10, 2025. It:

• Added solicitation provision 252.204-7025, which tells offerors the CMMC level required.
• Revised clause 252.204-7021 to require a CMMC Unique Identifier in SPRS for each information system that will handle FCI or CUI.
• Required affirmations of continuous compliance by an affirming official.
• Required contractors to report changes to their CMMC Unique Identifiers to the contracting officer. A proposed requirement to notify the contracting officer of security lapses was dropped from the final rule.
• Required flow-down of CMMC requirements to subcontractors.
• Set a three-year phase-in and an exemption for COTS-only contracts.

November 10, 2025: Phase 1 begins. Contracting officers could now require Level 1 self-assessment or Level 2 self-assessment as a condition of award. They could also require a Level 2 C3PAO certification at their discretion.

The original four-phase schedule was:

• Phase 1 (November 10, 2025): Level 1 and Level 2 self-assessments required in applicable solicitations; C3PAO optional
• Phase 2 (November 10, 2026): Level 2 C3PAO certification required for applicable contracts involving CUI
• Phase 3 (November 10, 2027): Level 3 DIBCAC assessments begin; C3PAO required for option periods
• Phase 4 (November 10, 2028): Full implementation across all applicable contracts

For the contractors we work with, Phase 2 was the date that mattered. Nearly all of them handle CUI.

Intech Pacific, then Intech Hawaii, announced its own CMMC Level 2 certification in October 2025, just before Phase 1 began. I will explain in Part 6 why I think a provider's own certification is the single most important credential a contractor should look for.

Era 7: Phase 1 in Practice (November 2025 to July 2026)

The first eight months of Phase 1 showed steady growth in certifications, a new wave of enforcement, and continued concern about cost and assessor capacity.

February 1, 2026: The DFARS overhaul. As part of the government-wide Revolutionary FAR Overhaul (RFO), the DoW issued class deviations that reorganized cybersecurity clauses. The most important change for contractors: DFARS 252.204-7019 was eliminated, 7020 was renumbered as DFARS 252.240-7997, and the standalone requirement to upload a Basic NIST SP 800-171 self-assessment score to SPRS was removed. The cybersecurity rules moved from DFARS Part 204 to Part 240. Clauses 7012, 7021, and 7025 kept their numbers. The DoW's authority to conduct Medium and High assessments through DIBCAC was preserved.

This change confused a lot of people. It did not remove the NIST SP 800-171 requirement. It removed a duplicate reporting step, because CMMC status now goes into SPRS under 7021 and 7025.

Early to mid 2026: The ecosystem grows. Numbers reported from Cyber AB town halls through mid-2026 showed:

• About 100 authorized C3PAOs.
• More than 1,000 CMMC Certified Assessors nationwide by June 2026.
• Level 2 final certificates growing from about 900 in February 2026 to about 1,400 in May 2026.

Federal News Network later reported that nearly 2,000 contractors had achieved Level 2 certification by July 2026. Against an estimated 76,000 or more companies needing C3PAO certification, the math was clear. The ecosystem could not certify everyone by November 2026.

June 18, 2026: LOGZONE. An Alabama defense contractor, LOGZONE, agreed to pay $507,144 to resolve False Claims Act allegations. The company had reported a perfect SPRS score of 110. A DIBCAC assessment found a score of -170.

June 23, 2026: The FAR CUI rule is re-proposed. The FAR Council re-proposed its government-wide CUI rule as part of the FAR overhaul. It consolidated an earlier proposal from January 2025, would apply to civilian agency contracts as well as defense, would use NIST SP 800-171 Revision 3 as the baseline, and would require 72-hour incident reporting. Comments closed July 23, 2026. This rule has not been finalized.

Era 8: The Phase 2 Pause (July 2026 to Today)

On July 13, 2026, the DoW suspended CMMC Phase 2 and launched a 60-day review of the entire program. This is where things stand today.

July 13, 2026: The suspension. DoW Chief Information Officer Kirsten Davies issued a memo titled "Removing Barriers to Defense Industrial Base Expansion," with an implementing memo from Under Secretary of War for Acquisition and Sustainment Michael Duffey. The DoW announced that it was suspending Phase 2 and all pending and future CMMC implementation milestones.

What was suspended:

• The November 10, 2026 Phase 2 requirement for Level 2 C3PAO certification.
• Pending and future implementation milestones, including the later phases as scheduled.

What stayed in effect:

• DFARS 252.204-7012 and the requirement to implement NIST SP 800-171.
• Phase 1 self-assessment requirements.
• SPRS affirmations.
• Government-led assessments by DIBCAC.
• The 32 CFR Part 170 program rule itself. It was not revoked.

Active solicitations were to be amended as soon as practicable. Existing contracts with C3PAO requirements were to be modified at the next option or administrative modification.

The DoW formed a CMMC Reform Task Force with a 60-day window to review the program. Davies said that "robust cybersecurity and operational resilience remain critical." The Small Business Administration publicly supported the suspension, calling CMMC an untenable barrier for small contractors.

July 2026: A request for information. The DoW posted an RFI asking industry how to reform CMMC and reduce compliance burden. Responses were due August 14, 2026.

July 16, 2026: Class Deviation Revision 2. The DoW put the pause into the DFARS through a revision to Class Deviation 2026-O0025. Contracting officers could accept Level 1 or Level 2 self-assessment status in place of C3PAO certification.

July 16, 2026: The review begins. The task force held its first meetings. Federal News Network reported that Davies said the review could produce "everything from an overhaul, to small tweaks here and there."

July 29, 2026: The cost debate. A CSIS analysis compared an SBA estimate of about $594,000 in total compliance cost for a small contractor against the DoW's estimate of roughly $102,000. That gap is the heart of the political debate. The DoW's figure mostly covers the assessment. The SBA's figure includes implementation.

August 14, 2026: The RFI closes. DefenseScoop reported that the DoW received more than 1,100 responses totaling more than 10,000 pages. According to Davies, more than half of respondents supported the pause and some level of reform. Inconsistent CUI marking and scoping was among the main operational challenges raised. Contractors said they often could not tell what information was CUI because the government did not mark it clearly.

I agree with that feedback. In almost every contract review we do, we find CUI that is not marked, markings that are wrong, or contracts that reference CUI without saying what it is.

September 1, 2026: Honeywell. During the pause, Honeywell Aerospace agreed to pay more than $2 million to settle False Claims Act allegations that it failed to meet NIST SP 800-171 requirements between 2020 and 2023. The whistleblower received $375,823.

September 3, 2026: Class Deviation Revision 3. The DoW issued Revision 3 of the class deviation, which superseded Revision 2 and locked the Phase 2 suspension into binding acquisition regulation. It carried forward the acceptance of self-assessment status, directed removal of C3PAO requirements at the next option or modification, and preserved the DoW's authority to conduct Medium and High assessments.

September 9, 2026: "It's critical." Speaking at the Billington Cybersecurity Summit, Davies said, "This isn't about whether cybersecurity is important or not. It is. It's critical."

September 11, 2026: The review window closes. The 60-day review ended. The task force report goes to the CIO first.

As of late September 2026: No task force report has been published, and no new rule has been proposed. Industry commentary expects the report sometime in the fall, though it could slip.

CMMC Timeline at a Glance

• Nov 4, 2010: EO 13556 creates the government-wide CUI program
• Nov 18, 2013: First DFARS 252.204-7012 clause
• June 2015: NIST SP 800-171 published
• Aug 26, 2015: DFARS 7012 rewritten to require NIST SP 800-171 and expand 72-hour incident reporting
• Sept 14, 2016: 32 CFR Part 2002 CUI rule published
• Oct 21, 2016: DFARS 7012 final rule
• Dec 31, 2017: Deadline to implement NIST SP 800-171
• July 23, 2019: DoD IG report finds contractors failing to protect CUI
• Jan 31, 2020: CMMC 1.0 released: 5 levels, 171 practices
• Sept 29, 2020: DFARS interim rule creates 7019, 7020, 7021 and SPRS scoring
• Oct 6, 2021: DOJ launches the Civil Cyber-Fraud Initiative
• Nov 4, 2021: CMMC 2.0 announced: 3 levels, aligned to NIST SP 800-171
• Dec 26, 2023: Proposed 32 CFR Part 170 rule
• May 2, 2024: DoD keeps NIST SP 800-171 Rev 2 for contractors
• Aug 15, 2024: Proposed 48 CFR DFARS rule
• Oct 15, 2024: Final 32 CFR Part 170 rule published
• Dec 16, 2024: 32 CFR Part 170 takes effect
• Sept 10, 2025: Final 48 CFR DFARS rule published
• Nov 10, 2025: Phase 1 begins
• Feb 1, 2026: DFARS overhaul removes 7019 and the separate SPRS score upload
• June 18, 2026: LOGZONE False Claims Act settlement
• June 23, 2026: FAR CUI rule re-proposed
• July 13, 2026: DoW suspends Phase 2 and launches a 60-day review
• Aug 14, 2026: Reform RFI closes with 1,100+ responses
• Sept 1, 2026: Honeywell False Claims Act settlement
• Sept 3, 2026: Class Deviation Revision 3 locks in the suspension
• Sept 11, 2026: 60-day review window closes

Six Lessons From 15 Years of CMMC History

Looking at the timeline as a whole, a few patterns are hard to miss. They are the reason I give the advice I do.

1. The requirements have been stable. The verification has not. The 110 requirements in NIST SP 800-171 Revision 2 have been in place since 2020, and the original 800-171 requirements date to 2015. What has changed, repeatedly, is how the government checks. Contractors who waited for the verification rules to settle have been waiting for almost a decade while the requirement itself stayed the same.
2. Every delay has been followed by more enforcement. CMMC 1.0 was replaced, and the DOJ launched the Civil Cyber-Fraud Initiative. The rulemaking took years, and settlements increased. Phase 2 was paused, and two more settlements were announced within weeks. The government has consistently used enforcement to fill the gap while verification is delayed.
3. Deadlines move, but they do not disappear. The original CMMC 1.0 schedule, the 2023 target dates, the October 2025 and October 2026 dates quoted in older content, and now the November 2026 Phase 2 date have all shifted. None of those shifts removed the underlying obligation.
4. The program has become simpler, not more complicated. Five levels became three. 171 practices became 110 requirements. Maturity processes were removed. Duplicate SPRS reporting was eliminated in 2026. Each revision made the program easier to understand, even when it did not make the work easier.
5. Cost has always been the central debate. From the first CMMC 1.0 pilots to the 2026 SBA analysis, the question of who pays and how much has driven every major change. I expect the next revision to include some form of cost relief, but I do not expect it to change what a secure environment requires.
6. Contractors who prepared early have done better at every stage. The contractors in Hawaii and Guam who started working on NIST SP 800-171 years ago were ready for Phase 1, had strong SPRS scores, and were able to pursue C3PAO certification when their primes asked for it. The contractors who waited are now trying to catch up in a market with limited local expertise.

Part 3: What the 2026 CMMC Pause Means for Your Contracts

The 2026 pause changed how contractors prove compliance. It did not change what contractors are required to do. If your contract includes DFARS 252.204-7012, you are still required to implement all 110 requirements of NIST SP 800-171, report incidents within 72 hours, and keep an accurate record of your status in SPRS.

I have had this conversation dozens of times since July. Some contractors heard "CMMC is paused" and stopped their projects. Others heard the same news and asked me whether they should speed up. The right answer depends on your contracts, your primes, and how close you are to ready. But the starting point is the same for everyone: understand exactly what changed and what did not.

What Was Suspended in July 2026?

The July 13, 2026 memo suspended the Phase 2 requirement that contractors handling CUI obtain a Level 2 certification from a C3PAO, along with pending and future implementation milestones. Contracting officers can now accept a Level 1 or Level 2 self-assessment in place of a C3PAO certification.

In practical terms:

• New solicitations will not require Level 2 C3PAO certification as a condition of award while the suspension is in effect.
• Active solicitations with C3PAO requirements are to be amended.
• Existing contracts with C3PAO requirements are to be modified at the next option exercise or administrative modification.
• The planned Phase 3 and Phase 4 milestones are on hold along with Phase 2.

What Did Not Change?

Nearly everything else stayed in place:

• DFARS 252.204-7012. Still in effect. Still requires NIST SP 800-171, 72-hour incident reporting, media preservation, and FedRAMP Moderate equivalent cloud services.
• NIST SP 800-171 Revision 2. Still the standard. All 110 requirements still apply.
• 32 CFR Part 170. The program rule was not revoked. It remains a federal regulation.
• DFARS 252.204-7021 and 7025. Still in the DFARS. Contracting officers can still require Level 1 or Level 2 self-assessment status.
• SPRS affirmations. A senior official still has to affirm compliance, and that affirmation is still a statement to the federal government.
• DIBCAC assessments. The DoW kept its authority to conduct Medium and High assessments of contractors.
• The False Claims Act. Still fully in effect, and actively enforced during the pause.
• Your primes' requirements. Your subcontract is a private agreement. If your prime requires a C3PAO certification, you still need one.

That last point is the one that surprises people most. Several large primes have publicly told their suppliers to keep moving forward. From what we are seeing with clients in Hawaii and Guam, primes have not relaxed their flow-down expectations. Some are asking harder questions than before.

Why Did the DoW Pause CMMC Phase 2?

The DoW paused Phase 2 because the assessment ecosystem could not certify every affected contractor by November 2026, and because the cost to small businesses had become a political issue. Both reasons are real.

On capacity, the numbers speak for themselves. About 100 authorized C3PAOs and about 2,000 Level 2 certificates by mid-2026, against tens of thousands of companies needing certification. Even at an accelerated pace, most companies would not have been certified by November 10, 2026.

On cost, the SBA and many small contractors argued that the full cost of compliance was far higher than the DoW's estimates. The DoW's figures largely counted the assessment itself. The SBA counted implementation, tools, staff time, and ongoing maintenance. I think the SBA's view is closer to what contractors actually experience, and I cover real numbers in Part 10.

What the pause was not about: it was not a finding that NIST SP 800-171 is unnecessary, or that contractors had become secure. The DoW's own statements during the pause have been consistent that cybersecurity is critical. The question on the table is how to verify it, not whether to require it.

Should You Stop Your CMMC Project During the Pause?

No. I recommend continuing your CMMC Level 2 preparation during the pause, and I have given that same advice to every client and prospect since July.

Here are the reasons I give:

1. You are already required to meet NIST SP 800-171. If your contract has DFARS 7012, the requirement has been in effect since 2017. The pause did not change it.
2. Your SPRS affirmation is a legal statement. If you affirm compliance and you are not compliant, you have a False Claims Act problem whether or not a C3PAO ever looks at you.
3. Your primes may still require certification. Private flow-down requirements are not affected by the DoW memo.
4. Voluntary C3PAO assessments are still available. C3PAOs are still conducting Level 2 assessments. A certification earned now remains valid for three years.
5. The work takes a long time. In our experience, getting a typical small contractor to assessment-ready takes many months. If a revised requirement returns in 2027, companies that stopped will be starting over against a crowded assessor calendar.
6. The security benefit is real. Following NIST SP 800-171 makes your company harder to breach. That benefit does not depend on the DoW's timeline.

There is a seventh reason that I think about often. CMMC exists to protect the warfighter. The information in our clients' environments includes drawings, specifications, and logistics data for systems our service members depend on. Protecting that information is the point of the program. It was the point before the pause, and it still is.

What About Contractors Who Were Mid-Assessment?

