July 25, 2026
Is CMMC Going Away? What the Phase 2 Suspension Actually Changed
On July 13, 2026 the Department of War suspended CMMC Phase 2. Here’s what the memos actually say, what’s still required, and my read on where it goes.
Read it →The CMMC M365 Blog
Straight answers on CMMC, NIST 800-171, and what actually happens to defense contractors who get it wrong. Every claim sourced to .gov or .mil.
July 25, 2026
Do I Still Need CMMC? Yes. Here’s Exactly What’s Required Right Now
CMMC Phase 2 is suspended, and contractors still owe NIST 800-171, a Level 1 or Level 2 self-assessment, an SPRS score, and a signed annual affirmation. The breakdown, with sources.
Read it →July 25, 2026
The CMMC Level 2 Self-Assessment Is the Whole Ballgame Now
With Phase 2 suspended, the Level 2 self-assessment against NIST 800-171A’s 320 objectives is the requirement that remains. How to run one that holds up, step by step.
Read it →July 25, 2026
Your SPRS Score Is a Legal Statement. DOJ Keeps Proving It.
The SPRS score and signed affirmation are now the enforcement surface of defense cybersecurity: DIBCAC audits and False Claims Act settlements, with the DOJ cases to prove it.
Read it →July 25, 2026
NIST 800-171 Survived the CMMC Pause. It Was Always the Real Requirement.
CMMC was the enforcement wrapper. NIST SP 800-171’s 110 requirements are the actual obligation, they’re still in DFARS 252.204-7012 contracts today, and they’re spreading government-wide.
Read it →