What defense contractors need to know about CMMC, written by practitioners who've done the work, not advisors who've read the framework.
As of November 2025, CMMC requirements are appearing in active DoD solicitations. This isn't a drill, a pilot, or a future deadline. It's the floor contractors are being measured against right now. We break down what Phase 1 requires, what Phase 2 adds in November 2026, and what you need to do before a contract shows up with a CMMC clause attached.
Most contractors don't know what to expect. Here's exactly what we look at, how we evaluate your environment, and what you walk away with.
The DOJ is already pursuing contractors who falsely self-attested compliance. A senior official signs off annually, creating personal liability. This is not an administrative fine.
You start at 110 and lose points for every unimplemented control. Below 88 and you can't bid on CUI contracts. Here's how the scoring works and what your number actually means.
The indefinite hall pass is gone. 180-day hard deadlines, zero POA&Ms at Level 1, and pre-assessment requirements that can't be deferred. What this means for your compliance timeline.
Which DFARS clauses trigger CMMC, how to find them in your contract, what CUI means for your obligations, and what the rules say about where work can be performed.
The scoping call is free, no-commitment, and takes 30 minutes. We review every request personally and respond within one business day.