Breaking: the Department of War has suspended CMMC Phase II requirements. NIST SP 800-171 Rev 2, DFARS 252.204-7012, and Phase 1 self-assessments still apply. Read MRI's analysis.
CMMC Registered Practitioner · RPO Pending · CAGE 10S34
CMMC Phase II is suspended. Your security obligations are not.
On July 13, 2026 the DoW suspended CMMC Phase II — but NIST SP 800-171 Rev 2, DFARS 252.204-7012, and Phase 1 self-assessments stay enforced. MRI, a Registered Practitioner, helps you turn paused-certification budget into real resilience — and get ready for the reformed model.
Book CMMC ConsultRegistered Practitioner · 32 CFR Part 170 · NIST SP 800-171
How We Get You to Assessment Day
Assessors care about evidence, not your consultant's methodology deck. This is built for that reality.
Gap Analysis
We evaluate your environment against all 110 NIST 800-171 controls before an assessor sets foot in your building. The gaps we find now are the ones that won't surprise you later. See our full capability statement for how gap analysis fits into our broader security practice.
Remediation Planning
Every finding gets an owner, a deadline, and a definition of done. POA&Ms that hold up under assessor scrutiny — not a 200-page PDF that collects dust on a shelf.
Implementation
SSP authoring, policy development, and technical control deployment. We do the engineering work — not just the audit paperwork.
Assessment Preparation
Mock assessments run by people who know how C3PAOs score. Evidence packages structured the way assessors expect to receive them. You walk in ready.
CMMC readiness often surfaces endpoint hardening and secure AI deployment needs. MRI handles both in the same engagement.
Readiness Assessment
Where do you stand?
Answer 4 questions and we'll recommend the right starting point for your program.
Step 1 of 4
What is your current SPRS score?
Check PIEE (piee.whs.mil) or your last self-assessment report.
Which CMMC level does your contract require?
Check your contract's DFARS clauses or ask your contracting officer.
When does your contract require CMMC compliance?
CMMC Phase II certification is suspended (Jul 2026), but NIST 800-171 Rev 2 and DFARS 7012 obligations still apply to your contracts.
How many systems or enclaves need to be in scope?
An enclave is a group of assets sharing the same security boundary.
Your assessment is ready
What Does CMMC Level 2 Readiness Actually Cost?
Costs depend on company size, CUI scope, and current security maturity. These ranges reflect 2026 market data across RPOs, technology providers, and C3PAO assessors.
| Cost Component | Micro <20 employees | Small 21–100 | Medium 101–500 | Large 500+ |
|---|---|---|---|---|
| Gap Analysis | $3,500–$15,000 | $5,000–$25,000 | $15,000–$40,000 | $25,000–$50,000 |
| Readiness SSP + POA&M + Remediation | $25,000–$100,000 | $60,000–$200,000 | $150,000–$400,000 | $250,000–$700,000 |
| C3PAO Assessment | $30,000–$70,000 | $35,000–$100,000 | $70,000–$150,000 | $120,000–$200,000 |
| Technology Year 1 | $10,000–$50,000 | $20,000–$100,000 | $50,000–$150,000 | $80,000–$250,000 |
| Typical First Year | $75,000–$200,000 | $120,000–$400,000 | $275,000–$700,000 | $465,000–$1.2M |
| Ongoing Annual | $18,000–$36,000 | $30,000–$60,000 | $60,000–$120,000 | $96,000–$240,000 |
Ranges reflect 2026 market data from 48+ sources including DoD regulatory impact analysis, C3PAO fee schedules, and RPO engagement reports. Accelerated timelines command 30–60% premiums. Costs exclude existing IT infrastructure that may already satisfy controls.
Common CMMC Questions
Is CMMC Phase 2 still happening?
No — not on the original timeline. On July 13, 2026 the Department of War suspended CMMC Phase II, including the November 10, 2026 milestone, and launched a 60-day reform review. Critically, this does not lift your security obligations: NIST SP 800-171 Rev 2 remains enforced through self-assessments and select government-led assessments, DFARS 252.204-7012 still requires you to safeguard covered defense information, and Phase 1 self-assessments remain in place. See our briefing "DoW Suspends CMMC Phase II: What It Actually Means for the DIB" for the full breakdown.
What CMMC level does my company need?
Level 1 applies to contractors handling Federal Contract Information (FCI) only — 17 practices, self-assessment. Level 2 applies to contractors handling CUI — requirements mapped to NIST SP 800-171 Rev 2; the contract will specify whether Level 2 (Self) or Level 2 (C3PAO) status is required. Level 3 applies to the most sensitive programs and requires a DIBCAC assessment.
How long does CMMC certification take?
Preparation timelines vary widely (often months, sometimes longer) depending on current security posture, environment scope, evidence readiness, and subcontractor flow-down complexity. The safest plan is to start early and work backward from your contract timeline and required CMMC status.
How much does CMMC Level 2 certification cost?
Costs vary significantly by scope (systems and enclaves in-scope), existing control maturity, remediation effort, and required third-party involvement. DoD publishes cost assumptions and scenarios in the CMMC final rule and associated analyses; treat any universal “price range” with skepticism.
Do subcontractors need CMMC certification?
Yes. DFARS 252.204-7021 requires prime contractors to flow CMMC requirements down to subcontractors at every tier. Subcontractors handling FCI or CUI must meet the appropriate CMMC level before performing on a subcontract.
Phase II is paused. The security bar isn't. Get grounded.
The certification clock stopped — but 800-171 Rev 2, DFARS 7012, and Phase 1 self-assessment are still enforced, now via self- and government-led assessments. Redirect audit-prep budget into controls that actually reduce risk. Read our analysis of the Phase II suspension for what changed and what didn't.