Blog
CMMC and federal
CMMC, SPRS, CUI scoping, and defense-industrial readiness: what the rule requires, what a pause does not waive, and how to keep evidence defensible.
CMMC Phase II Timeline: What Changed in July 2026
The government suspended Phase II on July 13 and began a 60-day review. Here is what changed, what Phase I still requires, and what to watch next.
CMMC Phase II Is Suspended: Why Contractors Should Not Wait
The government paused Phase II for a 60-day review. Phase I and the underlying security duties remain, so contractors should use the pause to build evidence.
How Much Does CMMC Level 2 Certification Cost?
CMMC Level 2 has no single sticker price. Scope, remediation, assessment, and sustainment determine the budget; this guide shows what moves each one.
CUI Scoping: Drawing the Boundary That Shrinks Your CMMC Assessment
The single biggest lever on the cost and difficulty of a CMMC Level 2 assessment is not a control — it is where you draw the CUI boundary. Here are the five asset categories, the enclave strategy, and the discipline that keeps a tight scope honest.
C3PAO Assessment: What Your Evidence Package Needs
A Level 2 assessment tests 320 objectives against real artifacts. Learn what a C3PAO examines and how to build a defensible evidence package.
POA&M Under CMMC: What's Allowed and the 180-Day Clock
CMMC POA&Ms are narrow: an 88-point floor, limited eligible requirements, and a 180-day closeout clock. Here is what 32 CFR 170.21 allows.
How to Calculate and Improve Your SPRS Score
The DoD Assessment Methodology turns 110 security requirements into a single number between −203 and 110. Here is exactly how the arithmetic works, what the score does and does not prove, and the highest-leverage way to raise it without gaming it.