CMMC compliance · Level 2 readiness · Client Vision by 3HUEPhase 2 paused. The 110 still count.
Jul 13Phase 2 suspended
Nov 10date withdrawn
60day review
110practices still apply
Suspended by the Department of War CIO's reform memorandum of July 13, 2026. No replacement date has been announced.
Phase 2 and its November 10, 2026 third-party date were suspended while a 60-day review runs. What did not change: Phase 1 self-assessment, every one of the 110 NIST SP 800-171 practices, your SPRS score and your annual affirmation. Client Vision maps your controls to the 110, links the evidence a contracting officer or assessor asks for, publishes your System Security Plan, and keeps every open POA&M item on the clock. Run it yourself, or with 3HUE's CMMC team.
Screens show the Big Venture Incorporated demo workspace. All figures are sample data.
Trusted in regulated industriesA transit technology companyA large North American bankA marine services company
3 regulated industries10 business-day Snapshot100% executive-led delivery
What is CMMC compliance?
The Pentagon's proof that you protect its data.
CMMC (Cybersecurity Maturity Model Certification) is the Department of Defense program that verifies contractors protect Federal Contract Information and Controlled Unclassified Information (CUI). Level 2 covers the 110 security requirements of NIST SP 800-171. The Phase 2 requirement for an assessment by an accredited third party (a C3PAO) was suspended on July 13, 2026; Level 2 self-assessment and annual affirmation continue.
Level 115 basic safeguards for Federal Contract Information. Annual self-assessment.
Level 2110 NIST SP 800-171 practices for CUI. Self-assessment and annual affirmation now; the C3PAO requirement is suspended pending the review.
Level 3Level 2 plus selected NIST SP 800-172 requirements. Government-led assessment.
The CMMC rollout
Four phases. Three are suspended.
- Nov 10, 2025Phase 1 · in force
Level 1 and Level 2 self-assessments appear in solicitations, with SPRS scores and annual affirmations. Still required.
- Nov 10, 2026Phase 2 · suspended Jul 13, 2026
Level 2 third-party (C3PAO) certification was to be required. The date, new C3PAO designations and the waiver process are withdrawn until further notice; existing clauses are removed by contract modification.
- Nov 10, 2027Phase 3 · suspended
Level 3 government assessments were to be added. A pending milestone, not a replacement Phase 2 date.
- Nov 10, 2028Phase 4 · suspended
Full implementation was planned here. Not an announced restart date.
Status checked October 20, 2026. Sources: the Department of War CIO CMMC Reform Memorandum of July 13, 2026, as reported by Latham & Watkins, WilmerHale and Federal News Network. The Task Force report was due in 60 days; no public report had been located as of October 12.
How we get you assessment-ready
Seven words. Every screen is the real product.
10 / 12controls cross-walked to CMMC Level 2 practices on the first import
83%CMMC L2 coverage in the GROC compliance report
v1.0System Security Plan approved, published and frozen
180days: the conditional window every open POA&M item is tracked against
Figures from the Big Venture Incorporated demo workspace (sample data), Sep 26, 2026.
Free tool · CMMC Level 2 readiness check
How many of the 110 can you prove today?
Tick each NIST SP 800-171 family you could evidence to an assessor tomorrow. Your answers stay in this browser.
Ways to work with 3HUE
See pricing for all three lanes →01 · Client VisionRun it yourselfFree workspace to start. Assurance adds CloudSignals, RiskOps and a governance pack; Multi adds all six. Annual or monthly.Start free →
03 · Managed by 3HUEWe run it with youA named vCISO and scoped programs (RMP, CIRP, ISP, VCP, SEA), run in the Client Vision plan you hold. Priced to your program in the builder.Book a vCISO strategy call →
CMMC compliance services · two ways in
Your workspace. Your call on who drives.
Self-serve
Run it yourself.
- Import your baseline and cross-walk it to CMMC Level 2 practices
- Link evidence where it already lives: SharePoint, Drive, Box
- Write, approve and publish your System Security Plan
- Track every POA&M item to assessor validation
CMMC team by 3HUE
Or we get you there.
- A readiness assessment against all 110 practices, with a gap list you can act on
- Your SSP and POA&M built with you, in the same workspace
- Evidence organized the way a C3PAO asks for it
- Assessment prep and support through to your Level 2 status
Questions
What contractors ask first.
What is CMMC compliance?
CMMC is the Department of Defense's Cybersecurity Maturity Model Certification. It verifies that contractors protect Federal Contract Information and Controlled Unclassified Information. Level 2, the level most CUI contracts require, covers the 110 security requirements of NIST SP 800-171.
Is CMMC Phase 2 cancelled?
Suspended, not cancelled. On July 13, 2026 the Department of War CIO suspended Phase 2, the November 10, 2026 date and all pending CMMC milestones until further notice, and set up a CMMC Reform Task Force to report within 60 days. As of October 2026 no public report or replacement date has been published. Contracts that already carry a C3PAO clause are being amended by modification, so read the modification, not the headline.
What still applies during the suspension?
Phase 1: Level 1 and Level 2 self-assessments in solicitations, a current SPRS score and an annual affirmation by an affirming official. DFARS 252.204-7012 safeguarding and 72-hour incident reporting. All 110 NIST SP 800-171 Rev. 2 practices, which the Department says it will enforce through self-assessments and selected government-led assessments. False Claims Act exposure on every affirmation.
What are the CMMC Level 2 requirements?
The 110 practices of NIST SP 800-171, grouped into 14 families such as Access Control, Identification and Authentication, Incident Response and System and Communications Protection, plus a System Security Plan describing how each practice is met.
What is an SPRS score?
The Supplier Performance Risk System score is the result of a NIST SP 800-171 self-assessment that contractors submit to the DoD. A perfect score is 110; unmet requirements subtract weighted points. During the suspension the Department enforces NIST SP 800-171 through self-assessments posted to SPRS and selected government-led assessments, so a current, accurate score matters more, not less.
Can we pass with open POA&M items?
Sometimes. CMMC allows conditional Level 2 status when a minimum score is met and only permitted requirements remain open, but every open POA&M item must be closed within 180 days. Client Vision keeps each item owned, dated and moving to assessor validation.
What is a System Security Plan (SSP)?
The SSP documents your CUI environment and how each Level 2 practice is implemented. Assessors start there. In Client Vision it's authored, approved and published as a frozen version, so the plan an assessor received stays reproducible.
We already hold a C3PAO certification. Was it wasted?
No. A C3PAO assessment is not required for award during the suspension, but the evidence behind it is what a contracting officer, a DIBCAC audit or a False Claims Act inquiry will ask for. Keep the documentation current; Client Vision keeps the SSP and evidence versioned so the plan an assessor received stays reproducible.
Do we have to report cyber incidents?
Yes. Under DFARS 252.204-7012, contractors must report cyber incidents affecting covered defense information to the DoD within 72 hours of discovery. Client Vision's incident timeline records every step from the moment you declare.
Phase 2 paused. The 110 still count.
Start with a CMMC readiness assessment: fifteen minutes, your questions, real screens.