If you were scheduled for a C3PAO assessment, I generally recommend keeping the date. A C3PAO certification is still recognized, it is still valid for three years, and it satisfies any prime that requires it. If the eventual reform includes some form of recognition for companies already certified, which several commentators have suggested, you will be in the strongest position.

If your assessment date is close and you are not ready, the pause gives you room to move it without contract pressure. Use that time to close gaps rather than to stop.

What About Level 1 Contractors?

Level 1 contractors are affected very little by the pause. Level 1 was always a self-assessment. The requirement to meet all 15 FAR 52.204-21 requirements, complete an annual self-assessment, and affirm in SPRS continues. If you only handle FCI, keep your annual cycle on schedule.

What the Pause Means for Your Situation

The right response to the pause depends on where you are today. Here is how I would advise each type of contractor.

If you are already Level 2 certified: Keep maintaining your environment exactly as assessed. Complete your annual affirmation on time. Your certification remains valid for three years and puts you ahead of competitors with primes. If reform eventually includes recognition for companies already certified, you will benefit.

If you are close to assessment-ready: Keep your assessment date if you can. Assessor calendars are less crowded than they would have been before November 2026, which may make scheduling easier now than later.

If you are in the middle of remediation: Keep going. Use the pause to finish the work properly rather than rushing it. Focus on documentation and evidence, which is where most projects fall behind.

If you have not started: Start with an honest gap assessment and a review of your SPRS status. Your immediate priority is making sure your affirmation is accurate. Then build a roadmap you can execute over the next year.

If you only handle FCI: Keep your Level 1 annual cycle on schedule. The pause does not change Level 1.

If you are a prime: Decide what you will require of your subcontractors, and tell them in writing. Your ability to perform on future contracts depends on their readiness. Many primes are continuing to require C3PAO certification from suppliers handling CUI.

If you are an MSP serving defense contractors: Expect your clients and their primes to ask harder questions about your own security. The pause has not reduced the scrutiny on providers that have access to CUI environments.

Questions to Ask Your Prime During the Pause

If you are a subcontractor, the pause makes communication with your primes more important. Here are the questions I recommend asking, in writing:

1. Has your CMMC requirement for our subcontract changed since July 13, 2026?
2. Will you continue to require a Level 2 C3PAO certification from us, and if so, by when?
3. Will you accept a Level 2 self-assessment in the meantime?
4. What SPRS information do you need from us, and how often?
5. Will you be sending us CUI on this subcontract, and how will it be marked?
6. Is there a specific scope or system you expect us to use for your CUI?
7. Do you have a supplier readiness program or survey we should complete?

Keep the answers with your compliance records. If a dispute or audit ever arises, you will want a clear record of what your prime told you.

Part 4: What Happens After the CMMC Pause?

No one outside the task force knows exactly what will come next. The 60-day review window closed on September 11, 2026, and the report has not been published as of this writing. What we can do is look at the options that have been discussed publicly, the feedback the DoW received, and the legal process required to change a federal regulation.

I will cover the realistic scenarios first, then share my own view.

Why the Pause Cannot Last Forever Without Rulemaking

32 CFR Part 170 is a final federal rule. A policy memo and a class deviation can change how the DFARS clauses are applied in contracts, but they cannot rewrite the program rule. Any permanent change to the levels, the assessment requirements, or the phase schedule would require new rulemaking, which typically takes many months and often more than a year.

That means the current situation, with the program rule in place and C3PAO requirements suspended in contracts, could last for a while. It also means any major redesign would come with a public comment period. Contractors will have notice.

Scenario 1: Phase 2 Returns Later in Revised Form

The most commonly discussed outcome is that third-party assessment returns on a later schedule with changes intended to reduce cost and burden. Possible changes include clearer scoping rules, phased applicability by contract type, and relief for small businesses.

If this happens, the 110 requirements stay the same, the need for a C3PAO eventually returns for most CUI contracts, and contractors who kept preparing are well positioned. I think this is the most likely outcome in some form.

Scenario 2: Third-Party Assessment Narrows to High-Priority Programs

A second possibility is that C3PAO certification becomes required only for higher-priority programs, with most CUI contractors staying on self-assessment backed by government spot checks.

If this happens, fewer contractors would need a C3PAO. But self-assessment would carry more risk, not less, because the government would rely more heavily on enforcement. I discuss this in Part 5.

Scenario 3: Self-Assessment Plus Enforcement Becomes the Model

A third possibility is that the current interim approach becomes permanent: self-assessments, SPRS affirmations, DIBCAC assessments, and False Claims Act enforcement.

This is essentially a return to the pre-CMMC model with stronger teeth. The LOGZONE and Honeywell settlements during 2026 show what that enforcement looks like. Under this model, a contractor with an inflated SPRS score is exposed to whistleblowers, DIBCAC findings, and DOJ investigations.

Scenario 4: The FAR CUI Rule Changes the Baseline

The government-wide FAR CUI rule re-proposed in June 2026 would apply CUI safeguarding to civilian agency contracts and use NIST SP 800-171 Revision 3 as the baseline. If it is finalized, it could eventually push the DoW to align CMMC with Revision 3.

For contractors, this would mean a transition from Revision 2 to Revision 3 at some point. Revision 3 reorganizes the requirements and adds organization-defined parameters. It does not reduce the amount of work. Contractors who have implemented Revision 2 well will have a much easier transition than those starting from nothing.

Scenario 5: Targeted Reforms From Industry Feedback

The RFI responses pointed to several specific reforms that could be adopted regardless of the broader outcome:

• Better CUI marking and scoping guidance from the government, a major theme in the responses.
• A graduated path between Level 1 and Level 2.
• Prioritization of high-impact controls.
• Recognition for companies already certified.
• Reciprocity with FedRAMP and other frameworks.
• Cost relief, such as grants, clearer rules on cost allowability, or limits on unnecessary Level 2 flow-downs.

Better CUI marking alone would help our clients in Hawaii and Guam. Much of our scoping work today is figuring out what the government meant by the markings, or lack of markings, on the documents it sent.

Scenario 6: The Program Is Cancelled

Some commentators have raised the possibility that CMMC is cancelled entirely. I think this is the least likely outcome. Even if it happened, DFARS 7012 and NIST SP 800-171 would remain in contracts. The DoW would simply return to verifying compliance through self-attestation and enforcement, which is Scenario 3.

My View on What Comes Next

I expect third-party verification to return in some form, likely with a later start date, clearer scoping guidance, and some relief aimed at small businesses. I do not expect the 110 requirements to change until the DoW moves to Revision 3, and when it does, the work will increase rather than decrease.

I also expect enforcement to keep increasing in the meantime. The DoW and DOJ have both made clear that the pause is about verification, not about the requirement. Every settlement announced during the pause reinforces that message.

Here is how I would summarize it for a business owner. The pause gives you more time. It does not give you a pass. The companies that use the time well will be ready for whatever version of CMMC comes next. The companies that stop will be starting over under pressure.

How We Will Keep This Guide Current

We will update this guide when the task force report is released, when any new rule is proposed, and when the phase schedule changes. The "Last updated" date at the top of this page will tell you when we last revised it.

Part 5: Enforcement, the False Claims Act, and Why the Pause Raised the Stakes

The False Claims Act is the main enforcement tool the federal government uses against contractors that misrepresent their cybersecurity. It applies whether or not CMMC Phase 2 is in effect. In my view, the pause increased False Claims Act risk for many contractors, because the government is now relying more heavily on self-assessments.

What Is the False Claims Act?

The False Claims Act is a federal law, dating to 1863, that imposes liability on anyone who knowingly submits a false claim for payment to the government. For cybersecurity, a claim can be false if a contractor is paid under a contract that requires NIST SP 800-171 while knowingly failing to meet it, or while misrepresenting its compliance.

Key features:

• Treble damages. The government can recover up to three times its damages.
• Per-claim penalties. Civil penalties apply to each false claim, adjusted annually for inflation.
• Private individuals, often current or former employees, can file suit on the government's behalf and receive a share of the recovery.
• "Knowingly" includes reckless disregard. A contractor does not have to intend fraud. Ignoring obvious gaps, or signing an affirmation without checking, can meet the standard.

One correction to older content, including some of ours: penalties are not calculated as a flat amount per control. They are calculated per false claim, such as each invoice, plus damages.

The DOJ Civil Cyber-Fraud Initiative

In October 2021, the Department of Justice launched the Civil Cyber-Fraud Initiative to pursue contractors that knowingly provide deficient cybersecurity, misrepresent their security practices, or fail to report incidents. Since then, the pace of settlements has increased steadily.

Cybersecurity False Claims Act Cases Every Contractor Should Know

These cases show how the government applies the law. Each is drawn from public DOJ announcements or court filings.

• Comprehensive Health Services (March 2022), $930,000: First settlement under the Civil Cyber-Fraud Initiative, involving failure to store medical records securely
• Aerojet Rocketdyne (July 2022), $9 million: Whistleblower case alleging misrepresented compliance with DoD and NASA cybersecurity requirements
• Penn State (October 2024), $1.25 million: Alleged failure to implement NIST SP 800-171 on DoD and NASA contracts
• MORSECORP (March 2025), $4.6 million: Alleged use of a non-compliant cloud provider, missing SSP, and an inaccurate SPRS score
• Raytheon and Nightwing (May 2025), $8.4 million: Alleged use of a non-compliant system to handle covered defense information
• Georgia Tech Research Corporation (September 2025), $875,000: Settled litigation in which DOJ intervened, alleging failure to implement required controls and an inaccurate assessment score
• LOGZONE (June 2026), $507,144: Reported an SPRS score of 110; a DIBCAC assessment found -170
• Honeywell Aerospace (September 2026), More than $2 million: Alleged NIST SP 800-171 gaps from 2020 to 2023; whistleblower received $375,823

A few patterns stand out:

• SPRS scores are evidence. In several cases, the gap between the score a contractor reported and its actual state was central.
• Company size does not matter. Settlements range from universities and small contractors to some of the largest defense companies in the country.
• Whistleblowers drive many cases. Employees who know where the gaps are can bring cases.
• Enforcement continued during the pause. LOGZONE and Honeywell were both announced in 2026.

How Inflated SPRS Scores Create Risk

The mistake I see most often is not in the submission to SPRS. It is in the self-assessment behind it. When contractors do their own gap assessments, they are almost always generous with their scores. They mark a requirement as met because a policy exists, or because a tool is installed, without checking every assessment objective.

When I assess the same environment, the score is usually much lower. That gap is the exposure. If a senior official affirms a score of 110 and the real score is closer to 40, the company has a problem that no amount of paperwork after the fact will fix.

There is a second practical issue. Many contractors discover late that they do not have access to SPRS or PIEE, or that the person who had access has left the company. Getting access can take days to weeks. Do not wait until a contracting officer asks for your score to find out.

How the SPRS Score Is Calculated

The SPRS score comes from the DoD Assessment Methodology. Understanding how it works makes it much easier to see why self-assessed scores are so often too high.

The calculation starts at 110, one point for each requirement. For every requirement that is not fully implemented, you subtract its assigned weight:

• 5 points for requirements whose absence could lead to significant exploitation of the network or exfiltration of CUI. Examples include MFA, limiting access to authorized users, and FIPS-validated encryption.
• 3 points for requirements whose absence has a specific and confined effect on the security of the network and its data.
• 1 point for requirements with a more limited or indirect effect.

Two requirements allow partial scoring. MFA (3.5.3) subtracts 3 points instead of 5 if MFA is in place for remote and privileged users but not for all general users. FIPS-validated cryptography (3.13.11) subtracts 3 points instead of 5 if encryption is used but is not FIPS validated.

Because the heaviest requirements are the ones most often missing in small environments, scores drop quickly. A company missing MFA, FIPS-validated encryption, audit log review, and a handful of other common gaps can fall well below zero. The lowest possible score is -203.

Two rules catch many self-assessors:

1. A requirement is met only if every assessment objective is met. If a requirement has four objectives and you meet three, the requirement is not met, and you subtract its full weight.
2. The SSP is binary. If you do not have an SSP, you cannot complete a valid assessment at all.

Here is a simplified example of how quickly a score changes. Suppose a contractor believes it is compliant but has these gaps:

• MFA not enforced on VPN (3.5.3): 5 points
• Encryption not FIPS validated (3.13.11): 3 points
• Logs collected but not reviewed (3.3.5): 5 points
• No incident response testing (3.6.3): 1 point
• No formal risk assessment (3.11.1): 3 points
• Vulnerability scans not recurring (3.11.2): 5 points
• No documented baselines (3.4.1): 5 points
• Former employee accounts still active (3.9.2): 5 points
• Removable media not controlled (3.8.7): 5 points
• Unescorted visitors (3.10.3): 1 point

That is 38 points from ten gaps many companies would consider minor, taking the score from 110 to 72. At 72, the company would not qualify for conditional certification, because the threshold is 88. And the gaps I listed are only the ones the company knows about. In practice, an independent assessment usually finds more.

The point values above are drawn from the DoD Assessment Methodology as I understand it. Always confirm against the current methodology document when you calculate your own score.

How to Reduce False Claims Act Risk

1. Get an independent assessment of your current NIST SP 800-171 status from someone who does not have a stake in the answer.
2. Correct your SPRS score if it is higher than your actual status. Voluntary correction and self-disclosure are viewed very differently from a score discovered to be false.
3. Keep your SSP and POA&M accurate and tied to your real environment.
4. Make sure the affirming official understands what they are affirming and has evidence to support it.
5. Document everything. If you are ever questioned, the difference between a good-faith gap and reckless disregard is often the documentation.
6. Train your staff and create a way for employees to raise concerns internally.

In finance, I learned that documentation and reporting are critical because regulators check them. Defense contractors are now in the same position. The government has made clear it will check.

Part 6: Who Is Actually Qualified to Sell CMMC Services?

This is the part of the guide I care about most. Contractors need to understand one thing before they hire anyone for CMMC work: many of the badges used to market CMMC services are registrations, not certifications, and they do not prove that the provider can get you through an assessment.

We are seeing more non-credentialed companies and individuals selling CMMC services in Hawaii and Guam than ever before. The pattern is consistent. A contractor pays for a gap assessment, a documentation package, or a platform. Months later, they bring us in, and we find that most of the work has to be redone. We have multiple clients that spent hundreds of thousands of dollars with another provider and ended up no closer to certification.

I am not writing this to criticize competitors by name. I am writing it because contractors deserve to know what the credentials mean before they spend the money.

The CMMC Ecosystem in Plain Language

The CMMC ecosystem is managed by The Cyber AB under an agreement with the DoW, with training and certification of individuals handled by ISACA, which became the CMMC Assessors and Instructors Certification Organization (CAICO) in December 2025. The ecosystem includes two kinds of credentials: registrations for people and companies that provide consulting services, and certifications for people and companies that conduct assessments.

