Phase 2 is on hold. Your CMMC Level 2 self-assessment is not.
Level 2 self-assessments against NIST SP 800-171 Rev 2, SPRS affirmations and DFARS 252.204-7012 still apply during the suspension. An affirmation is only as strong as the evidence behind it.
Map your pipeline's findings to the NIST 800-171 practices they affect, and estimate your SPRS score before you affirm it.
Want a guided evaluation first? Join the CMMC pilot · Government overview
CMMC status · as of October 2026
Phase 2 is suspended. Self-assessments and SPRS affirmations still apply.
CMMC Phase 2 had been scheduled to begin Nov 10, 2026. It would have made C3PAO-assessed Level 2 certification the default requirement for DoW contracts involving CUI. In July 2026 the Department of War (DoW) suspended it and set up a CMMC Reform Task Force for a 60-day review. That review ended in September 2026, and its recommendations had not been made public as of late September.
Suspended
- Level 2 (C3PAO) and Level 3 (DIBCAC) assessments as contract requirements: DoW may not designate them while the suspension lasts.
- New contract requirements may name only CMMC Level 1 (Self) or Level 2 (Self) assessments.
Still enforced today
- CMMC Level 2 self-assessments against the 110 requirements of NIST SP 800-171 Rev 2.
- A current CMMC status and affirmation in SPRS, the Supplier Performance Risk System, which offerors generally need to be eligible for award.
- DFARS 252.204-7012: safeguarding covered defense information and reporting cyber incidents.
- DoW says it continues to enforce NIST SP 800-171 Rev 2 during the suspension, through Level 1 and Level 2 self-assessments and select government-led assessments.
Why AT 3.2.x training evidence still matters
A self-assessment score and the affirmation in SPRS are your own statements to DoW, and select government-led assessments continue during the suspension. An honest affirmation scores a requirement as met only when you can show the evidence. The three Awareness and Training requirements are easy to over-score, because no scan finding, ours included, can show that they are met:
- AT.L2-3.2.1Managers, system administrators and users are made aware of the security risks of their activities and of the applicable policies, standards and procedures.
- AT.L2-3.2.2Personnel are trained to carry out their assigned information security duties.
- AT.L2-3.2.3Security awareness training covers recognizing and reporting potential indicators of insider threat.
The evidence is your training records: who completed which training, when, and what it covered. Keep them in your assessment file next to the POAM and findings you export, so every AT requirement you affirm as met is backed up.
No size exemption
When a DoW contract includes a CMMC requirement, it applies to the prime and to subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI), small businesses included. During the suspension, new requirements may name only a Level 1 or Level 2 self-assessment.
Sources, checked October 2026
- Department of War memorandum implementing the CMMC Phase II suspension (dodcio.defense.gov, PDF)
- Inside Government Contracts (Covington): CMMC Reform Task Force updates, September 2026
- Summit 7: CMMC Phase 2 suspended with 60-day review
- Fortinetics: CMMC Phase 2 suspended
General information, not legal advice: the CMMC clauses in each contract or solicitation govern what applies to you.
What you get
The 110-Practice CMMC Level 2 Catalog
The full NIST SP 800-171 Rev 2 catalog, with scan findings that carry a CWE mapped automatically to the practices they affect, such as flaw remediation and configuration management.
SPRS Score Estimator
Estimate your Supplier Performance Risk System score (-203 to 110) with the family-level calculator below. Scoring SPRS directly from your findings is not built yet.
Gap Analysis with Remediation Priorities
Remediation priorities ranked by severity, EPSS, CISA KEV status and asset context, so you fix the most exploitable findings first.
POAM Auto-Generation
Plans of Action and Milestones generated from your open cases and exported in the FedRAMP Appendix A column layout (XLSX), or as CSV or JSON, ready to adapt for your assessment package.
Audit Evidence Export
Export case and finding lists as CSV, and download an executive summary or a single case report as PDF, alongside your POAM, for your assessment package.
Cryptographic Audit Trail
Hash-chained audit log: editing or removing an entry breaks the chain. Ed25519 signing with independently verifiable proofs is in progress.
How it works for defense contractors
Step 01
Run the scanner
Point the CLI at your codebase, infrastructure configs, or import existing scan results from Nessus, Qualys, or any of 11 supported formats.
Step 02
Findings map to NIST 800-171
Findings that carry a CWE are mapped through NIST 800-53 to the NIST 800-171 practices they affect. The mapping is rule-based and versioned; findings without a CWE are not mapped yet.
Step 03
Review affected practices and export POAMs
See which practices your findings affect, estimate SPRS with the calculator, and export POAMs in the FedRAMP Appendix A layout for your assessment package.
Step 04
Track remediation in the dashboard
Assign findings to team members, set SLA deadlines, and track remediation progress.
CMMC compliance shouldn't cost $50K
300,000+ small defense subcontractors need to comply. Most can't afford a consultant.
Typical CMMC consultant
- —$15,000 – $50,000 engagement fee
- —3–6 month assessment timeline
- —Point-in-time snapshot only
- —Manual spreadsheet-based tracking
- —No continuous monitoring
- —Additional cost for remediation support
Federal Assessment — scoped per assessment boundary
- Priced per assessment boundary, not per consultant hour
- Scan and map findings in one CLI run
- Rescan and remap whenever your environment changes
- Automated POAM generation
- Risk-prioritized remediation queue
- Evidence export for your self-assessment file
Re-scans and scan-to-scan comparisons whenever you need them, not a one-time snapshot. Tell us your CUI boundary and we'll scope it.
Estimate your SPRS score
Select the implementation status for each of the 14 NIST 800-171 control families. Click a family to cycle through Not Implemented, Partially Implemented, Fully Implemented.
Estimated SPRS score
-123
Range: −203 (worst) to 110 (perfect)
See which practices your findings affect
This estimator uses control family-level granularity. To see which NIST 800-171 practices your scan findings affect, run the CVERiskPilot scanner.
Training evidence · CMMC AT.L2-3.2.1–3.2.3
Train on the vulnerabilities you actually have
Assign role-based security training from the CWEs in your own findings, track completions and verify them, and export the records for your C3PAO alongside your POAM. Insider threat awareness (3.2.3) usually also needs a dedicated awareness course.
Compliance packages
Packages for every stage of CMMC readiness
Scope a Federal Assessment for your Level 2 boundary, or start on Starter and establish a baseline first.
Federal Assessment
Defense contractors and federal suppliers handling CUI
Get to a defensible CMMC Level 2 or FedRAMP-style POAM before your assessment.
- Everything in Audit Readiness
- CMMC Level 2 self-assessment workflow and SPRS estimate
- FedRAMP-style POAM generation
- CMMC AT.L2 training evidence (3.2.1–3.2.3) via the awareness path
- Case approval workflow for risk decisions
- SSO, set up with our team
- Built by a 100% Veteran Owned company
Starter
Individual practitioners evaluating on real data
See which controls your scan findings threaten, and what your team should learn next.
- 50 AI triage calls / month
- 3 scan uploads / month
- Unlimited local CLI scans
- POAM export (CSV, JSON, XLSX)
- Training recommendations from your findings
- Community support
All packages include unlimited local CLI scans. Run without an API key, the CLI reports the core 6 frameworks; add an API key from any package to see all 13.
Back the score you affirm with evidence. Start now.
Phase 2 is suspended, but Level 2 self-assessments, SPRS affirmations and DFARS 252.204-7012 still apply, and DoW continues select government-led assessments. Run the scanner, estimate your SPRS score, and build the evidence behind it today.
100% Veteran Owned · FedRAMP POAM ready