A defensible SPRS baseline in 30 days. $15K flat.
CMMC Phase II is suspended. The security baseline is not.
The Department of War paused the November Phase II transition while it runs a 60-day reform review. Phase I self-assessments remain in force, and contractors handling covered defense information still have to meet their DFARS safeguarding obligations.
- PHASE II
- SUSPENDED
- Transition and future milestones paused
- PHASE I
- ACTIVE
- Self-assessment requirements remain
- CONTRACT DUTY
- DFARS 7012
- Covered defense information still protected
- INTERIM BASELINE
- NIST REV. 2
- 110 requirements · government checks continue
Phase II is suspended, but Phase I self-assessments and DFARS safeguards remain. PolicyCortex validates the 110-requirement Rev. 2 baseline, fixes cloud gaps, and produces the evidence behind the SPRS score you affirm.
- CAP-01Autonomous remediationRollback contract on every action, type-checked.
- CAP-02Continuous validation110 NIST SP 800-171 Rev. 2 requirements; drift < 5s.
- CAP-03C3PAO-ready evidenceSSP · POA&M · OSCAL · auditor ZIP.
- CAP-04GovCloud + GCC HighCUI boundaries respected by default.
- CAP-05Shadow → gated → autonomousThree trust modes; most stay gated.
- CAP-06Single source of truthReplaces the 4–6 tool sprawl.
- 01Connect Azure Government · AWS GovCloud · GCC High. Discovery in minutes.
- 02Baseline Pipeline runs. Findings with AI confidence. Gated remediation.
- 03Hand off OSCAL bundle + auditor ZIP. Continuously regenerated thereafter.
- DOE National LabActive consultant
- MITRECybersecurity engineering
- USAAFinancial-grade ops
- FrontierProduction cloud architecture
Founder runs every engagement personally. 4 U.S. patent applications filed.
Did the Department of War cancel CMMC?
No. It suspended the Phase II transition and future implementation milestones on July 13, 2026, while a reform task force conducts a 60-day review. Phase I self-assessment requirements remain in place.
GovCloud required for CMMC L2?
Not strictly. We support Azure Government, AWS GovCloud, and GCC High — plus commercial cloud when CUI is out of scope.
How long until assessment-ready?
30 days from cloud connection to C3PAO-ready evidence package. $15K flat — no hourly, no overages.
What if a remediation breaks prod?
Every action ships matched captureState / restoreState pairs. Failed post-state → automatic rollback. The runtime refuses actions without a defined rollback path.
Can we stay in advisory mode?
Yes. Shadow mode is the default. Graduate to gated (human approval per action), then autonomous when confidence is high.
Connect a cloud. Walk away with the package.
$15,000 flat. Cleared founder runs the engagement. No hourly, no overages, no surprises.