• RP (Registered Practitioner): Registration held by an individual. Requires: Online training, open-book quiz, code of conduct, background check, fee. Can participate in a C3PAO assessment: No
• RPA (Registered Practitioner Advanced): Registration held by an individual. Requires: RP plus additional training. Can participate in a C3PAO assessment: No
• RPO (Registered Provider Organization): Registration held by a company. Requires: Fee, agreement, and at least one RP on staff. Can participate in a C3PAO assessment: No
• CCP (Certified CMMC Professional): Certification held by an individual. Requires: Approved curriculum, proctored exam, DoD Tier 3 background investigation. Can participate in a C3PAO assessment: Yes, in a supporting role
• CCA (Certified CMMC Assessor): Certification held by an individual. Requires: Active CCP, advanced training, proctored exam, verified IT and audit experience, and a qualifying DoD 8140 cybersecurity certification such as CISSP. Can participate in a C3PAO assessment: Yes, conducts assessments
• C3PAO (Certified Third-Party Assessment Organization): Authorization held by a company. Requires: Its own DIBCAC-assessed environment, CCAs on staff, and authorization by The Cyber AB. Can participate in a C3PAO assessment: Yes, it is the assessor
• CMMC Level 2 certified provider: Certification of the provider's own environment held by a company. Requires: Passed its own C3PAO assessment against all 110 requirements. Can participate in a C3PAO assessment: Not as an assessor, but it has proven it can pass one

What an RP, RPA, or RPO Actually Proves

An RP, RPA, or RPO shows that a person or company has registered with the CMMC ecosystem and agreed to its code of professional conduct. It does not show that the person has passed a rigorous exam, that the company's own environment meets NIST SP 800-171, or that anyone involved has helped a client pass a C3PAO assessment.

Here is what it takes to become a Registered Practitioner:

• Watch online training videos.
• Pass a basic, open-book online quiz.
• Sign a professional conduct agreement.
• Pass a basic background check.
• Pay a registration fee.

That is the entire process. It is useful as an entry point to the ecosystem. It is not evidence of expertise.

An RPO is a company that has registered and has at least one RP on staff. The RPO badge shows up on a lot of websites, and I understand why. It looks official. But an RPO badge does not prove that the provider's own environment has ever been assessed. It does not prove the provider has implemented the controls it is advising you on. It does not prove the provider has experience with evidence collection, assessor interviews, or control testing.

I have said publicly that I think The Cyber AB should retire the RP, RPA, and RPO designations. They are not certifications, and too many people are using them to sell services they are not qualified to deliver.

We once used the RPO designation in our own marketing. We stopped, because we no longer think it tells a contractor anything meaningful. What matters is certification and a track record.

What CCP and CCA Certifications Prove

A CCP or CCA certification shows that a person has completed structured, approved training, passed a proctored exam on NIST SP 800-171, scoping, and assessment methodology, and cleared a DoD Tier 3 background investigation. These are professional certifications, not registrations.

Certified CMMC Professional (CCP) requirements:

• Complete an approved curriculum through a Licensed Training Provider.
• Pass a strict, proctored certification exam.
• Pass a DoD Tier 3 background investigation.
• Maintain the certification through continuing education and ethical standards.

A CCP can support a Level 2 assessment as a member of an assessment team.

Certified CMMC Assessor (CCA) requirements:

• Hold an active CCP certification first.
• Complete advanced CCA training.
• Pass a more rigorous proctored exam.
• Prove substantial, verifiable IT and cybersecurity experience, typically three years or more.
• Prove at least one year of assessment or audit experience.
• Hold a baseline cybersecurity certification from the DoD 8140 list, such as CISSP.

A CCA can conduct official CMMC Level 2 assessments as part of a C3PAO.

When I went through the CCA process, I did not have many surprises, because I had already been involved in more than 100 gap assessments. What the process gave me was a deeper understanding of how assessors think and the confidence to lead our clients through the assessment itself. That is the value a CCA brings to a readiness engagement. We know what the assessor will ask for, because we have been trained to ask for it.

What a C3PAO Is, and Why It Cannot Also Be Your Consultant

A C3PAO is the organization that conducts your official Level 2 assessment and issues your certification. To become a C3PAO, a company must pass its own DIBCAC assessment, have CCAs on staff, and be authorized by The Cyber AB.

A C3PAO cannot provide consulting to a company it assesses. The ecosystem's conflict-of-interest rules separate the people who help you prepare from the people who judge whether you are ready. That separation is intentional, and it is the reason your readiness partner and your assessor should be different organizations.

The Cyber AB publishes the list of authorized C3PAOs in the CMMC Marketplace. Any C3PAO you consider should appear there.

Why a Provider's Own CMMC Level 2 Certification Matters Most

When a contractor asks me what to look for in a CMMC provider, my first answer is always the same. Look for a provider that is CMMC Level 2 certified itself.

A provider that has passed its own C3PAO assessment has done what it is asking you to do. It has scoped its own environment, implemented all 110 requirements, written an SSP that matches reality, collected evidence, sat through assessor interviews, and had its controls tested. A provider that has never been through an assessment is working from theory.

This also matters for a practical reason. If your MSP will store, process, or transmit CUI, or will provide security protection for your environment, it is part of your assessment scope. An MSP that has not been assessed can become the weak link in your own assessment.

Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam. We announced our certification in October 2025, before Phase 1 began. We pursued it because we did not think we could credibly ask our clients to go through the process if we had not gone through it ourselves.

My second answer is to look for CCAs and CCPs on staff. Intech Pacific is the only MSP in Hawaii and Guam with both CCPs and CCAs on staff. As of September 2026, we have two of the three CCAs based in Hawaii. The third works as an internal resource for a contractor, not for a service provider. Our CCPs support our engagements in Hawaii and Guam.

My third answer is track record. Intech Pacific has taken more companies through C3PAO certification than every other company in Hawaii and Guam combined. For a longer list of what to ask any provider about its record, see our post on past performance and CMMC. Our published case studies include MK Engineers and PacMar Technologies.

The Do-Over Problem: What We See When Contractors Come to Us Second

When contractors come to us after working with an unqualified provider, the problems are remarkably consistent. The most common issue is documentation that does not match the environment.

Here is what we typically find:

1. Generic, template documentation. Policies and an SSP that were clearly written for another company or downloaded from the internet. They describe tools the contractor does not use and processes the contractor does not follow. Every company we have ever done a gap assessment for lacked the right documentation, including companies that had paid a third party to create it.
2. An SSP that is not detailed enough. Most SSPs we inherit describe each requirement in a sentence or two. An assessor needs to know how each assessment objective is met, by what system, and who is responsible. Most people who write SSPs have never been through a C3PAO assessment, so they do not know how to structure one.
3. Wrong scoping. The CUI boundary was never defined, or was drawn in a way that does not match how information actually flows. Sometimes CUI is in systems the provider never looked at. Sometimes the scope is far larger than it needs to be, which drives up cost.
4. Tools that do not meet requirements. Cloud services that are not FedRAMP Moderate or equivalent. Encryption that is not FIPS validated. Logging that is not retained or reviewed.
5. An inflated self-assessment score. A score that credits requirements as met because a policy was written, not because the control is implemented and evidenced.
6. No evidence strategy. Nobody planned how the contractor would prove each requirement to an assessor.
7. No shared responsibility matrix. The contractor does not know which requirements it owns and which its providers own.
8. No one who can speak to the assessor. The contractor has no point of contact who can explain the environment, the documentation, and the evidence in an interview.

Each of these can be fixed. But fixing them usually means starting the documentation over, re-scoping the environment, and sometimes replacing tools. The contractor ends up paying twice and losing months.

Nine Questions to Ask Before You Hire a CMMC Partner

Before you sign with any CMMC provider, ask these questions and expect specific answers:

1. Is your own company CMMC Level 2 certified? If not, why not? If yes, when, and by which C3PAO?
2. Which credentials does your team hold? Ask specifically whether they are registrations (RP, RPA, RPO) or certifications (CCP, CCA).
3. How many clients have you taken through a C3PAO assessment, and did they pass? Ask for the number, not a general statement.
4. Can I speak with a client you helped achieve Level 2 certification? References should be easy for a qualified provider to give.
5. Who will do the work? Find out whether a certified person will lead your engagement, or whether the credentialed person only appears in the sales meeting.
6. How do you scope CUI? A good answer involves reviewing your contracts, your data flows, and your users, not assuming a boundary.
7. Will you write our SSP, and how detailed will it be? Ask to see a redacted example.
8. Will your services store, process, or transmit our CUI? If yes, the provider is in your scope and must meet the requirements itself.
9. Will you provide a shared responsibility matrix? It should define who owns each of the 110 requirements.

Red Flags When Evaluating CMMC Providers

Be cautious if you see any of these:

• A guaranteed pass. No provider can guarantee a certification outcome. The C3PAO makes that determination.
• Heavy reliance on the RPO badge as the primary credential.
• No named clients that have achieved Level 2 certification.
• A single product sold as a complete CMMC solution.
• A documentation package delivered without a detailed review of your environment.
• Reluctance to discuss the SSP or to show examples.
• Skipping scoping and moving directly to tools.
• Vague answers about who does the work.
• Unusually low pricing. Real CMMC work takes real hours. If a price seems too good, ask what is missing.

How to Verify a Provider's Credentials

You do not have to take a provider's word for its credentials:

• C3PAOs are listed in the Cyber AB Marketplace.
• CCAs and CCPs can be verified through the Cyber AB Marketplace and CAICO.
• A provider's own CMMC certification can be discussed in detail by the provider. Ask for the date, the level, and the C3PAO. A provider that has earned it will be happy to talk about it.
• References can confirm whether the provider actually led a client through a successful assessment.

Do These Rules Apply the Same Way in Guam?

Yes. CMMC credentials, requirements, and assessment rules are the same in Guam as in Hawaii and the mainland. There is no separate structure for Guam contractors. What is different in Guam is access. There are even fewer local resources, costs are higher, and distance makes on-site work harder to schedule. That makes choosing a qualified provider the first time even more important, because replacing a provider in the middle of a project is harder in a smaller market.

Why This Matters More Than Ever During the Pause

The pause has created a new opening for unqualified providers. With C3PAO certification temporarily off the contract timeline, it is easier to sell a self-assessment, a documentation template, or a platform without the discipline an assessment imposes.

That creates risk for the contractor. A self-assessment done poorly leads to an inflated SPRS score. An inflated SPRS score, affirmed by a senior official, is exactly the fact pattern in the False Claims Act cases in Part 5. The pause did not lower the standard. It moved the verification from a C3PAO to the contractor's own affirmation, and that makes the quality of the help you receive more important, not less.

Part 7: Scoping and Technology for CMMC Level 2

Scoping is the most important technical decision in any CMMC project, because it determines which systems, people, and facilities an assessor will evaluate. A well-defined scope reduces cost and risk. A poorly defined scope either leaves CUI unprotected or forces you to secure far more than you need to.

How to Find CUI in Your Contracts

The first step in scoping is finding out what CUI you actually handle, and that starts with your contracts. Many contractors do not know whether they have CUI until someone reads the contract documents carefully.

Here is the process we use:

1. Gather every contract document. Include the base contract, modifications, statements of work, attachments, the DD Form 254 if there is one, the Contract Data Requirements List (CDRL), and every subcontract and purchase order you have received.
2. Search for key clauses. Look for DFARS 252.204-7012, 7021, and 7025, and FAR 52.204-21 (renumbered FAR 52.240-93 in newer contracts under the FAR overhaul).
3. Search for key language. Phrases such as "controlled unclassified information," "CUI," "covered defense information," "export controlled," "ITAR," "EAR," "distribution statement," and "NIST SP 800-171."
4. Review the documents you actually receive. Look for CUI banner markings, distribution statements on drawings, and export control warnings.
5. Map where that information goes. Once you know what CUI you receive, find every place it is stored, processed, or transmitted: email, file shares, laptops, engineering workstations, printers, removable media, and third-party services.
6. Ask your prime or contracting officer when the markings are unclear. Document the answer.

Inconsistent marking is a real problem. It was one of the main challenges raised in the RFI responses the DoW received in 2026. Until the government improves its guidance, contractors have to make reasonable, documented decisions about what they are protecting.

Common Places CUI Hides

When we scope an environment, we almost always find CUI somewhere the contractor did not expect. These are the places we check first:

• Drawings and specifications attached to messages, forwarded to personal addresses, or synced to phones.
• Downloads folders. Files opened from a secure portal and saved locally without anyone thinking about it.
• Engineering and design workstations. CAD files and models stored locally for performance.
• Shared drives and consumer file-sharing services. Folders set up years ago and never reviewed.
• Printers and scanners. Devices that store copies of scanned documents on internal drives.
• Backup services that are not approved for CUI.
• Collaboration tools. Chat, meeting recordings, and shared whiteboards.
• Job-site devices. Laptops, tablets, and phones used by field staff.
• Removable media. USB drives used to move files between systems or to plotters.
• Ticketing and project management systems. Attachments uploaded to support tickets or project tasks.

Each of these is either brought inside the boundary with the required protections or locked down so that CUI cannot end up there. Doing that well is the difference between a boundary that holds up in an assessment and one that does not.

CUI, Remote Work, and Job Sites

Remote work and field work are common in Hawaii and Guam, and both affect CMMC scope. Every location where CUI is accessed has to meet the relevant requirements.

For remote workers:

• Access CUI only through company-managed, compliant devices.
• Use a secure connection that does not allow split tunneling.
• Apply the same MFA, session lock, and encryption requirements as in the office.
• Follow a written alternate work site policy covering physical protection, such as screen privacy and securing printed material.

For job sites and field offices:

• Treat job-site laptops and tablets as CUI assets if they access CUI.
• Control physical access to temporary offices and trailers.
• Avoid printing CUI on site unless the printer and storage are controlled.
• Plan for connectivity loss without creating workarounds that move CUI outside the boundary.

Construction and field service contractors often underestimate this part of scoping. The office may be well protected while the field is not.

Email and File Sharing With CUI

Email and file sharing are where most CUI moves, and they are where many contractors create unintended gaps.

A few practical rules:

• Use an email and file-sharing platform approved for CUI. Under DFARS 7012, that means FedRAMP Moderate or equivalent.
• Share CUI with outside parties through controlled methods. Use approved secure sharing rather than attachments to external addresses whenever possible.
• Label and classify. Sensitivity labels can help users identify CUI and apply protections automatically.
• Prevent forwarding to personal accounts. Configure rules to block automatic forwarding outside the organization.
• Know what your partners use. If your prime or subcontractor sends CUI to a system that is not approved, you may still be responsible for where it ends up.

Asset Categories in CMMC Scoping

The CMMC scoping guidance for Level 2 sorts assets into categories:

• CUI assets: process, store, or transmit CUI. Fully in scope.
• Security Protection Assets: provide security functions for the CUI environment, such as firewalls, identity systems, and security monitoring tools. In scope.
• Contractor Risk Managed Assets: can, but are not intended to, handle CUI because of policy and procedure. Documented in the SSP and subject to review.
• Specialized Assets: such as operational technology, test equipment, IoT devices, and government-furnished equipment. Documented in the SSP and managed with a risk-based approach.
• Out-of-scope assets: cannot handle CUI and are physically or logically separated from CUI assets.

The categories matter because they determine what an assessor will evaluate. Getting them wrong is one of the most common reasons scoping goes wrong.

Enclave vs. Enterprise: Which CMMC Scoping Approach Is Right?

An enclave limits your CMMC scope to a separate, secured environment used only by the people and systems that handle CUI. An enterprise approach brings your entire company into scope. The right choice depends mainly on how many of your users need access to CUI.

My rule of thumb: an enclave usually makes sense when you can clearly identify which users need CUI access and that group is less than 25 to 50 percent of your staff. Once that group is more than about half of your company, the math of running a separate enclave usually stops making sense, and bringing the whole environment into compliance becomes the better option.

