Krieger Security helps Defense Industrial Base (DIB) contractors meet their Cybersecurity Maturity Model Certification (CMMC) obligations under 32 CFR Part 170 and DFARS 252.204-7021. We help you protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) and keep your eligibility for DoD contracts.

CMMC Phase 1 is in effect. On July 13, 2026, the Department suspended Phase 2, which had been scheduled for November 10, 2026, while it reviews the program. During the suspension, solicitations and contracts may require only CMMC Level 1 (Self) or Level 2 (Self) assessments. Your obligations under DFARS 252.204-7012 are unchanged: you must still implement NIST SP 800-171 Rev. 2 and report cyber incidents within 72 hours. We help you meet today’s requirements and stay ready for third-party assessment if it is reinstated.

• Level 1 and Level 2 self-assessment support, including SPRS score submission and annual affirmations
• Scoping of FCI/CUI environments and asset categorization
• Gap assessments against the 110 security requirements of NIST SP 800-171 Rev. 2, the current CMMC baseline
• System Security Plan (SSP) development, and POA&M management within CMMC limits (minimum 80% score, eligible requirements only, closeout within 180 days)
• DFARS 252.204-7012 compliance, including incident response planning and 72-hour reporting
• Policy, procedure, and evidence documentation
• NIST SP 800-171 Rev. 3 gap analysis to prepare for future rule changes
• Level 2 (C3PAO) readiness for organizations that want to be prepared if Phase 2 resumes

Not sure which CMMC level applies to your contracts, or how the Phase 2 suspension affects you? Contact us at (703) 261-9122 or info@kriegersecurity.com. We are based in Arlington, Virginia.