Topic starter
11/07/2026 8:25 pm
TL;DR: CMMC enforcement now begins through defense contracts, with Level 1 or Level 2 self-assessments required at award for many suppliers and an estimated 65% of the DIB affected, according to Secureframe. The practical issue is no longer policy familiarity but contract eligibility, evidence readiness, and assessment throughput.
Editorial analysis by NHI Mgmt Group, based on content published by Secureframe: “CMMC Deadline 2025: CMMC Phase 1 Is Now Live”.
By the numbers:
- As of the October CyberAB Town Hall, only 431 organizations had achieved a final CMMC Level 2 certification.
- Only 1% of DIB organizations felt fully prepared for upcoming CMMC assessments, according to CyberSheath research cited by Secureframe.
- Fewer than 50% have completed foundational documentation like an SSP or POA&M or implemented all NIST 800-171 requirements.
Key questions
Q: What fails when CMMC readiness is not in place at award time?
A: The failure is not just a compliance gap, it is a contract eligibility gap.
Q: Why does CMMC create legal and operational risk before full rollout finishes?
A: Because the underlying security requirements already exist in contract and regulatory language, late or inaccurate readiness can create False Claims Act exposure, missed delivery timelines, and weaker supply chain resilience even before later phases arrive.
Q: How should contractors measure whether CMMC readiness is real?
A: They should measure whether they can produce current SSPs, active POA&Ms, scoped inventories, access review records, and system boundary evidence without last-minute reconstruction.
Practitioner guidance
- Map contract-triggered CMMC obligations Identify which bids, solicitations, and subcontract flows now require Level 1 or Level 2 evidence before award, then assign control owners for each requirement.
- Stabilise CUI and FCI scope boundaries Document where CUI, SPD, and FCI reside, which systems support them, and which third parties or service accounts can reach them.
- Close the SSP and POA&M gap first Create or refresh the System Security Plan and Plan of Actions and Milestones so assessment evidence exists before the next procurement cycle.
Bottom line: CMMC Phase 1 turns defence cybersecurity into an eligibility gate, so readiness now has direct commercial consequences.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:54 pm
CMMC Phase 1 is a governance test, not a documentation refresh: the decisive issue is whether a defence supplier can prove control operation at the moment eligibility is judged. That changes compliance from a back-office function into a live business dependency, especially where award timing, subcontract flow-down, and evidence ownership are distributed. Practitioners should treat readiness as a continuously maintained control state, not a project milestone.
A question worth separating out:
Q: What is the difference between CMMC Level 1 self-assessment and Level 2 assessment readiness?
A: Level 1 focuses on the basic safeguard set and a self-assessment, while Level 2 adds the much heavier burden of mapping CUI scope, implementing NIST SP 800-171 controls, maintaining richer evidence, and sometimes passing a third-party assessment.
👉 Read our full editorial: CMMC Phase 1 changes defense supply chain compliance timing