When an enclave works well:

• Only an engineering team, a program team, or a few project managers touch CUI.
• The rest of the company does commercial work, or government work without CUI.
• Your existing environment includes legacy systems that would be expensive to bring into compliance.
• You want to limit how much of the company is affected by CMMC controls.

When an enterprise approach works better:

• Most of your staff handle CUI.
• You are primarily a defense contractor.
• Your workflows would be disrupted by forcing users to move between two environments.
• You are small enough that a separate environment adds complexity without much savings.

Common enclave mistakes:

• Shadow CUI. CUI leaks outside the enclave through email, downloads, screenshots, or personal devices. If CUI ends up outside the boundary, the boundary has failed.
• Relying on VLANs alone. Network segmentation on its own is not the same as a properly separated environment with its own identity, access, and logging controls.
• Over-engineering. Building an enclave so complex that users avoid it.
• Weak user training. Users who do not understand the boundary will cross it.
• Mismatched expectations. An enclave the assessor does not accept as a valid boundary is a costly surprise. This is why scoping should be done by someone who understands how assessors evaluate boundaries.

GCC vs. GCC High for CMMC

Microsoft offers three main cloud environments that contractors ask about: Microsoft 365 Commercial, Microsoft 365 Government Community Cloud (GCC), and Microsoft 365 GCC High, which runs on Azure Government. The right choice depends mainly on whether you handle export-controlled data.

My position is simple. We recommend GCC High for companies that handle ITAR-controlled data or NOFORN information. For CUI that is not export-controlled, GCC is generally sufficient.

A few important points:

• GCC High is not required by CMMC. No CMMC level requires GCC High on its own. The requirement comes from the type of data you handle and the rules attached to it.
• ITAR and EAR data carry U.S. persons requirements. Export-controlled data must be protected against access by non-U.S. persons, including the provider's own support staff. GCC High is built for this.
• DFARS 7012 requires FedRAMP Moderate equivalent cloud services for CUI, plus the ability to meet 7012's incident reporting and forensic requirements.
• Migrations are expensive. Moving between Microsoft cloud environments is a significant project. It usually involves new tenants, data migration, new licenses, and user disruption. Choose correctly the first time.
• GCC High licensing costs more and some features arrive later than in commercial.

Some of our earlier posts leaned more heavily toward GCC High as a default. This guide reflects my current view: match the environment to the data.

FedRAMP and Cloud Service Providers

Under DFARS 7012, any cloud service that stores, processes, or transmits CUI must meet FedRAMP Moderate baseline requirements or equivalent. This applies to email, file storage, collaboration tools, backup services, and any other cloud service touching CUI.

This requirement catches a lot of contractors. A file-sharing tool, backup service, or ticketing system that has not been authorized at FedRAMP Moderate, or does not meet the DoD's equivalency requirements, cannot hold CUI. One of the MORSECORP allegations in Part 5 was the use of a non-compliant email provider.

When evaluating any cloud service for CUI, ask:

• Is it FedRAMP Moderate authorized or higher, or does it meet the DoD equivalency requirements?
• Will the provider meet DFARS 7012 incident reporting and forensic support requirements?
• Does it use FIPS-validated encryption?
• Does it provide a customer responsibility matrix?

Why a Shared Responsibility Matrix Matters

A shared responsibility matrix, also called a customer responsibility matrix, defines who is responsible for each of the 110 NIST SP 800-171 requirements: the contractor, the MSP, the managed security provider, or the cloud service provider. Without one, gaps appear between providers and nobody owns them.

The most common mistakes we see:

• Assuming the provider covers everything. No cloud or MSP covers all 110 requirements. Many requirements are always shared, and some always belong to the contractor.
• Creating the matrix at assessment time. It should be built during scoping and maintained throughout.
• Ignoring inherited requirements. When you rely on a cloud provider for a requirement, you still have to show the assessor evidence of how it is met.

Require a responsibility matrix in every service agreement that touches your CUI environment, and update it when providers or services change.

The DIY CMMC Platform Trap

A growing number of platforms market themselves as a fast path to CMMC compliance. Some claim to cover 90 percent or more of NIST SP 800-171. In our experience, these claims do not hold up in an assessment.

The problem is the difference between "covered" and "inherited." When we have reviewed these platforms' own responsibility matrices, only a minority of requirements are fully inherited by the customer. Most are shared, meaning the contractor still has to implement and prove them. Some are not addressed at all.

Encryption-overlay platforms deserve a specific caution. Encrypting CUI does not remove the endpoint from scope. The computer a user opens CUI on is still a CUI asset. It still needs endpoint protection, configuration management, patching, logging, and access controls. An overlay also adds another storage location and another email workflow for users to manage, which increases the chance of error.

Platforms have a place. But a platform is a tool. It is not a compliance program. Before you buy one, ask for its responsibility matrix and count how many requirements you will still own.

Open Source Software and CMMC Risk

Open source software can create CMMC risk when there is no accountable vendor to patch vulnerabilities, provide support, or meet supply chain expectations. Supply chain compromises of widely used open source security and development tools in 2026 showed how quickly attackers can exploit trusted projects to steal credentials and secrets.

For a CMMC environment, the questions are practical:

• Who is responsible for patching this software, and how quickly?
• What happens if the project is abandoned?
• Can you document the software's configuration and vulnerability management in your SSP?
• Would an assessor accept your evidence for the requirements it supports?

This is also part of why FedRAMP-authorized services cost more. You are paying for accountability, documented controls, and independent verification.

How to Handle Legacy Systems in a CMMC Assessment

Legacy systems that cannot meet NIST SP 800-171 requirements must be isolated, protected with compensating controls, and documented. In some cases, they can be treated as Specialized Assets or placed outside the CUI boundary.

The approach we use:

1. Inventory every legacy system and identify which requirements it cannot meet.
2. Decide whether it needs to touch CUI. If not, move it outside the boundary and separate it.
3. Segment it with firewalls and access controls. Disable unneeded ports and services.
4. Apply compensating controls such as restricted access, enhanced monitoring, and MFA at the access point.
5. Document everything in the SSP, including the rationale and the compensating controls.
6. Plan replacement through your IT lifecycle roadmap.

It is interesting that many of the technologies I worked with in 2000, such as Windows Server, Active Directory, and DNS, are still at the center of client environments today. The difference is that they now have to be configured and monitored to a standard that did not exist back then.

Multifactor Authentication Is Mandatory, But It Is Not Enough

NIST SP 800-171 requires multifactor authentication for privileged accounts and for network access to non-privileged accounts. I recommend MFA on every system, for every user, without exceptions.

The mistake businesses make is a false sense of security. MFA is necessary, but attackers now routinely bypass it. The most preventable breach scenario I see is a user opening an unexpected PDF, clicking a link inside it, and entering credentials on a fake login page that steals the session token. The attacker never needs the password or the MFA code again. Phishing-resistant MFA, conditional access policies, and user training are what close that gap.

Part 8: CMMC Documentation, the Most Common Gap

Documentation is the most common gap we find in CMMC gap assessments. No company we have ever assessed has had the right documentation, including companies that had already paid a third party to create it. An assessor evaluates what you have written as much as what you have implemented, and the two have to match.

What Documentation Does CMMC Level 2 Require?

At a minimum, a Level 2 contractor needs:

• A System Security Plan (SSP) that describes the CUI environment and how each requirement is met.
• Policies and procedures covering each of the 14 requirement families.
• A Plan of Action and Milestones (POA&M) for any requirement not yet fully met, if applicable.
• A network diagram and data flow diagrams showing where CUI goes.
• An asset inventory categorized according to the CMMC scoping guidance.
• A shared responsibility matrix for every external service provider.
• An incident response plan that has been tested.
• A risk assessment conducted and updated periodically.
• Training records for security awareness and insider threat training.
• Evidence supporting every assessment objective.

What Makes a Good System Security Plan?

A good SSP describes, for every one of the 110 requirements, exactly how the requirement is met in your environment, by which systems and tools, and who is responsible. It should be detailed enough that an assessor could read it and know what evidence to ask for.

The most common problem with SSPs, aside from not having one, is that they are not detailed enough. Here is the difference:

A weak SSP entry for 3.1.1 (limit system access to authorized users):

"The company limits access to authorized users."

A stronger SSP entry:

"User accounts are created in Microsoft Entra ID only after a completed access request is approved by the user's manager and the IT manager. Accounts are assigned to role-based security groups that control access to the CUI SharePoint site and file shares. Devices must be enrolled in Intune and compliant with the device compliance policy before accessing CUI resources. Access is reviewed quarterly by the IT manager, and the review is documented in the access review log. Terminated user accounts are disabled within 24 hours of separation, as described in the Personnel Security procedure."

The second version tells the assessor what to examine, who to interview, and what to test. That is what an SSP is for.

A good SSP also:

• Defines the system boundary clearly.
• Lists every in-scope asset by category.
• Describes the environment's architecture and data flows.
• Identifies inherited and shared requirements and the provider responsible.
• Is updated whenever the environment changes.
• Matches your policies, procedures, and actual practice.

Plans of Action and Milestones (POA&Ms)

A POA&M documents requirements that are not yet fully met, the plan to meet them, and the date by which they will be met. Under the CMMC program rule, POA&Ms are allowed only in limited circumstances.

The rules for Level 2:

• You must score at least 88 of 110 (80 percent) to receive conditional status.
• Generally, only requirements worth 1 point can be on a POA&M, with a narrow exception for 3.13.11 (FIPS-validated cryptography) when encryption is used but not yet FIPS validated.
• Six requirements can never be on a POA&M: 3.1.20 (external connections), 3.1.22 (publicly accessible content), 3.12.4 (the SSP), 3.10.3 (escort visitors), 3.10.4 (physical access logs), and 3.10.5 (physical access devices).
• Every POA&M item must be closed within 180 days of the assessment.
• A closeout assessment confirms the items are closed.
• If they are not closed in time, conditional status expires.

At Level 1, POA&Ms are not allowed at all.

A POA&M is not a place to park work you do not want to do. It is a short-term plan for a small number of remaining items.

Risk Assessments: Requirement 3.11.1

Requirement 3.11.1 requires contractors to periodically assess the risk to operations, assets, and individuals from operating their systems and from processing, storing, or transmitting CUI. It is one of the most frequently under-documented requirements we see.

A good risk assessment:

1. Identifies threats, including non-cyber risks such as floods, power outages, hurricanes, equipment failure, and loss of key personnel.
2. Assesses impact and likelihood for each.
3. Prioritizes and plans mitigation.
4. Is reviewed on a set schedule and whenever something significant changes.

NIST SP 800-30 is a useful guide to the method. For Hawaii and Guam, natural hazards and single points of failure in connectivity belong on every risk register. My years in New York through 9/11, the 2003 blackout, and Superstorm Sandy taught me to think broadly about what can cause downtime. The Maui wildfires reminded everyone here that we are not isolated from large-scale disasters.

Incident Response Plans

NIST SP 800-171 requires an operational incident handling capability, incident tracking and reporting, and testing of the incident response capability. DFARS 7012 adds a 72-hour reporting requirement to the DoD Cyber Crime Center (DC3) for cyber incidents affecting covered defense information.

For a 25-person company, a good incident response plan is:

• Formal and documented, following NIST guidance.
• Specific about roles, contacts, and decisions.
• Aligned with 7012, including how to report to DC3, who holds the required DoD-approved medium assurance certificate, and how to preserve images for 90 days.
• Aligned with your cyber insurance policy, since many insurers now require notification and use of their forensic partners.
• Practiced regularly, through tabletop exercises at least once a year.

Evidence: What Assessors Look For

An assessor evaluates each assessment objective using three methods: examine (documents, configurations, records), interview (the people who perform the work), and test (observing the control in operation). Your evidence has to support all three.

Good evidence is:

• Current, not from last year.
• Specific to the system in scope.
• Consistent with the SSP.
• Organized so it can be found quickly during the assessment.
• Collected continuously, not scrambled together the week before.

What Does "Assessment Ready" Actually Look Like?

In my experience, a contractor is assessment ready when four things are true:

1. All controls are met. Every requirement, every objective, implemented.
2. The documentation reflects the environment. The SSP and policies describe what actually happens.
3. Evidence can be collected on demand. You can show an assessor proof of any requirement quickly.
4. Someone can articulate all of it. You have a point of contact who can explain the environment, the documentation, and the evidence to the C3PAO in an interview.

That fourth point is often overlooked. The assessment is partly a conversation. A contractor with good controls and a nervous, unprepared point of contact can still struggle.

How to Write Policies That Hold Up in an Assessment

Policies state what your company requires. Procedures describe how those requirements are carried out. An assessor will compare both to what actually happens in your environment.

Good CMMC policies are:

• Specific to your company. They name your systems, roles, and processes. A policy that could apply to any company will not help you in an assessment.
• Together, they address every requirement family.
• Policies, procedures, and the SSP use the same terms and describe the same processes.
• Approved and dated. Signed by the appropriate leader, with a review date.
• An assessor will interview staff. If employees do not know the policy, or do something different, the requirement is not met.
• Reviewed regularly. At least annually, and whenever the environment changes.

The most common mistake is a set of policies downloaded from a template library and lightly edited. They typically reference tools the company does not use, roles it does not have, and time frames it does not follow. An assessor will notice within minutes.

Examples of CMMC Evidence

The list below shows the kinds of evidence assessors commonly expect for a few representative requirements. It is not exhaustive, and the right evidence depends on your environment.

• 1.1 Limit access to authorized users: Access request records, user and group listings, access review records
• 1.5 Least privilege: Privileged account inventory, role definitions, admin group memberships
• 2.1 Security awareness: Training content, completion reports by user
• 3.1 Create and retain audit logs: Logging configuration, retention settings, sample logs
• 4.1 Baselines and inventories: Asset inventory, baseline configuration documents
• 5.3 Multifactor authentication: Conditional access or MFA policies, sign-in logs showing MFA
• 6.3 Test incident response: Tabletop exercise agenda, attendance, and after-action notes
• 8.3 Sanitize media: Destruction certificates, sanitization log
• 9.2 Protect CUI during personnel actions: Offboarding checklists, account disable timestamps
• 10.4 Physical access logs: Visitor logs, badge system reports
• 11.2 Vulnerability scanning: Scan schedules, recent scan reports
• 12.4 System Security Plan: The current SSP, with version history
• 13.11 FIPS-validated cryptography: Encryption settings and FIPS validation certificate references
• 14.1 Flaw remediation: Patch compliance reports, remediation tickets

A useful habit is to keep an evidence folder organized by requirement number and update it on a set schedule. When the assessor asks for 3.5.3, you should be able to open the folder and show the current evidence immediately.

Part 9: The 110 CMMC Level 2 Requirements, Family by Family

CMMC Level 2 requires all 110 NIST SP 800-171 Revision 2 requirements, grouped into 14 families. This section explains what each family covers, what an assessor typically looks for, and the gaps we find most often in Hawaii and Guam environments. It is not a substitute for the full text of NIST SP 800-171 and 800-171A, but it should give you a clear picture of the work involved.

Access Control (AC): 22 Requirements

Access Control is the largest family, and it covers who can access CUI systems, what they can do once inside, and how remote and wireless access is protected.

The requirements include limiting access to authorized users, processes, and devices; limiting users to the functions they are authorized for; controlling the flow of CUI; separating duties; applying least privilege; limiting unsuccessful login attempts; displaying system use notices; locking sessions after inactivity; terminating sessions; controlling remote access; protecting wireless access; controlling mobile devices; encrypting CUI on mobile devices; controlling connections to external systems; limiting the use of portable storage on external systems; and controlling CUI posted on publicly accessible systems.

