POLICY UPDATE // JUL 13, 2026

CMMC Phase II is suspended. The security baseline is not.

The Department of War paused the November Phase II transition while it runs a 60-day reform review. Phase I self-assessments remain in force, and contractors handling covered defense information still have to meet their DFARS safeguarding obligations.

What changed and what to do Official release
PHASE II
SUSPENDED
Transition and future milestones paused
PHASE I
ACTIVE
Self-assessment requirements remain
CONTRACT DUTY
DFARS 7012
Covered defense information still protected
INTERIM BASELINE
NIST REV. 2
110 requirements · government checks continue
PROCUREMENT // 30-DAY SPRS ASSURANCE PILOT

30 days to a defensible SPRS baseline. $15,000 flat.

Phase II may be paused. Phase I self-assessments and the DFARS duty to protect covered defense information are not. This fixed-scope engagement validates your NIST SP 800-171 Rev. 2 baseline against live cloud state, closes technical gaps, and packages the evidence behind your SPRS score.

Book 30-min demo Free assessment first
Current PolicyCortex compliance workspace showing framework posture and prioritized policy findings in the production demo tenant
Current product · /governance/compliance · demo tenant
MISSION READINESS
DURATION
30 DAYS
● FIXED
PRICE
$15,000
● FLAT
OUTPUT
SPRS + EVIDENCE
● DELIVERED
OPERATOR
CLEARED FOUNDER
● ON-SITE
CMMC PHASE II // SUSPENDEDAnnounced 2026-07-13Scope: Phase I self-assessments + DFARS safeguards remain active
LIVE OPS // SAMPLE TENANT
STREAM
WEEK 1infokickoff target=cloud-account scope=CMMC-L2 boundary=cui
WEEK 1okdiscovery.complete resources=147 controls.mapped=110
WEEK 2infobaseline.run findings=23 confidence=avg-94%
WEEK 2okremediation.applied count=18 gates=3/3 mode=gated
WEEK 3infossp.generated family=AC controls=22 format=oscal-1.1.2
WEEK 4okpackage.delivered format=zip+oscal hash=4b3a…ce19
CAPABILITIES
  1. CAP-01
    Full Rev. 2 baselineAll 110 NIST SP 800-171 Rev. 2 requirements validated against your environment.
  2. CAP-02
    Automated gap closureMisconfigurations remediated with rollback contract.
  3. CAP-03
    SSP + POA&M + OSCALAuto-generated · content-hashed · 7-year retention.
  4. CAP-04
    CUI boundary analysisScope explicitly defined; defensible to assessor.
  5. CAP-05
    Cleared engineeringFounder runs personally · DoD Secret + DoE Q · active federal consultant.
  6. CAP-06
    No hourly, no overagesFlat $15K — what you sign is what you pay.
OPERATIONS · 30-DAY PILOT
  1. 01
    ConnectWeek 1: cloud account onboarded, scope mapped, controls baselined.
  2. 02
    RemediateWeeks 2–3: gated auto-remediation closes findings; SSP narratives generated.
  3. 03
    Hand offWeek 4: C3PAO-ready evidence package delivered as OSCAL + ZIP.
FIELD-TESTED · FOUNDER OPERATED AT
  1. DOE National LabActive consultant
  2. MITRECybersecurity engineering
  3. USAAFinancial-grade ops
  4. FrontierProduction cloud architecture
CLEARANCES · PATENTS
DoD SECRETDoE Q

Founder runs every engagement personally. 4 U.S. patent applications filed.

FAQ

Why run the pilot while Phase II is suspended?

Because Phase I self-assessments, selected government assessments, and DFARS 252.204-7012 obligations remain. The pilot validates the system state and evidence behind the score you represent today, while keeping the same package useful for a future CMMC model.

What's NOT included for $15K?

Custom development beyond the standard CMMC scope. Multi-cloud or multi-tenant scope beyond a single primary account (additional accounts price separately). FedRAMP work (separate engagement). On-going post-pilot operations — the platform license continues after, see pricing.

What if we fail the C3PAO assessment?

The evidence package contains live-state evidence and continuous attestation. C3PAO failures are exceptionally rare when the pilot output is presented. If a C3PAO raises a concern not covered by the pilot output, we extend at no additional charge until resolved.

Can we choose our C3PAO?

Yes. The OSCAL package is C3PAO-agnostic. We don't lock you to an assessor.

Does pricing change for larger environments?

Single primary cloud account is $15K. Multi-cloud (AWS + Azure) or multi-tenant scope adds engagement fees scoped to your environment. Most defense contractors start with one cloud account and add scope post-pilot.

PROCUREMENT · 30-DAY PILOT

Schedule the pilot. 30 days from kickoff to package.

$15,000 flat. Cleared founder runs the engagement personally. Defensible SPRS baseline and assessment-ready output on day 30.

Book 30-min demo Full pricing