CMMC is in contracts now. The rest of the schedule is not.
The DFARS CMMC rule took effect 10 November 2025 and is contractually enforceable. On 13 July 2026 the DoD suspended the move to Phase 2. Both facts are true at once, and most contractors have only heard one of them.
Phase 1 is live. Phase 2 is paused. NIST 800-171 did not move.
Phase 1 is in effect: applicable DoD solicitations carry Level 1 and Level 2 self-assessment requirements today. In July 2026 the DoD suspended the transition to Phase 2 and future implementation milestones pending review, which halted Level 2 C3PAO assessments and Level 3 certification. No replacement dates have been published.
It is tempting to read the suspension as a reprieve. It is not. The obligation in your contract is unchanged, the self-assessment is a representation you are making to the government, and NIST SP 800-171 Rev 2 remains the baseline either way. The only thing that moved is when a third party comes to check.
What a self-assessment actually is
A self-assessment is not a lighter form of compliance. It is a statement you submit, with a score, about controls you claim to have implemented — and it carries the same exposure as any other representation made to the government. A generous score against controls you have not implemented is a much worse position than a modest score against controls you have.
No managed service provider can certify you. Certification is a C3PAO function, and right now that path is suspended anyway. What we do is the engineering underneath: implementing the 800-171 controls, building and maintaining your System Security Plan and POA&M, and keeping the evidence current so your score is defensible rather than optimistic.
The controls, the documentation, and the evidence.
NIST SP 800-171 implementation
The 110 controls, implemented in your environment — not a gap list handed back to you to solve.
System Security Plan & POA&M
Written, accurate, and maintained as the environment changes. The two documents every assessment starts from.
CUI boundary and scoping
Working out what actually holds Controlled Unclassified Information, because scope is what determines cost.
Self-assessment support
Scoring you can defend, with the evidence behind each control organised before anyone asks.
Managed security operations
EDR, 24/7 monitoring, logging and incident response — several 800-171 families are operational, not paperwork.
Readiness for when Phase 2 resumes
Built so that when third-party assessment restarts, it is a review rather than a rebuild.
Veteran-owned, and familiar with the other side of the contract.
Degarmo Technologies is veteran-owned. Our founder served, has worked in government contracting, and follows this market closely — which is why this page tells you about the Phase 2 suspension rather than selling against a deadline that is no longer scheduled.
That matters more than it sounds. A great deal of CMMC marketing is built on urgency that the DoD has since paused, and contractors who bought against those deadlines are now unsure what they actually owe. The honest answer is that the contract requirement is real and current, the assessment schedule is not, and the work in between is the same either way.
Scope before spend
Most CMMC cost is scope. Narrowing where CUI lives is the cheapest work available to you.
Evidence as you go
Controls documented when implemented, not reconstructed later from memory.
Straight answers on timing
We will tell you what is actually required today and what is speculation about a schedule nobody has published.
Find out what your score would really be.
We will assess your environment against NIST SP 800-171, tell you what your self-assessment score honestly is today, and show you the shortest path to a defensible one. If your scope is smaller than you feared, that is good news we are happy to deliver.