What assessors look for: access request and approval records, role definitions, group memberships, privileged account inventories, remote access configurations, session lock settings, mobile device management policies, and evidence that access reviews actually happen.

Common gaps:

• Too many users with administrative rights, including owners and managers who do not need them for daily work.
• Shared accounts, especially on engineering workstations, shop-floor systems, and older equipment.
• No documented process for granting and removing access.
• Remote access that bypasses the controls applied in the office.
• Personal phones accessing company email without device management.
• No control over CUI shared through external collaboration tools.

Awareness and Training (AT): 3 Requirements

Awareness and Training requires that all users understand the security risks of their work, that people with security roles receive role-specific training, and that users are trained to recognize and report insider threats.

What assessors look for: training content, completion records for every in-scope user, role-based training for administrators, and insider threat awareness material.

Common gaps:

• Training done once at hire and never again.
• No record of who completed training.
• No insider threat content.
• Administrators trained the same way as everyone else.

This family is small, but I consider it the most important. Awareness training is the most effective single control a small business can have.

Audit and Accountability (AU): 9 Requirements

Audit and Accountability requires that systems create and retain logs, that user actions can be traced to individual users, that logs are reviewed and correlated, that logging failures generate alerts, that logs are protected, and that system clocks are synchronized.

What assessors look for: logging configurations, retention settings, a centralized log system or SIEM, evidence of regular log review, alerting on audit failures, and restricted access to log management.

Common gaps:

• Logs are collected but nobody reviews them.
• Logs are retained for too short a period.
• Logs from firewalls, servers, cloud services, and endpoints are not brought together.
• Shared accounts make it impossible to tie actions to individual users.

A managed SOC closes most of the gaps in this family, because log review becomes a continuous, documented activity rather than something done when time allows.

Configuration Management (CM): 9 Requirements

Configuration Management requires baseline configurations and inventories, security configuration settings, change control, security impact analysis, access restrictions for changes, least functionality, restrictions on nonessential programs and services, application allowlisting or denylisting, and control over user-installed software.

What assessors look for: a current asset inventory, documented baselines, hardening standards, change requests and approvals, evidence that unnecessary services are disabled, and software control policies.

Common gaps:

• No current hardware and software inventory.
• No documented baseline for workstations and servers.
• Changes made without any record.
• Users able to install any software they want.

In a small company, change management does not have to be complicated. A simple, consistently used ticket for each change, with an approval, is usually enough if it is actually followed.

Identification and Authentication (IA): 11 Requirements

Identification and Authentication requires that users and devices are identified and authenticated, that multifactor authentication is used for privileged accounts and for network access, that authentication is replay-resistant, that identifiers are managed, that passwords meet complexity and reuse rules, that temporary passwords are changed on first use, that passwords are stored and transmitted only in protected form, and that authentication feedback is obscured.

What assessors look for: MFA configurations, conditional access policies, password policies, identifier management procedures, and evidence that MFA covers every applicable access path.

Common gaps:

• MFA on email but not on VPN, remote desktop, or administrative consoles.
• Service accounts and legacy protocols that bypass MFA.
• Local administrator accounts with shared or unchanged passwords.
• No process for disabling identifiers after inactivity.

Incident Response (IR): 3 Requirements

Incident Response requires an operational incident handling capability, tracking and reporting of incidents to the right people inside and outside the company, and testing of the incident response capability.

What assessors look for: a written incident response plan, defined roles, contact lists, an incident log, evidence of reporting procedures that meet DFARS 7012, and evidence of testing, such as tabletop exercise records.

Common gaps:

• A plan that exists but has never been tested.
• No awareness of the 72-hour reporting requirement to DC3.
• No DoD-approved medium assurance certificate, which is needed to submit a 7012 incident report.
• No coordination between the plan and the company's cyber insurance carrier.

Maintenance (MA): 6 Requirements

Maintenance requires that system maintenance is performed and controlled, that tools used for maintenance are controlled, that equipment removed for off-site maintenance is sanitized, that maintenance media is checked for malicious code, that remote maintenance sessions require MFA and are terminated when complete, and that maintenance personnel without authorization are supervised.

What assessors look for: maintenance records, procedures for vendor maintenance, remote maintenance tool configurations, and escort records.

Common gaps:

• Vendors with standing remote access to equipment.
• Remote support tools that do not require MFA.
• No record of who performed maintenance and when.

Media Protection (MP): 9 Requirements

Media Protection requires protecting and limiting access to CUI on paper and digital media, sanitizing media before disposal or reuse, marking media with CUI markings, controlling media during transport, encrypting CUI on digital media during transport, controlling removable media, prohibiting portable storage without an identifiable owner, and protecting backup CUI.

What assessors look for: removable media policies and technical controls, sanitization records, marking procedures, encrypted transport methods, and backup encryption.

Common gaps:

• USB drives used freely to move drawings between systems.
• Printed CUI left on desks or in shared printers.
• No record of media destruction.
• Backups that are not encrypted.

Personnel Security (PS): 2 Requirements

Personnel Security requires screening individuals before granting access to CUI systems and protecting CUI during and after personnel actions such as terminations and transfers.

What assessors look for: screening procedures, onboarding and offboarding checklists, and records showing access was removed promptly.

Common gaps:

• No written offboarding process.
• Accounts for former employees still active weeks or months later.

This family is short, but the offboarding gap is one of the most common findings we see. It is also one of the easiest to fix.

Physical Protection (PE): 6 Requirements

Physical Protection requires limiting physical access to systems and CUI, protecting and monitoring the facility, escorting visitors and monitoring their activity, maintaining physical access logs, controlling physical access devices such as keys and badges, and enforcing safeguarding measures at alternate work sites.

What assessors look for: facility access controls, visitor logs, badge or key inventories, camera or monitoring arrangements, and remote work policies.

Common gaps:

• Shared office buildings where the contractor does not control the entrance.
• No visitor log.
• Keys and badges issued without an inventory.
• No requirements for employees working from home with CUI.

Assessors will often want to see the facility in person, which is one reason on-site capability matters for contractors in Hawaii and Guam.

Risk Assessment (RA): 3 Requirements

Risk Assessment requires periodic assessment of risk, periodic and triggered vulnerability scanning, and remediation of vulnerabilities based on risk.

What assessors look for: a documented risk assessment, vulnerability scan reports, and evidence that findings were remediated on a defined timeline.

Common gaps:

• No written risk assessment.
• Vulnerability scans run once and never repeated.
• Scan results with no remediation tracking.

I covered requirement 3.11.1 in detail in Part 8. Vulnerability management is usually handled as part of a managed security service.

Security Assessment (CA): 4 Requirements

Security Assessment requires periodic assessment of security controls, plans of action to correct deficiencies, ongoing monitoring of controls, and a System Security Plan.

What assessors look for: evidence of internal control assessments, the POA&M, continuous monitoring activities, and the SSP.

Common gaps:

• No SSP at all, which is requirement 3.12.4 and cannot be placed on a POA&M.
• An SSP that has not been updated since it was written.
• No internal assessment process between external assessments.

System and Communications Protection (SC): 16 Requirements

System and Communications Protection is the second-largest family. It covers boundary protection, network architecture, separation of user and system functions, preventing unauthorized information transfer through shared resources, deny-by-default network traffic, preventing split tunneling, encrypting CUI in transit, terminating network connections, cryptographic key management, FIPS-validated cryptography, prohibiting remote activation of collaborative computing devices, controlling mobile code, controlling VoIP, protecting session authenticity, and protecting CUI at rest.

What assessors look for: network diagrams, firewall rules, segmentation, VPN configurations, encryption settings, FIPS validation evidence, and data-at-rest encryption.

Common gaps:

• Flat networks with no segmentation between CUI systems and everything else.
• Firewall rules that allow more traffic than needed.
• Encryption that is not FIPS validated, which affects requirement 3.13.11.
• Split tunneling enabled on VPN clients.
• Laptops without full disk encryption.

System and Information Integrity (SI): 7 Requirements

System and Information Integrity requires identifying and correcting system flaws in a timely manner, protecting against malicious code, monitoring security alerts and advisories, updating malicious code protection, performing periodic and real-time scans, monitoring systems for attacks, and identifying unauthorized use.

What assessors look for: patch management records, endpoint protection configurations, subscriptions to security advisories, scan settings, and evidence of security monitoring.

Common gaps:

• Patching that is irregular or does not cover third-party applications.
• Endpoint protection installed but not monitored.
• No one watching for attacks outside business hours.

How the Families Work Together

The families are not independent. A single tool or process often supports requirements across several families. For example, a well-configured identity platform supports Access Control, Identification and Authentication, and Audit and Accountability at the same time. A managed SOC supports Audit and Accountability, Incident Response, and System and Information Integrity.

This is why the SSP has to describe the whole environment, and why a shared responsibility matrix is essential when you use outside providers. The assessor will follow a single control across families, and your documentation needs to hold up everywhere it appears.

Part 10: What Does CMMC Cost?

CMMC cost depends on company size, the state of your current environment, your scope, and whether you do the work in-house or with a provider. Based on our experience, a 50-person organization pursuing CMMC Level 2 across its entire environment should plan for roughly $100,000 to implement all controls, about $75,000 for the C3PAO assessment, and $50,000 to $100,000 per year to maintain compliance and the required tools.

Those figures are general. Your costs could be lower with a well-designed enclave or a strong starting point, or higher with complex environments, legacy systems, or a large user count.

Why Official Estimates and Real Costs Differ

The DoD's estimates in the rule focused mostly on the cost of the assessment and affirmation. For example, the proposed rule estimated about $104,670 for a small business Level 2 C3PAO assessment over the three-year cycle. The SBA's 2026 analysis estimated total compliance costs for small firms needing third-party assessment at close to $594,000, because it counted implementation.

In practice, the assessment is the smaller part of the bill. Implementation, tools, and ongoing operation are where most of the money goes.

The Main CMMC Cost Categories

• Gap assessment and scoping: Contract review, CUI identification, boundary definition, scoring against all 110 requirements
• Remediation and implementation: Configuring identity, endpoint, logging, encryption, backup, and network controls; replacing non-compliant tools
• Licensing and tools: Compliant cloud licensing, endpoint protection, SIEM or managed SOC, vulnerability management, MDM
• Documentation: SSP, policies, procedures, diagrams, responsibility matrix, POA&M
• Training: Security awareness, insider threat, role-based training
• Pre-assessment: Mock assessment, evidence review, interview preparation
• C3PAO assessment: The formal Level 2 assessment
• Ongoing maintenance: Monitoring, patching, evidence collection, annual affirmations, SSP updates, periodic assessments

How to Control CMMC Costs

1. Scope carefully. A smaller, well-defined boundary is the biggest cost lever.
2. Consider an enclave if fewer than 25 to 50 percent of your users need CUI access.
3. Choose the right cloud environment. Do not pay for GCC High if you do not handle ITAR or NOFORN data.
4. Avoid doing it twice. Hiring an unqualified provider is the most expensive mistake we see.
5. Use a provider's buying power. As an MSP, we have negotiated pricing on tools and licensing that is often better than a small contractor can get on its own, and we manage the tools as part of the service.
6. Budget for maintenance. Compliance is ongoing. Plan for it as an operating cost, not a one-time project.

Can a Small Contractor Prepare for a C3PAO Assessment on Its Own?

It is possible, but in my experience it is highly unlikely to succeed without experienced help. The documentation requirements are very specific. The tool requirements, such as FedRAMP-authorized cloud storage and FIPS-validated encryption, are easy to get wrong. And most small contractors do not have staff who have been through a C3PAO assessment.

When we do budgeting exercises with small contractors, our combined pricing for tools and management is frequently lower than what the contractor could buy on its own. That is before counting the cost of the staff time required to run everything.

Funding and Cost Recovery

Some contractors may be able to recover part of their compliance cost through indirect cost rates, depending on their contract types and accounting system. Some states and programs offer assistance to small manufacturers and defense suppliers. Talk to your accountant and your contracting officer about what applies to you. I am not a lawyer or an accountant, and this is not financial or legal advice.

Part 11: CMMC in Hawaii and Guam

CMMC requirements are the same in Hawaii and Guam as anywhere in the country, but doing the work here is different. Things take longer to arrive, there are fewer qualified people, there are fewer choices of providers and services, weather is a real risk, and everything costs more.

Why Hawaii Has So Many Defense Contractors

Hawaii sits at a strategically important location in the Pacific. The defense sector is one of the largest drivers of the state economy, and there are a large number of DoD contracts supporting installations such as Joint Base Pearl Harbor-Hickam, Schofield Barracks, and Marine Corps Base Hawaii, along with U.S. Indo-Pacific Command. That creates a large local base of primes and subcontractors in construction, engineering, logistics, professional services, and technology.

I expect the DoW to continue investing in infrastructure here, and I think that investment will raise the overall cybersecurity posture of many local businesses over the next several years.

What Makes CMMC Harder in Hawaii

• There are fewer experienced cybersecurity and compliance professionals here, and very few with CMMC certifications. As of September 2026, there are three CCAs based in Hawaii, and two work at Intech Pacific.
• Lead times. Hardware and equipment take longer to ship. Projects need to be planned further ahead.
• Provider choices. There are fewer internet carriers, fewer local vendors, and fewer compliant service options.
• Everything, from hardware to labor to insurance, costs more.
• Time zones. Working with mainland vendors, primes, and assessors means working outside standard Hawaii business hours.
• Continuity risk. Hurricanes, tsunamis, wildfires, and our dependence on a limited number of undersea cables for connectivity all belong in continuity planning. On an island, you cannot simply drive to another location if something goes wrong.

What Makes CMMC Harder in Guam

Guam contractors face everything Hawaii contractors face, and more. There are even fewer local resources, costs are even higher, and Guam is even more isolated. Military construction and support work in Guam has brought many new contractors into the defense supply chain, and many of them are encountering CMMC requirements for the first time.

We support Guam contractors both remotely and on-site, and our CCPs and CCAs are available for on-site engagements in Guam. Our work with the Guam Contractors Association and SAME Guam has given us a close view of the challenges local companies face. You can read more on our CMMC for Guam Contractors page.

CMMC by Industry in Hawaii and Guam

The defense supply chain in Hawaii and Guam includes a wide range of industries, and each one runs into CMMC in its own way.

Construction and design-build. Military construction contractors receive drawings, site plans, and specifications, some of which are CUI. The challenges are job-site devices, temporary offices, large numbers of subcontractors, and project teams that change from job to job. Physical protection and flow-down to subcontractors need particular attention.

Architecture and engineering. A&E firms often handle the most technical CUI in the local supply chain: design drawings, models, and specifications. CAD workstations, large file transfers, and collaboration with primes and government reviewers make scoping and file sharing critical. Export-controlled data may also be involved, which can drive the GCC High decision.

Manufacturing and fabrication. Manufacturers have shop-floor equipment, CNC machines, and test systems that often cannot meet NIST SP 800-171 requirements directly. These typically need to be handled as Specialized Assets with segmentation and compensating controls. Removable media use for moving files to machines is a common gap.

Logistics, maintenance, and support services. These contractors often handle operational data, schedules, and maintenance records. The CUI is sometimes less obvious, which makes contract review especially important. Many have large field workforces and mobile devices.

Professional and technical services. Consulting, program management, and staffing firms may have employees working on government systems as well as their own. It is important to separate what happens on government-furnished equipment from what happens on the company's own systems.

