CMMC Phase 2 Is Seven Months Out: Why CMMC Readiness Starts With Infrastructure

CMMC readiness means you can prove, with evidence, that the systems handling your Controlled Unclassified Information meet NIST SP 800-171 every day, not only during audit week. In April 2026 most small defense suppliers were not there, and seven months was too short to get there by retrofitting. The firms that start from infrastructure built to produce that evidence get certified faster and stay certified with less work.

Update, November 2026: the date this note was written against has moved. A Defense Department CIO memorandum dated July 13, 2026 suspended the November 2026 move to CMMC Phase 2, and a class deviation signed September 3, 2026 wrote the pause into the acquisition rules: contracts may call only for CMMC Level 1 or Level 2 self-assessments, and contracting officers must take the suspended requirements out of existing contracts at the next option period or administrative modification. Breaking Defense reported the announcement the day it was made. Phase 1 self-assessments stay in place. On October 27 Federal News Network reported that a narrower restart of Phase 2 within 90 days is one of the options a reform task force put forward. As of November 4, 2026, that September deviation was still the version in force on the acquisition policy office's deviation list. The case for CMMC readiness below still holds; only the deadline pressure changed.

What CMMC readiness actually requires

The rule is plain about the standard. Under 32 CFR 170.14, the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 Revision 2. That standard covers access control, audit logging, configuration management, incident response, media protection and system integrity, among others.

Those requirements are not just settings. They call for written policies, monitoring that runs all the time, incident procedures that people have practiced, and proof that all of it works. CMMC readiness is the gap between "we think we comply" and "we can show an assessor."

Why the documentation is where CMMC readiness breaks

You can configure a firewall correctly in an afternoon. Proving to an assessor that it stayed correctly configured, watched and maintained for the past year is a different job. Most small contractors keep that proof by hand: screenshots, spreadsheets, a shared folder someone updates before the audit. That approach works until the person who maintains it leaves, or until the systems drift between audits and nobody notices.

CMMC readiness by level

Which level you need depends on the information you hold, and that decides how much evidence CMMC readiness takes. The three levels side by side, from the rule itself:

Retrofit to pass, or built to comply

There are two ways to approach CMMC readiness, and they cost very different amounts over time.

For CMMC readiness, the second approach is more work up front and much less work after. It also holds up better under scrutiny, because the evidence is generated by the systems themselves rather than assembled for the occasion.

Scope is the cheapest control

The smallest system to prove compliant is the one that holds only CUI. Moving CUI into a separate, dedicated environment shrinks what an assessor has to look at, and it shrinks what you have to maintain. Everything outside that boundary still needs basic hygiene, but it stops being part of the audit.

Certification is a status you keep

CMMC readiness is not a one-time event. The rule allows a conditional status when an assessment ends with a plan of action for open items, but under 32 CFR 170.21 the open items have to be fixed and closed out within 180 days of the status date, or the conditional status expires. After that, the systems have to stay compliant between assessments, and the yearly affirmation is a senior official putting their name to that. Infrastructure that produces evidence continuously keeps you ready without a scramble each cycle.

The self-assessment side carries its own risk. A score posted to the government is a claim, and the September 2026 class deviation still requires baseline compliance with NIST SP 800-171 Revision 2 under DFARS 252.204-7012 while the third-party assessments are paused. A strong score you cannot back up with evidence is worse than an honest middling one with a plan.

Primes are not waiting

Large defense primes build their supplier teams long before contract awards. The rule puts that pressure in writing: under 32 CFR 170.23, primes must flow CMMC requirements down to subcontractors at every tier that will handle FCI or CUI. If you are a subcontractor, the question of your CMMC readiness can come up during proposal work, well before any formal deadline. The pause on third-party assessments does not change what primes can ask of their suppliers, and it does not change the NIST SP 800-171 obligation already in your contracts.

A practical order of work for CMMC readiness

1. Find every place CUI lives and moves today, including email and file shares.
2. Decide the boundary: which systems will handle CUI, and which will be kept out of scope.
3. Build or move that environment so its settings are defined in code and its logs are kept automatically.
4. Write the policies and the System Security Plan to match how the systems actually run, not the other way around.
5. Run your self-assessment against that environment and keep the evidence current every month.

Our note on scoping a CUI enclave walks through the boundary step with an example, and what an assessor asks for covers the evidence side.

Where LTFI fits

Kief Studio runs LTFI on a dedicated server for each company, patched and watched by us, with every action recorded in an activity log. That is the kind of operating model CMMC readiness depends on: one owner for the systems, settings that do not drift, and a record of who did what. See what LTFI does, read our note on the NIST enhanced requirements for CUI, or book a walkthrough to talk through your environment.

Frequently asked questions