CMMC Level 2 compliance, assembled from source-linked evidence, scored, and packaged for your DIB contracts.
CMMC Phase II is suspended for a 60-day government review, with no replacement start date announced. Phase I self-assessments and the underlying NIST and DFARS duties remain. Valty maps all 320 NIST SP 800-171A assessment objectives, computes your SPRS score, runs the POA&M clock, and generates the OSCAL assessment package, so a defense industrial base supplier can build defensible readiness evidence without pretending the pause is a pass.
Phase II is suspended. The readiness work is not.
The government paused Phase II on July 13, 2026 and began a 60-day review. It did not announce a new start date. Phase I self-assessments and existing CUI-protection duties remain, so the useful move is to build evidence against the enduring baseline while the acquisition mechanics are reviewed.
Suspended for review
On July 13, 2026, the government suspended CMMC Phase II immediately and opened a 60-day review. The previously scheduled November start is no longer operative, and no replacement date has been announced.
July 13, 2026 · official program announcementSelf-assessments continue
During the suspension, solicitations and contracts can still designate Level 1 Self or Level 2 Self under Phase I. Contractors should read the assessment type in each acquisition rather than assume the pause removes every CMMC requirement.
Level 1 Self · Level 2 SelfStill enforceable
The suspension does not remove existing duties to protect CUI. The government said it will continue enforcing NIST SP 800-171 Revision 2 and DFARS 252.204-7012 requirements.
NIST SP 800-171 Rev. 2 · DFARS 252.204-7012A defensible readiness package, generated from evidence you already hold.
Valty maps CMMC Level 2 to all 320 assessment objectives in NIST SP 800-171A, lets you attach source-linked evidence to each one, and computes the SPRS score the way an assessor reads it. CMMC Level 2 is one of the framework catalogs Valty maps. Evidence sources are scoped with you. Valty generates the readiness evidence and the OSCAL package; it does not grant an authorization.
- 800-171A objective crosswalk, with source-linked evidence attached per objective
- SPRS score view across the 110 NIST 800-171 requirements
- POA&M with the 180-day closeout clock tracked per item
- OSCAL 1.1.2 SSP, SAP, SAR, and POA&M generation
- A factual readiness status statement, not an authorization
Valty generates readiness evidence and OSCAL packages. It does not grant a CMMC certification or an authorization to operate. Product framework coverage is a readiness aid, never a company certification.
Six capabilities behind the package, each one an assessor can trace.
These are product capabilities, evidenced to source. Nothing here asserts a certification. Every output is readiness material a supplier and a C3PAO can inspect.
All 320 objectives, evidenced individually
CMMC Level 2 maps to the 110 requirements of NIST SP 800-171 and the 320 assessment objectives of 800-171A. Valty holds every objective as its own line item, so you attach evidence and see coverage at the exact granularity an assessor works from.
NIST SP 800-171A crosswalkYour score, the way an assessor reads it
Valty computes the SPRS score across the 110 security requirements using the standard weighting, so the number you brief internally matches the one that lands in the Supplier Performance Risk System.
SPRS score computationThe 180-day clock, tracked per item
Requirements eligible for a Plan of Action & Milestones carry the 180-day closeout clock. Valty tracks each POA&M item, its owner, and its deadline, and flags items approaching the window before it closes.
180-day POA&M closeout clockSSP, SAP, SAR, and POA&M in OSCAL 1.1.2
Valty generates the System Security Plan, assessment plan, assessment results, and POA&M as OSCAL 1.1.2 packages: machine-readable artifacts an assessor or downstream tool can ingest, not just PDFs.
OSCAL 1.1.2 package generationAssembled for your C3PAO
The readiness output assembles into the package a supplier hands to a C3PAO for the Level 2 assessment: crosswalk, SPRS view, POA&M, OSCAL SSP, and a factual status statement. Valty assembles it; the C3PAO assesses it.
C3PAO assessment-package assemblyScope what is in and out
Define the CUI boundary, the systems, people, and data in scope for assessment, so evidence, scoring, and the SSP all describe the same environment the assessor will walk.
CUI boundary scopingScope in. Assessment package out.
The same evidence spine runs the whole path: define the boundary, evidence the objectives, score against SPRS, and export the OSCAL package a C3PAO can assess.
The artifact
The package you hand a C3PAO, not a certificate you print yourself.
The workflow ends in an OSCAL 1.1.2 package: SSP, SAP, SAR, and POA&M, plus the 800-171A crosswalk, the SPRS score view, and a factual readiness statement. It is machine-readable, assembled for the assessment, and honest about what is not yet closed.
Valty assembles the assessment package. A C3PAO conducts the Level 2 assessment and the DoD accepts it. The package is readiness evidence, not an authorization.
Draw the CUI boundary
Define the systems, users, and data in scope. Everything downstream, objectives, evidence, scoring, and the SSP, describes this boundary, so the package matches the environment the assessor walks.
CUI boundary definitionMap and evidence 320 objectives
Read from your connectors and attach source-linked evidence to each 800-171A objective. Coverage is measured per objective; missing or stale evidence stays visible instead of being assumed closed.
800-171A objective crosswalkCompute SPRS, open the POA&M
Valty computes the SPRS score across the 110 requirements and opens POA&M items for eligible gaps, each with the 180-day closeout clock, an owner, and a deadline.
SPRS score + 180-day POA&M clockGenerate the OSCAL package
Export the SSP, SAP, SAR, and POA&M as OSCAL 1.1.2, assembled into the package you bring to a C3PAO, with a factual readiness statement, never an authorization claim.
OSCAL 1.1.2 package for C3PAOValty is not a C3PAO.
Valty the company is not a CMMC Third-Party Assessment Organization (C3PAO), a C3PAO-accredited assessor, or a certifying body. It does not issue CMMC certifications, authorizations, or attestations of compliance.
The product produces readiness evidence and assessment artifacts: the 800-171A crosswalk, the SPRS score, the POA&M, and the OSCAL package. A C3PAO conducts the certification assessment and the DoD accepts it. Valty helps you arrive prepared.
Product CMMC coverage is never presented as a company certification. Where evidence is missing or stale, Valty flags the gap rather than closing it.
What Valty can claim for CMMC, and what it cannot.
Every CMMC output carries a source, a confidence label, and a freshness rule. The last row is the one that matters most: certification is not a Valty claim.
Estimate your SPRS score in minutes . Free, no sign-in.
Not ready for a full readiness engagement? Start with the free SPRS score estimator. Answer for the 110 requirements and get an indicative SPRS score plus the gaps that cost you the most points: no account, no evidence upload.
The estimator returns an indicative self-assessment score for planning. It is not an official SPRS submission or a CMMC certification.
Build your CMMC readiness package before a contract requires it.
Valty maps the 320 objectives, computes your SPRS score, runs the POA&M clock, and generates the OSCAL assessment package from evidence you already hold. Request a readiness package and see exactly where you stand and what is still missing.
Valty is in design-partner and early-access stage. Valty generates CMMC readiness evidence and OSCAL assessment artifacts; it does not issue CMMC certifications or authorizations, and it is not a C3PAO. Product framework coverage is decision-support for readiness, never a company certification. No customer names or logos are shown.