IT and managed service providers. Providers that support defense contractors can be in their clients' assessment scope. If you provide security protection or have access to a client's CUI environment, expect your own practices to be scrutinized.

Small and family-owned businesses. Many of the subcontractors in Hawaii and Guam are small, family-owned companies that have supported defense work for years. They often have no IT staff, and the owner wears many hats. For these companies, the most important decisions are the first ones: confirming the level, scoping carefully, and choosing a qualified partner so the work is done once.

What "Local" Means for CMMC Support

To me, a local provider is one that is based in Hawaii or Guam, has people on staff in these locations, and does its main business here. That matters for CMMC because assessments often include on-site work, because relationships matter in a small defense community, and because a local provider understands the practical constraints of operating here.

There is a very strong sense of community in Hawaii. It seems everyone knows each other, and you become close to the clients you work with. That works both ways. A good reputation travels quickly, and so does a bad experience. It is one reason I take the choice of CMMC provider so seriously.

Disaster Recovery and Continuity in the Pacific

My background in New York taught me that availability has to be planned for, not assumed. After 9/11, every firm I worked with had a disaster recovery site ready to go. During the 2003 blackout, I learned to think bigger about what can cause downtime, and I saw the advantage of coming back online before competitors. During Superstorm Sandy, what worked was years of DR planning. We knew exactly what we needed to do.

The same principle applies here. You need a plan, and it has to be practiced. For CMMC, that plan should include:

• Backups that are tested, protected, and stored in a way that meets the CUI requirements.
• Alternate connectivity where possible.
• Documented recovery procedures.
• A risk assessment that includes natural hazards.
• Coordination with your cyber insurance carrier.

Part 12: How Intech Pacific Helps Defense Contractors With CMMC

Intech Pacific provides CMMC readiness, remediation, documentation, managed compliance, and assessment support for defense contractors in Hawaii, Guam, and across the Pacific. We are the only CMMC Level 2 certified MSP in Hawaii and Guam, the only MSP in Hawaii and Guam with CCPs and CCAs on staff, and we have taken more companies through C3PAO certification than every other company in Hawaii and Guam combined.

I want to explain our services in detail, because the right service depends on what kind of company you are. A 12-person engineering firm with no IT staff needs something very different from a 200-person contractor with its own IT department.

How We Approach Every CMMC Engagement

Every engagement follows the same basic path, regardless of which service you choose:

1. Discover and scope. We review your contracts, identify FCI and CUI, map where it flows, and define the boundary.
2. Analyze and plan. We assess your environment against every applicable requirement and assessment objective, score it accurately, and build a remediation roadmap.
3. Implement and document. We close the gaps, deploy and configure the required tools, and write documentation that matches your environment.
4. Assess and maintain. We prepare you for the C3PAO, support you during the assessment, and keep you compliant afterward.

The first question I ask every new client is: what does success look like in 90 days, and in one year? The answer shapes everything else. Some clients need to win a specific contract. Some need to satisfy a prime. Some want to be certified before a recompete. We build the roadmap around that goal.

CMMC Recon: A Free Readiness Assessment

CMMC Recon is a free, 45-minute readiness session for defense contractors in Hawaii and Guam. It is the starting point for most of our CMMC relationships.

In a Recon session, we:

• Review your contracts to confirm which CMMC level applies.
• Do a preliminary identification of your CUI and where it lives.
• Discuss how your boundary could be scoped.
• Identify likely gaps against NIST SP 800-171.
• Give you a plain-language view of timeline, cost drivers, and next steps.
• Recommend which service, if any, fits your situation.

There is no cost and no obligation. If you are not sure where to start, start here.

CMMC Overwatch: Advisory Support for Contractors With Internal IT

CMMC Overwatch is our advisory service for contractors that have their own IT team and technology stack. We provide the compliance leadership, and your team does the implementation.

Overwatch includes:

• CUI scoping and boundary definition.
• A full NIST SP 800-171 gap analysis.
• SSP and POA&M guidance.
• An evidence collection strategy.
• Recurring compliance leadership meetings.
• Direct CCP and CCA support during your C3PAO assessment.

Overwatch fits contractors that:

• Have a capable internal IT team.
• Want to keep their existing tools where possible.
• Need expert guidance on what to do and how to prove it, more than hands-on implementation.

CMMC Sentry: Co-Managed CMMC for Contractors That Want Shared Responsibility

CMMC Sentry is our co-managed service. We deploy and manage a standardized cybersecurity stack aligned to CMMC Level 2, and we share responsibility for operations with your internal team.

Sentry includes:

• A standardized, CMMC Level 2 aligned cybersecurity stack.
• A defined split of responsibilities between our team and yours.
• CUI scoping.
• SSP and POA&M guidance.
• Continuous alignment checks and evidence mapping.
• Tool deployment and management.
• Training on the tools for your internal IT staff.
• CCP and CCA support during your C3PAO assessment.

Sentry fits contractors that:

• Have some internal IT capacity but not enough to run a compliant security stack alone.
• Want proven tools deployed the way assessors expect to see them.
• Want their internal staff to stay involved in day-to-day operations.

CMMC Command: Fully Managed CMMC for Contractors Without IT Staff

CMMC Command is our fully managed service. We run your IT, your security stack, and your compliance program.

Command includes:

• A fully managed CMMC Level 2 technology stack.
• Complete IT operations, including identity, endpoints, patching, and configuration management.
• A full help desk for your users.
• CUI scoping.
• SSP and POA&M creation, with ongoing updates.
• Continuous evidence collection.
• Security monitoring and incident response coordination.
• CCP and CCA support during your C3PAO assessment.

Command fits contractors that:

• Have little or no internal IT staff.
• Want a single partner responsible for IT, cybersecurity, and compliance.
• Would rather focus on the work their contracts are for.

For a small contractor without IT staff, Command is often the most cost-effective path when you compare it to hiring, training, and equipping an internal team that could do the same work.

CMMC Enclave: A Separate, Compliant Environment for CUI

CMMC Enclave is a pre-built, compliant environment for the users and data that handle CUI. It is built on Azure Government and Microsoft 365 government cloud services. Only the users and data tied to your DoD work move into the enclave. The rest of your organization keeps using its existing environment.

Enclave includes:

• A pre-configured government cloud environment.
• Access controls, logging, and endpoint management aligned to NIST SP 800-171.
• CUI scoping.
• An enclave-specific SSP and POA&M.
• Continuous management of the enclave stack.
• CCP and CCA support during your C3PAO assessment.

Enclave fits contractors that:

• Have a clearly defined group of CUI users, typically under 25 to 50 percent of staff.
• Do significant commercial or non-CUI work alongside defense work.
• Have legacy systems that would be expensive to bring into compliance.

Enclave pairs with Overwatch, Sentry, or Command depending on how much support you need for the rest of your environment.

CMMC Support for Prime Contractors

Primes are responsible for flowing CMMC requirements down to their subcontractors, and a prime's ability to perform often depends on whether its suppliers can meet those requirements. Our program for prime contractors helps primes prepare their supplier base.

The prime contractor program includes:

• Mapping which suppliers are exposed to FCI and CUI.
• CUI scoping for suppliers.
• NIST SP 800-171 gap analysis for each supplier.
• SSP and POA&M guidance.
• Evidence mapping.
• Rollup readiness reporting so the prime can see where the supply chain stands.
• C3PAO preparation.

We support suppliers in Hawaii, Guam, and across the Pacific, with remote support for mainland suppliers.

CMMC Partner Program for MSPs

Some defense contractors already have an MSP they trust but need CMMC expertise that their MSP does not have. Our CMMC Partner Program for MSPs lets us work alongside another MSP to bring its clients through CMMC Level 1 or Level 2.

The partner program includes:

• Gap analysis.
• SSP and POA&M guidance.
• An evidence strategy.
• A remediation roadmap.
• Compliance leadership meetings.
• C3PAO preparation with CCP and CCA support.

Managed CMMC Level 1

For contractors that only handle FCI, we provide managed Level 1 support: an SSP, a guided self-assessment of all 15 requirements, SPRS submission through PIEE, and ongoing reviews so the annual affirmation is accurate.

How Our Services Map to Different Types of Contractors

• You are not sure whether CMMC applies or at what level: CMMC Recon
• You only handle FCI: Managed CMMC Level 1
• You have a capable IT team and need compliance leadership: CMMC Overwatch
• You have some IT staff and want a proven security stack: CMMC Sentry
• You have little or no IT staff: CMMC Command
• Only a small part of your company handles CUI: CMMC Enclave, paired with another service
• You are a prime preparing your supplier base: Prime contractor program
• You already have an MSP you want to keep: MSP Partner Program
• You were working with another provider and are not making progress: CMMC Recon, followed by a gap assessment

Three Illustrative Contractor Profiles

The examples below are composites, written to show how the decisions in this guide play out in practice. They are not descriptions of specific clients. Your situation will differ, but these profiles reflect the kinds of companies we talk with every week in Hawaii and Guam.

Profile 1: A 15-person engineering firm in Honolulu

The firm supports two DoW programs as a subcontractor and receives technical drawings marked CUI from its prime. Six of its fifteen employees work on defense projects. The rest do commercial and state work. The firm has no internal IT staff and uses commercial Microsoft 365. The owner handles IT decisions and completed a self-assessment two years ago that produced an SPRS score of 110.

What the decisions look like:

• Level: Level 2, because the firm handles CUI.
• SPRS: the earlier self-assessment was likely generous. An independent gap assessment would almost certainly produce a much lower score. The firm should correct its SPRS status.
• Scope: six of fifteen users is 40 percent, which falls in the range where an enclave usually makes sense. The drawings are not export-controlled, so GCC High is not required.
• Service fit: an enclave for the defense team, paired with fully managed IT and security for the whole firm, since there is no internal IT staff.
• Key risks: CUI drawings saved outside the enclave, personal phones accessing email, and an owner who signs the affirmation without evidence.

Profile 2: A 60-person construction contractor on Oahu

The company holds several military construction contracts as a prime and uses a dozen subcontractors. Project managers, estimators, and superintendents all receive project documents, some of which are marked CUI. More than half of the staff handles CUI in some form. The company has one internal IT person.

What the decisions look like:

• Level: Level 2 for the company. Its subcontractors will need Level 1 or Level 2 depending on what they receive.
• Scope: more than half of staff handles CUI, so an enterprise approach is likely more practical than an enclave.
• Service fit: co-managed support, so the internal IT person stays involved while a provider runs a proven security stack. The company would also benefit from a supplier readiness program for its subcontractors.
• Key risks: CUI on job-site laptops and tablets, shared accounts on field devices, subcontractors receiving CUI before they are ready, and physical protection at temporary job-site offices.

Profile 3: An 8-person subcontractor in Guam

The company provides specialized services to a larger contractor supporting military construction in Guam. It receives schedules, pricing, and some technical specifications from its prime. Its prime has asked for CMMC status but has not specified a level. There is no internal IT staff, and the owner uses a local technician for break-fix support.

What the decisions look like:

• Level: it depends on whether the specifications are CUI. If they are, Level 2. If the company only receives FCI, Level 1. The first step is a contract review and a written answer from the prime.
• Service fit: a free readiness session to confirm the level, followed by managed Level 1 support or a small managed Level 2 environment, depending on the answer.
• Key risks: limited local support, long hardware lead times, reliance on a single technician, and the possibility of receiving CUI without realizing it.

In all three profiles, the first step is the same: find out exactly what information you receive, and get an honest assessment of where you stand.

Other Compliance Requirements Defense Contractors Face

CMMC is rarely the only compliance requirement a Hawaii or Guam defense contractor faces. Understanding how the other requirements relate prevents duplicate work and missed obligations.

ITAR and EAR. The International Traffic in Arms Regulations and the Export Administration Regulations control the export of defense articles, technical data, and dual-use items. Export-controlled technical data is often also CUI, but ITAR and EAR carry their own requirements, including restrictions on access by non-U.S. persons. These requirements are the main reason a contractor would need GCC High. They are separate from CMMC and enforced by the State Department and Commerce Department.

DFARS 7012 incident reporting. Even outside CMMC, 7012's 72-hour reporting, 90-day image preservation, and malicious software submission requirements apply to any cyber incident affecting covered defense information.

Cyber insurance. As covered in Part 15, carriers now require many of the same controls as NIST SP 800-171.

HIPAA and PCI DSS. Some defense contractors also handle health information, for example through medical service contracts, or accept card payments. Each framework has its own requirements, but there is significant overlap with NIST SP 800-171 in areas like access control, logging, encryption, and incident response.

State and territorial requirements. Hawaii and Guam have their own data breach notification laws that may apply to personal information your company holds.

When a client is subject to more than one framework, we crosswalk the requirements so that a single control, documented once, supports every framework it applies to. That takes experience with each framework. Doing it poorly leads to conflicting policies and duplicated effort.

What We Deliver Beyond CMMC

CMMC does not exist in isolation. Most of our defense clients also rely on us for:

• Managed IT services in Honolulu and across Hawaii, including help desk, monitoring, patching, backup, and strategic IT planning.
• Managed cybersecurity, including identity hardening, endpoint protection, 24/7 monitoring and threat detection, vulnerability management, and Microsoft 365 hardening.
• IT compliance services for other frameworks, including HIPAA, PCI DSS, FTC Safeguards, NCUA, and CIS.
• Virtual CIO and CISO leadership, including three to five year technology roadmaps.
• Cyber insurance support, including help with applications and renewals.

Many contractors are subject to more than one framework. Crosswalking CMMC with HIPAA, PCI, or insurance requirements takes experience, and it prevents duplicate work.

What We Will Not Do

There are a few things we will not do, and I think contractors should know that up front:

• We will not guarantee a certification outcome. The C3PAO makes that decision. We prepare you to meet every requirement and support you through the assessment.
• We will not tell you that you are compliant when you are not. Our gap assessments are honest, even when the score is not what you hoped.
• We will not sell you the minimum. Clients looking for the least they can get away with tend not to become clients. Compliance done halfway creates more risk than it removes.
• We will not conduct your C3PAO assessment. The ecosystem's conflict-of-interest rules separate readiness and assessment, and we follow them.

Managed IT and the ROI of a CMMC Partner

For most small defense contractors, the decision is not whether to spend money on CMMC. It is whether to build the capability internally or buy it from a provider. The way I measure it is simple: the value of our services should exceed what it would cost the client to do the same work on its own.

When you calculate the internal cost, include everything:

• Salary and benefits for the IT and security staff you would need, including coverage for vacations and turnover.
• Recruiting and training, which is especially hard in Hawaii and Guam, where experienced compliance staff are scarce.
• The tools: endpoint protection, SIEM or SOC, vulnerability management, backup, device management, and compliant cloud licensing.
• A compliance consultant to guide the program.
• CIO and CISO level leadership for planning and budgeting.
• 24/7 coverage for monitoring and incident response.
• Hardware, software, and services such as internet connectivity.

When clients see the total, a managed program is usually the more cost-effective option for companies without an established internal IT department. The one metric I recommend every business owner track is return on investment. Can you do it better, cheaper, and faster yourself? Can someone else? There is an old saying that you can have two of those three, but not all three. The right partner should get you as close as possible.

Signs a Defense Contractor Has Outgrown Break-Fix IT

Many small contractors in Hawaii and Guam still rely on break-fix IT support: a technician who comes when something breaks. That model does not work for CMMC.

