Topic starter
10/07/2026 9:29 pm
TL;DR: CMMC Phase 2 begins on November 10, 2026 and makes C3PAO assessment the default for most DoD contracts involving CUI, with DoD estimates showing 93% of CUI-handling organisations will need Level 2 certification and 99% of organisations still awaiting completion, according to Secureframe and the 32 CFR rule. The practical issue is no longer awareness but scheduling, evidence quality, and whether readiness work starts early enough to beat assessment bottlenecks.
Editorial analysis by NHI Mgmt Group, based on content published by Secureframe: “CMMC Phase 2: What to Expect and How to Prepare [2026]”.
By the numbers:
- Phase 2 of CMMC begins on November 10, 2026.
Key questions
Q: What fails when a contractor waits too long to start CMMC Phase 2 readiness?
A: The failure mode is not just weak controls, it is missed eligibility.
A: CMMC 2.0 increases risk when external service providers do not meet the same security expectations as the contractor.
Q: What are the signs that a CMMC programme is not assessment-ready?
A: Common signs include missing control ownership, incomplete documentation, inconsistent access records, untested evidence exports and an SSP that does not match operational reality.
Practitioner guidance
- Define the CUI boundary early Document the system boundary, data flows, and connected systems before assessment scheduling begins so the SSP and evidence set reflect the actual environment.
- Align IAM evidence with the SSP Verify that account inventories, MFA enforcement, privileged access records, and review logs match the controls described in the system security plan.
- Book a C3PAO during readiness work Engage an authorized C3PAO while remediation is still underway so assessment dates, evidence requests, and readiness milestones can be sequenced together.
Bottom line: CMMC Phase 2 shifts defence contracting from self-reporting toward independently verified evidence, which changes compliance from a documentation task into an operating control problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:51 pm
CMMC Phase 2 turns evidence quality into a security control. The article shows that third-party verification is now the gating mechanism for most CUI-bearing defence work, which means weak documentation is no longer a clerical issue. It is a control weakness because assessors must reconcile the SSP, system boundary, and live implementation. Practitioners should treat evidence consistency as part of control design, not as the final paperwork step.
A question worth separating out:
Q: Should organisations use conditional CMMC status or wait for full certification?
A: Conditional status is useful only when the remaining gaps are narrow, permitted in a POA&M, and realistic to close inside the 180-day window. If boundary definition, identity controls, or core documentation are still unstable, organisations should focus on full readiness first because conditional status will not fix structural control weakness.
👉 Read our full editorial: CMMC phase 2 shifts defence contracting to third-party verification