Close the gaps before the auditor arrives
Readiness for CMMC, NIST SP 800-171, and FedRAMP — from a team that has audited these frameworks firsthand. We tell you where you stand, and get you where you need to be.
CMMC Phase II — third-party (C3PAO) certification as a condition of contract award — remains suspended. Since September 3 a DFARS class deviation directs contracting officers to remove that requirement from solicitations and contracts, and the reform task force's report (due September 11) has not been published. What hasn't changed: your self-assessment, your NIST SP 800-171 obligations, and the duty to protect CUI all remain in effect. Readiness is still the right move. Read the CMMC status page →
If you sell to the Department of Defense — even as a subcontractor — and your contracts touch Federal Contract Information or Controlled Unclassified Information (CUI — sensitive government data that isn't classified but must be protected), you already carry security obligations under NIST SP 800-171 and DFARS. Those haven't changed. What has: in July 2026 the government suspended the rollout of CMMC's third-party certification (Phase II) pending a review, and in September a class deviation directed contracting officers to remove that requirement from contracts, and what replaces it has not been announced — but the self-assessment you report yourself, and the duty to actually protect that data, both remain in force. Readiness is still the work. We find your gaps against those requirements, help you close them, and get you assessment-ready — whether that's the self-assessment on the table today or a C3PAO down the road.
Auditor perspective
Your readiness is guided by a former FedRAMP auditor who spent a decade on the other side of the table. We know exactly what assessors look for — because we were one.
Gap assessment
A clear-eyed read of your current posture against the requirements: what's in place, what's missing, what's at risk.
Remediation support
A prioritized path to close the gaps — with hands-on help implementing the controls that actually move your score.
Evidence & SSP support
We help you build your System Security Plan and gather the evidence an assessor will actually ask for — not a binder of filler.
Assessment preparation
Mock reviews and documentation checks so nothing surprises you when the real assessment starts.
Platform-accelerated
Optionally accelerate everything with OCIC, our compliance automation platform — so readiness work becomes continuous proof.
CMMC readiness, briefly
What is CMMC readiness?
Figuring out where your security stands against CMMC's requirements, fixing what's missing, and building the documentation and evidence — before you pay for the official assessment. Going in unprepared is the expensive way to find your gaps.
Who does CMMC apply to?
Any organization in the defense supply chain that handles Federal Contract Information or CUI. The required level — and whether it's a self-assessment or a third-party (C3PAO) assessment — depends on your specific contract. If DFARS 252.204-7012 or a CMMC clause appears in your solicitations, it applies to you at the level they specify. Not sure? That's a fine first question to ask us.
Did the July 2026 CMMC suspension change this?
The government suspended the transition to Phase II — third-party certification as a condition of award — on July 13, 2026, and a September 3 DFARS class deviation directs contracting officers to remove that requirement from solicitations and contracts; the task force's report, due September 11, has not been published, so what replaces third-party certification is still an open question. What didn't change: your self-assessment, your NIST SP 800-171 obligations, and the duty to protect CUI all remain in effect. Readiness still matters — the requirements behind CMMC are unchanged, whatever assessment model comes next. Current state, with dates and sources: the CMMC status page.
Get Change Controlled in your inbox
Change Controlled is the OCIC newsletter: short, practical notes on CMMC, CUI scoping, and staying continuously compliant. No noise.
Get your readiness snapshot
Tell us what framework you're facing and what you run. We reply within one business day to set up a short call and walk you through where you stand against the requirements and what it would take to close the gap. No obligation.
Get your readiness snapshot
Tell us what framework you're facing and what you run. We reply within one business day to set up a short call and walk you through where you stand against the requirements and what it would take to close the gap. No obligation.