Warning signs you have outgrown it:

• Response times are getting longer.
• Nobody is monitoring your systems when nothing is broken.
• Patching happens when someone remembers.
• There is no documentation of how your environment is configured.
• Your technician cannot help with your SSP or your assessment.

A break-fix provider cannot staff the way a company built on recurring managed services can. CMMC requires continuous monitoring, patching, logging, and evidence collection. Those are ongoing activities, not repairs.

Questions to Ask Before Signing With an MSP

If you are choosing a managed service provider as a defense contractor, ask about three things first: a proven track record, references, and credentials. Then go deeper:

• Is the MSP itself CMMC Level 2 certified?
• Does it have CCAs and CCPs on staff?
• Does it have true CIO and CISO level personnel who understand that you are buying an outcome, not a list of tools?
• Will it provide a shared responsibility matrix?
• How does it handle incident response, and does its process align with DFARS 7012?
• What does its onboarding look like, and how long does it take?
• How will it measure whether the relationship is working?

If you are unhappy with your current provider, the first thing to figure out is why. When a prospect comes to us unhappy with another provider, I try to understand the reason and be honest about whether we can solve it. If we can, we continue the conversation. If we cannot, we should not work together.

A Strategic IT Roadmap for Defense Contractors

For most of our clients, we plan three to five years ahead. We start with the client's business goals, then align IT, cybersecurity, and compliance to help meet them, while making sure the basics, such as hardware and software lifecycle management, are maintained.

For a defense contractor, a roadmap typically includes:

• The CMMC certification path and reassessment dates.
• Planned hardware and software replacements, especially for legacy systems.
• Cloud and licensing decisions, including any enclave or GCC High migration.
• Security tool upgrades.
• Budget by year, so leadership can plan.
• A plan for the eventual move to NIST SP 800-171 Revision 3.

The roadmap is reviewed in regular meetings, so it stays current as contracts, requirements, and the business change.

How We Measure Success With a CMMC Client

Our role is to make the relationship worth more to the client than it costs. For a CMMC client, after one year, success looks like:

• The client is compliant with its required framework.
• There are no unresolved vulnerabilities.
• The SSP, policies, and evidence reflect the current environment.
• We meet regularly to review IT, cybersecurity, and compliance together.
• The client would refer us to a peer.

That last one is the best measure I know. If a client is willing to put their name behind us, we are doing our job.

Why I Do Not Think of This as Selling

I am responsible for all new business at Intech Pacific, and I own the client relationships. People sometimes assume that means every client meeting is a sales meeting. It is not.

When I sit down with a client for a roadmap meeting, the goal is to move them forward. Sometimes that means recommending a project. Sometimes it means telling them a project can wait. I got my CISSP and CCA partly to make sure prospects know I am not a salesperson who learned the vocabulary. I have done this work since 2000, and I would rather lose a deal than recommend something a client does not need.

How We Build Trust in the First 90 Days

For a new CMMC client, the first 90 days set the tone for everything that follows. The approach is simple:

1. Do what we say we will do.
2. Clients should never have to wonder where a project stands.
3. Understand the client's goals, not just their compliance requirements.
4. Deliver a roadmap that ties the work to those goals.

Part 13: Your CMMC Action Plan

The right next step depends on where you are today. Below is a practical plan for Level 1 contractors, Level 2 contractors, subcontractors, and primes. It applies whether or not the pause is lifted soon.

Step 1: Confirm Which CMMC Level Applies to You

Review your contracts and subcontracts for DFARS 7012, 7021, 7025, and FAR 52.204-21, and identify whether you handle FCI only or CUI. Ask your prime what level it expects of you.

For subcontractors: most primes have not yet worked out exactly how flow-down will work. Until they do, we advise subcontractors to match the CMMC level of the DoW contract their work supports. If the prime contract requires Level 2, plan for Level 2.

Step 2: Confirm You Have SPRS and PIEE Access

Make sure someone at your company has active access to SPRS and PIEE, and that at least one backup person does too. Getting access can take days to weeks. Do not wait until you need to submit.

Step 3: Get an Honest Gap Assessment

Assess your environment against every requirement and assessment objective. If you have done a self-assessment before, have someone independent check it. The goal is an accurate score, not a high one.

Step 4: Correct Your SPRS Status if Needed

If your current SPRS score or affirmation is higher than your actual status, correct it. Talk to legal counsel about how to do that if you have concerns about past submissions.

Step 5: Define Your Scope

Decide between an enclave and an enterprise approach. Categorize your assets. Document the boundary.

Step 6: Build Your Remediation Roadmap

Prioritize gaps by risk and by point value. Close security gaps first. When a client has a limited budget, security gaps come before anything else.

Step 7: Implement and Document Together

Write the SSP as you implement, not after. Each change to the environment should be reflected in the documentation.

Step 8: Collect Evidence Continuously

Set up a process to collect and organize evidence for every requirement as part of normal operations.

Step 9: Prepare for the Assessment

Run a mock assessment. Practice interviews. Confirm your POA&M, if any, meets the rules. Choose a C3PAO from the Cyber AB Marketplace and schedule early. Assessor calendars fill quickly.

Step 10: Maintain Compliance

After certification, keep monitoring, patching, collecting evidence, and updating documentation. Complete your annual affirmation. Plan for reassessment in three years.

Your First 90 Days: A Practical Schedule

If you are starting from scratch, here is how I would structure the first 90 days. It is designed to produce an accurate picture of where you stand and a funded plan to close the gaps.

Days 1 to 30: Understand your obligations.

• Gather every contract, subcontract, and purchase order with defense work.
• Identify DFARS 7012, 7021, 7025, and FAR 52.204-21 clauses.
• Ask your primes, in writing, what CMMC level they expect and by when.
• Confirm SPRS and PIEE access for at least two people.
• Identify the senior official who will be the affirming official, and brief them on what the role means.
• Inventory the information you receive and where it goes.

Days 31 to 60: Measure where you stand.

• Define a preliminary CUI boundary.
• Complete an independent gap assessment against all 110 requirements and their objectives.
• Calculate an accurate SPRS score.
• Review your current SPRS entry and correct it if necessary.
• Review every cloud service and tool that touches CUI for FedRAMP and FIPS requirements.
• Decide between an enclave and an enterprise approach.

Days 61 to 90: Build the plan.

• Prioritize gaps by risk and point value.
• Select tools and services to close technical gaps.
• Assign owners for each remediation item.
• Establish the documentation plan, starting with the SSP.
• Set a target date for assessment readiness.
• Build a budget for implementation, the assessment, and the first year of maintenance.
• Present the plan to leadership for approval and funding.

At the end of 90 days, you should know your real score, your scope, your cost, and your timeline. That is enough to make good decisions, whatever the DoW decides after the review.

How to Conduct a CMMC Level 1 Self-Assessment

A Level 1 self-assessment evaluates your environment against the 15 requirements of FAR 52.204-21. Every requirement must be fully met. There is no POA&M and no partial credit.

The 15 Level 1 requirements cover six areas:

• Access control: limit system access to authorized users and devices, limit users to the transactions they are authorized for, control connections to external systems, and control information posted on public systems.
• Identification and authentication: identify users and devices, and authenticate them before allowing access.
• Media protection: sanitize or destroy media containing FCI before disposal or reuse.
• Physical protection: limit physical access to authorized individuals, escort visitors, maintain audit logs of physical access, and control physical access devices.
• System and communications protection: monitor and protect communications at external boundaries, and separate publicly accessible systems from internal networks.
• System and information integrity: identify and correct system flaws, protect against malicious code, update protection mechanisms, and scan systems and files.

Level 1 self-assessment steps:

1. Identify where FCI is stored, processed, and transmitted.
2. Define the systems in scope.
3. Assign a team with IT, operations, and leadership involvement.
4. Evaluate each of the 15 requirements and their assessment objectives.
5. Collect evidence for each: configurations, screenshots, policies, logs, and records.
6. Remediate anything not fully met.
7. Document the results.
8. Enter your self-assessment in SPRS and have a senior official complete the affirmation.
9. Repeat annually.

Do not underestimate Level 1. Some of the harder requirements, such as monitoring and protecting communications at external boundaries and controlling connections to external systems, are part of Level 1, and documentation is still required.

A Realistic Level 2 Timeline

Every company is different, but for a typical small contractor starting with limited compliance maturity, the path to assessment-ready is measured in months, not weeks. A general sequence:

• Month 1: Contract review, scoping, gap assessment
• Months 2 to 3: Remediation planning, tool selection, begin implementation
• Months 3 to 8: Implementation, documentation, evidence collection
• Months 8 to 10: Mock assessment, final remediation, interview preparation
• After readiness: C3PAO assessment, subject to assessor availability

Companies with a strong starting point can move faster. Companies with complex environments, legacy systems, or a large user count usually take longer.

A Note for Primes

If you are a prime, your subcontractors' readiness is your readiness. Start by identifying which suppliers receive CUI and FCI, set clear expectations for their CMMC level, and consider supporting them through a structured readiness program. The earlier you know where your supply chain stands, the fewer surprises you will have at award time.

A Note for MSPs Serving Defense Contractors

If you are an MSP with defense contractor clients, your services may put you in their assessment scope. If you provide security protection or have administrative access to their CUI environment, the controls you use to manage them matter to their assessment. MSPs have been used as an entry point in major supply chain attacks. I expect scrutiny of MSPs in the defense supply chain to keep increasing.

What to Expect During a C3PAO Assessment

A CMMC Level 2 C3PAO assessment is a structured, evidence-based review of your environment against all 110 requirements and 320 assessment objectives. Knowing what happens at each stage removes a lot of the stress.

Before the assessment. You select a C3PAO from the Cyber AB Marketplace, sign an agreement, and agree on dates. The C3PAO will ask for your SSP, network diagrams, asset inventory, and other documentation in advance. Many C3PAOs hold a readiness review to confirm that you are prepared and that your scope is clearly defined. If your documentation is not ready, this is where it shows.

During the assessment. The assessment team, led by a Lead CCA, works through each requirement. For every assessment objective, they use the three methods I described earlier: examine documents and configurations, interview the people who do the work, and test controls in operation. Assessments often include on-site time and remote sessions. Expect to spend several days with the team, and expect them to ask the same question more than one way.

Scoring. Each requirement is scored as met, not met, or not applicable. A requirement is met only if all of its objectives are met. Requirements met by an inherited control from a provider still need evidence that the inheritance is real.

Results. If you meet all 110 requirements, you receive a final Level 2 certification valid for three years. If you score at least 88 and your remaining gaps are all eligible for a POA&M, you receive conditional status and must close those items within 180 days. If you score lower, or if ineligible requirements are not met, you do not receive a certification and will need to remediate and be reassessed.

After the assessment. Results are recorded in the DoW's system, and your status appears in SPRS. Your senior official completes the affirmation. From that point, you must maintain the environment exactly as assessed, affirm annually, and report any changes to your CMMC Unique Identifiers.

How to prepare your team:

• Identify a point of contact who knows the environment and the documentation well.
• Make sure the people who perform each control can explain it in their own words.
• Organize evidence by requirement so it can be found in seconds.
• Run a mock assessment with someone who knows how assessors work.
• Do not change the environment in the weeks before the assessment unless you also update the documentation.

When we support a client during a C3PAO assessment, our CCAs and CCPs are in the room or on the call to help explain the environment and locate evidence. We cannot answer for the client, and we would not want to. But we can make sure nothing is missed because someone could not find the right screenshot.

How CMMC Flows Down From Primes to Subcontractors

DFARS 252.204-7021 requires primes to flow CMMC requirements down to subcontractors whose work involves FCI or CUI. The subcontractor must have a current CMMC status at the level appropriate to the information it will handle before the prime awards the subcontract.

In practice, flow-down creates several common situations:

• A prime requires a higher level than the DoW contract. This is allowed. The subcontract is a private agreement, and the prime can set its own terms.
• A prime requires C3PAO certification even though the DoW contract currently accepts self-assessment. Also allowed, and increasingly common during the pause.
• A prime has not decided what to require. Many primes are still working through their flow-down approach. In the meantime, we advise subcontractors to match the level of the DoW contract their work supports.
• A prime sends CUI to a subcontractor that is not ready for it. This creates risk for both parties. Subcontractors should not accept CUI into systems that do not meet the requirements.
• A lower-tier subcontractor supports a sub. The flow-down continues through every tier where FCI or CUI is shared.

If you are a subcontractor, ask your primes directly, in writing, what they require and by when. Keep the answer in your compliance records.

How to Talk to Your Leadership Team About CMMC

Many of the people reading this guide are not the final decision-makers at their company. If you need to make the case to an owner or board, here is how I would frame it:

1. It is already a contract requirement. DFARS 7012 has required NIST SP 800-171 since 2017. CMMC only adds verification.
2. The company is already affirming compliance. If the SPRS affirmation is inaccurate, the company has legal exposure today.
3. Primes are deciding now. Teaming and subcontract decisions are being made based on CMMC status.
4. The work takes a long time. Starting late means competing for assessor time later.
5. It improves security. The same controls reduce ransomware, business email compromise, and insurance risk.
6. The cost is predictable. With a clear scope and roadmap, the cost can be planned and budgeted rather than absorbed as a surprise.

Leadership has to own compliance. IT can implement controls, but only leadership can set priorities, provide the budget, and hold the company accountable for following its own policies.

Part 14: CMMC Level 3 and NIST SP 800-171 Revision 3

Most contractors will never need Level 3, and most will not face Revision 3 for some time. But both come up often enough in client conversations that they deserve their own section.

What Is CMMC Level 3?

CMMC Level 3 is the highest level of the program, reserved for contractors supporting the DoW's highest-priority programs, where CUI is a likely target of advanced persistent threats. It requires a Level 2 C3PAO certification first, plus implementation of 24 selected requirements from NIST SP 800-172, assessed by DIBCAC.

Key facts:

• Prerequisite: a final Level 2 C3PAO certification for the same assessment scope.
• Requirements: the 110 Level 2 requirements plus 24 enhanced requirements from NIST SP 800-172.
• Assessor: DIBCAC, a government team. Not a C3PAO.
• Validity: three years, with annual affirmations.
• POA&Ms: allowed only in limited circumstances, with a 180-day closeout.
• Scale: the DoD estimated in 2023 that about 1,487 entities would need Level 3. That is a very small share of the defense industrial base.

The NIST SP 800-172 requirements focus on defending against sophisticated adversaries. They cover areas such as threat hunting and threat intelligence, a security operations capability, penetration testing, stronger authentication and system integrity protections, and tighter supply chain risk management.

A correction to some older content, including one of our own posts: Level 3 is not "130 practices" and is not assessed by a C3PAO. Those descriptions came from the CMMC 1.0 model. Under the current program, Level 3 is 110 plus 24 requirements, assessed by DIBCAC.

The original Phase 3 date of November 10, 2027, when Level 3 requirements were to begin appearing in solicitations, is on hold along with the rest of the suspended milestones.

What Is NIST SP 800-171 Revision 3?

NIST published SP 800-171 Revision 3 on May 14, 2024. It updates and reorganizes the requirements for protecting CUI. The DoW has not adopted it for CMMC. Contractors are still assessed against Revision 2.

What changes in Revision 3:

• The requirements are restructured and renumbered, and some are consolidated or withdrawn.
• New families are added, including Planning, System and Services Acquisition, and Supply Chain Risk Management.
• Organization-defined parameters are introduced, allowing an agency to specify values such as time frames and frequencies.
• The requirements align more closely with NIST SP 800-53 Revision 5.

