Get compliant
Menu

Day: March 8, 2026

CMMC Phase 2 Is Coming: Why Third-Party Assessments Change Everything

We’re five months into the DoD’s phased CMMC implementation, and many DIB contractors are still operating like they have years to prepare. They don’t. While the first 12 months (Phase 1) focus primarily on self-assessments, Phase 2 brings mandatory third-party assessments for Level 2, and that shift fundamentally changes what “ready” means. Here’s the reality […]

CMMC Level 1 Requires 17 Safeguards 15 Controls

The official FAR clause lists 15 safeguards, but CMMC documentation often references 17 practices. Here is why: 

CMMC inherited the DoD’s earlier mapping from the DFARS 252.204-21 “Basic Safeguarding” table, where two of the FAR requirements were split into multiple CMMC practice IDs during modeling. They are not additional requirements—just a structural carryover from the original DoD-to-NIST mapping exercise.