Breaking: the Department of War has suspended CMMC Phase II requirements. NIST SP 800-171 Rev 2, DFARS 252.204-7012, and Phase 1 self-assessments still apply. Read MRI's analysis.
Operational analysis
Operational intelligence for defense leaders.
Written by people who build and deploy systems under real constraints — regulated environments, restricted delivery, and mission-critical timelines. Tested in operations, not in research papers.
Book a BriefingWritten by builders
DoW Suspends CMMC Phase II: What It Actually Means for the DIB
On July 13, 2026 the Department of War immediately suspended CMMC Phase II — the certification mandate that was set to hit contracts on November 10, 2026. Read the fine print before you stand down: NIST SP 800-171 Rev 2, DFARS 252.204-7012, and Phase 1 self-assessments all remain in force. The bar didn't drop. The paperwork clock did.
Read Briefing →Latest Briefings
Analysis and advisories from real engagements across the defense industrial base. For CMMC-specific guidance, see our CMMC practice.
CMMC Phase 2 Countdown: What November 2026 Means for Your Contracts
Phase 2 begins November 10, 2026 — one calendar year after Phase 1 start on November 10, 2025. Here’s what the phased rollout changes for Level 2 contracts and how to plan without relying on unverified market stats.
CMMC Phase 1 Is Live: What Defense Contractors Need to Know Now
CMMC 2.0 Phase 1 took effect November 10, 2025. Self-assessments for Level 1 and select Level 2 contracts are now required. Here's what you need to know.
Tools & Checklists
Self-service resources to assess readiness and prepare for compliance assessments.
CMMC Level 2 Readiness Checklist
Self-assessment checklist covering all 14 NIST 800-171 control families. Use this to identify gaps before your formal assessment.
Software Hardening Checklist for Secured Environments
Pre-deployment security checklist for software destined for secured enclaves and air-gapped networks.
Need a custom briefing?
Operational analysts. Tailored to your program. CMMC readiness, cybersecurity posture, or AI delivery constraints — specific to what you're working on.
Capability Briefing