The government-wide FAR CUI rule re-proposed in June 2026 would use Revision 3 as its baseline. If that rule is finalized, it is reasonable to expect pressure for the DoW to align CMMC with Revision 3 eventually.

My advice: build to Revision 2 now, because that is what you will be assessed against. But design your program so it can adapt. A well-documented, well-run Revision 2 environment will transition to Revision 3 far more easily than a program built on templates.

Part 15: CMMC Is Also a Cybersecurity Program

It is easy to treat CMMC as a paperwork exercise. It is not. The 110 requirements in NIST SP 800-171 are a proven cybersecurity framework, and following them makes a company harder to breach. That benefit does not depend on the DoW's timeline.

I usually explain the relationship between compliance and security this way. There is a reason a framework exists, and the framework was chosen because it works. If you follow it, you will naturally be more secure. There is very little downside to following a compliance requirement, and a great deal of downside to ignoring one.

The Threats Hawaii Businesses Face Most

The threats we see most often targeting businesses in Hawaii are business email compromise, ransomware, and token theft. Defense contractors face all three, plus targeting by nation-state actors looking for technical data.

• Business email compromise. An attacker takes over or impersonates an email account to redirect payments, steal information, or launch further attacks from a trusted address.
• Attackers encrypt systems and often steal data first, then demand payment. For a defense contractor, a ransomware incident involving CUI also triggers DFARS 7012 reporting.
• Token theft. Attackers steal the session token issued after a user signs in, allowing them to bypass the password and MFA entirely.

How Phishing Has Changed

Phishing has become extremely sophisticated. The poorly written emails of the past have been replaced by messages that look exactly like legitimate business communication. Add AI tools that can mimic human voices on phone calls and faces on video calls, and phishing has become a major threat for every business.

The most preventable breach scenario I see starts with a PDF the user was not expecting. The PDF contains a link. The link leads to a convincing login page. The user signs in, and the attacker captures the session token. My advice to every user: do not open documents or click links you were not expecting, even from people you know. Verify first, through a separate channel.

Why Awareness Training Is the Most Effective Control

If I could choose only one security control for a small business, it would be security awareness training. Building a culture of cybersecurity, where every employee understands the risks and knows what to do, protects against more attacks than any single tool.

NIST SP 800-171 requires security awareness training (3.2.1), role-based training (3.2.2), and insider threat awareness (3.2.3). Treat these as more than a check box. Short, regular training and simulated phishing tests change behavior far more than a single annual session.

How AI Is Changing Both Attack and Defense

AI is changing cybersecurity on both sides.

On defense, AI is automating work that used to be manual. A security operations center is a good example. No human team can review millions of log entries an hour, but AI can do that well and bring the important events to the analysts who need to act on them.

On offense, attackers are using AI to automate sophisticated attacks and to impersonate people on calls and video. The same technology that makes our monitoring better makes their phishing better.

What a Managed SOC Does for a Defense Contractor

A managed security operations center (SOC) watches your environment 24 hours a day, seven days a week, and responds when something looks wrong. The simplest way I can explain the value: someone is always looking out for you and making sure attackers do not get into your network.

For CMMC, a SOC supports several requirements directly, including audit log review (3.3.5), security monitoring (3.14.6 and 3.14.7), and incident handling (3.6.1). It also provides evidence that those requirements are operating, which assessors will want to see.

"We Are Too Small to Be a Target"

I hear this often, and I always give the same answer. Attackers are not looking at size. They are looking for easy ways in. Small businesses are frequently the most vulnerable, because they do not have the IT maturity to protect themselves, and they are the least able to recover from a serious incident.

For defense contractors, being small can make you more attractive, not less. A small subcontractor with access to the same technical data as its prime is an easier target than the prime.

Where Businesses Underspend

I rarely see businesses overspend on cybersecurity. I often see them underspend, and I see budgets that are not aligned. A common example: a company buys a new, top-of-the-line firewall while running network switches that are 20 years old. Security depends on the whole environment, not the most visible piece.

One practice from Wall Street I wish every small business adopted is its attitude toward IT spending. Financial services firms understand that better IT makes the business run better, which increases profit. It is an investment, not an overhead cost.

The Five Benefits of CMMC Compliance

Beyond contract eligibility, CMMC compliance brings real benefits:

1. Competitive advantage. Primes prefer subcontractors that are already certified. Certification can decide a teaming decision.
2. Stronger security. The 110 requirements reduce the chance of a breach and limit the damage if one occurs.
3. Lower legal risk. An accurate, well-documented compliance program is your best defense against False Claims Act exposure.
4. Better cyber insurance outcomes. Many of the controls insurers require overlap with NIST SP 800-171.
5. Operational discipline. Documented processes, asset inventories, and change management make IT easier to manage and support.

And the benefit that matters most to me: protecting the information our warfighters depend on.

Continuous Compliance

Continuous compliance means treating CMMC as an ongoing program rather than a project with an end date. In practice, it means building a culture of compliance, dedicating resources to it, conducting regular assessments, and using drift detection to catch configuration changes that take you out of compliance.

Leadership has a particular role here. With IT, leaders need to trust their team, provide the budget, and check in regularly. Compliance is different. Compliance has to be driven by leadership, or it will fail. An affirming official who signs the annual affirmation without understanding the program is taking a personal and corporate risk.

Cyber Insurance and CMMC

Cyber insurance applications have become longer, premiums have increased, requirements have grown, and insurers are more involved in incident response and forensics than they used to be. There is no shortcut. You have to review every requirement and make sure it is implemented.

The good news for CMMC contractors is that much of the work overlaps. MFA, endpoint protection, backups, logging, incident response plans, and training are required by both. A well-run CMMC program makes insurance applications easier to complete accurately.

A word of caution: answer insurance applications accurately. Misrepresentations on an application can give the carrier grounds to deny a claim, the same way an inaccurate SPRS affirmation creates False Claims Act exposure.

Part 16: Lessons From 25 Years in IT, Cybersecurity, and Compliance

I want to close the main body of this guide with a few lessons that shape how I approach CMMC. They come from more than 25 years of doing this work, from Manhattan to Honolulu.

You Often Get Only One Chance to Do It Right

I cut my teeth on Windows NT to Windows 2000 migrations as a field technician running around Manhattan. There was no Google to speak of. Software came on disks. Knowledge bases were thin. If something went wrong during a migration, fixing it took an enormous amount of work.

One migration kept me on the phone with Microsoft support for three days, and I slept at the client's office one of those nights. The problem turned out to be DNS. When you run into an issue like that, you never forget it.

CMMC is similar. The preparation is long, the assessment is thorough, and a failed assessment costs time, money, and credibility. It is far better to do the work right the first time than to fix it afterward.

Availability Has to Be Planned

After 9/11, availability became the top priority for every firm I worked with. Confidentiality and integrity were assumed, but availability took real effort. Every client had a DR site ready. The constant threat of further attacks meant we never knew when something could happen.

That mindset carries over to CMMC. The requirements cover confidentiality and integrity heavily, but your business still has to keep running. A compliant environment that cannot recover from an outage is not a success.

Documentation Is Not Optional

In finance, regulators expected documentation and reporting for everything. Most other industries have not adopted that discipline, largely because enforcement has been lighter. Finance audits focused on financial controls and how technology supported them. CMMC starts with the technical controls, but it demands the same documentation discipline. Contractors who learn that early have a much easier path.

The Human Side Matters Most

Certifications teach frameworks, controls, and assessment methods. What they do not teach is how to work with the people behind the controls: the owner worried about cost, the engineer who does not want another login, the office manager who became the IT contact by accident.

I started in IT by accident myself. I was the IT point of contact at a company supported by an MSP, and the MSP offered me a job when I was finishing college. I spent many years as a hands-on engineer and never expected to do anything else. It turned out that the skill that mattered most over time was working with people. That is what led me to consulting and client strategy, and it is what I think clients should look for in a CMMC partner: someone who understands both the controls and the people who have to live with them.

Learn From Peers

I have been lucky to work with smart, forward-thinking people throughout my career. I have been involved with MSP peer groups for a long time, including Evolve Peer Groups, and I learn something every time we meet. Locally, I stay involved with ISC2 Hawaii, ISACA Hawaii, the Guam Contractors Association, ABC Hawaii, BIA Hawaii, SAME Honolulu, SAME Guam, and AIA Honolulu. Intech Pacific also joined the MSP Collective in 2026, a community of MSPs that share compliance and security practices rather than working in isolation.

We also try to share what we learn. In June 2025, I co-hosted a CMMC webinar with Field Effect's Chief Security Officer, Matt Lewis, on simplifying the path to compliance for small and mid-size contractors. The questions we received that day were the same ones I still hear every week: how to scope, how to afford it, and how to know whether a provider is qualified. This guide is, in many ways, my longer answer to those questions.

CMMC is changing too quickly for anyone to keep up alone. I follow threat feeds, peers, news, vendors, and anywhere else I can get reliable information. I encourage contractors to do the same, and to be skeptical of any single source, including us.

Official CMMC Resources

When you research CMMC, go to primary sources first. Summaries, including this one, can fall behind when the program changes. These are the sources I rely on:

• DoW CIO CMMC page: the official program site, including the model, scoping guides, assessment guides, and FAQs.
• 32 CFR Part 170 final rule: the program rule.
• 48 CFR DFARS final rule: the rule that puts CMMC into contracts.
• DFARS 252.204-7012: the clause requiring NIST SP 800-171 and incident reporting.
• NIST SP 800-171 Revision 2: the 110 requirements assessed at Level 2.
• NIST SP 800-171A: the assessment objectives for each requirement.
• The Cyber AB CMMC Marketplace: the directory of C3PAOs, CCAs, CCPs, and registered organizations.
• NARA CUI Registry: the official list of CUI categories.
• DoW Office of Small Business Programs: announcements and resources for small contractors, including the July 2026 suspension notice.

For the pause specifically, law firm client alerts and trade press have been the fastest source of detailed analysis. Federal News Network, Nextgov, DefenseScoop, and client alerts from firms such as Crowell and Moring, Holland and Knight, and Covington have all covered the 2026 developments closely.

I also watch a lot of YouTube content from CMMC practitioners and assessors. It is a good way to hear how people doing the work interpret changes. As with any source, check what you hear against the official documents before acting on it.

CMMC Glossary

Affirming official: the senior company official who affirms, in SPRS, that the company meets and continues to meet its CMMC requirements.

C3PAO: Certified Third-Party Assessment Organization. An organization authorized by The Cyber AB to conduct CMMC Level 2 certification assessments.

CAICO: the CMMC Assessors and Instructors Certification Organization, which handles certification of CMMC professionals and assessors. ISACA has served in this role since December 2025.

CCA: Certified CMMC Assessor. An individual certified to conduct CMMC Level 2 assessments as part of a C3PAO.

CCP: Certified CMMC Professional. An individual certified in CMMC who can support assessments and readiness work.

CUI: Controlled Unclassified Information. Government information that requires safeguarding under law, regulation, or government-wide policy.

The Cyber AB: the organization that manages the CMMC ecosystem under an agreement with the DoW. Formerly the CMMC Accreditation Body.

DC3: the DoD Cyber Crime Center, where DFARS 7012 cyber incidents are reported.

DFARS: the Defense Federal Acquisition Regulation Supplement, the DoW's supplement to the FAR.

DIBCAC: the Defense Industrial Base Cybersecurity Assessment Center, the government team that conducts Level 3 assessments and Medium and High NIST SP 800-171 assessments.

Enclave: a separate, secured environment used only by the people and systems that handle CUI, used to limit assessment scope.

FCI: Federal Contract Information. Non-public information provided by or generated for the government under a contract.

FedRAMP: the Federal Risk and Authorization Management Program, which authorizes cloud services for government use. DFARS 7012 requires FedRAMP Moderate or equivalent for cloud services handling CUI.

GCC and GCC High: Microsoft's Government Community Cloud environments. GCC High is designed for export-controlled data such as ITAR.

NIST SP 800-171: the NIST publication defining the 110 security requirements for protecting CUI in nonfederal systems. The basis of CMMC Level 2.

NIST SP 800-172: the NIST publication defining enhanced security requirements, 24 of which are used for CMMC Level 3.

PIEE: Procurement Integrated Enterprise Environment, the DoW portal used to access SPRS.

POA&M: Plan of Action and Milestones. A documented plan for closing requirements not yet met.

RP, RPA, RPO: Registered Practitioner, Registered Practitioner Advanced, and Registered Provider Organization. Registrations with The Cyber AB, not certifications.

Shared responsibility matrix: a document defining which party is responsible for each security requirement when multiple providers are involved.

SPRS: the Supplier Performance Risk System, where contractors record CMMC status and affirmations.

SSP: System Security Plan. The document describing your CUI environment and how each requirement is met.

Talk to Intech Pacific About CMMC Compliance in Hawaii and Guam

If you take one thing from this guide, I hope it is this: following CMMC helps you win and keep contracts, and it also improves your company's cybersecurity and protects the warfighters who depend on the information you handle. That is the purpose of the program, and it did not change with the pause.

If you are not sure where you stand, start with a free CMMC Recon session. In 45 minutes, we will review your contracts, discuss your scope, and give you a plain-language view of your next steps. You can also explore our full range of CMMC services or reach our team at (808) 748-4062 through our contact page.

About the Author

Terence Tang is VP Client Strategy at Intech Pacific, a Honolulu-based provider of managed IT, cybersecurity, and compliance services for businesses and DoD contractors in Hawaii and Guam. He has worked in IT, cybersecurity, and compliance since 2000 and holds the CMMC Certified Assessor (CCA), CISSP, and CISM certifications. Terence leads client strategy at Intech Pacific. He helps organizations meet CMMC, NIST 800-171, HIPAA, and PCI requirements and make sure their managed IT services deliver real value. He has been involved in more than 100 CMMC gap assessments. Terence is active with ISC2 Hawaii, ISACA Hawaii, the Guam Contractors Association, and SAME Honolulu and Guam.

FAQ

Is CMMC still required after the 2026 pause?

Yes. The July 2026 pause suspended the Phase 2 requirement for C3PAO certification, but the 32 CFR Part 170 program rule, DFARS 7012, NIST SP 800-171, and self-assessment requirements are still in effect. Your primes may also still require certification.

Can I still get a CMMC Level 2 certification during the pause?

Yes. C3PAOs are still conducting Level 2 assessments. A certification earned during the pause is valid for three years and satisfies primes that require it.

How much does CMMC Level 2 cost for a small business?

For a 50-person company pursuing Level 2 across its whole environment, we typically see about $100,000 to implement, about $75,000 for the C3PAO assessment, and $50,000 to $100,000 a year to maintain. An enclave can reduce costs when only part of the company handles CUI.

Do subcontractors in Hawaii and Guam need CMMC certification?

Yes, if they handle FCI or CUI. CMMC requirements flow down to subcontractors at every tier, and a prime can require a higher level than the DoW contract. Until primes define their flow-down more clearly, we recommend subcontractors plan to match the level of the DoW contract their work supports.

How do I choose a qualified CMMC provider in Hawaii or Guam?

Look for a provider that is CMMC Level 2 certified itself, has CCPs and CCAs on staff, and can name clients it has taken through C3PAO certification. An RP or RPO badge alone is a registration, not a certification. Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam and the only MSP in the region with CCPs and CCAs on staff.