Phase 1 in force

The blog for contractors, not lawyers.

CMMC, translated out of federalese. New posts weekly.

CMMC Level 1 vs Level 2: Which Does Your Company Actually Need?

A practical guide to choosing between CMMC Level 1 (15 requirements, FCI) and Level 2 (110 requirements, CUI) — with the decision test, effort comparison, and common traps.

CMMC Phase 2 Is Suspended — What Defense Contractors Should Actually Do Now

DoD suspended CMMC Phase 2 on July 13, 2026. Here's what's still required for defense contractors — self-assessments, SPRS, NIST 800-171 — and why pausing now is the worst move.

FCI vs CUI: Which Is Your Data?

The FCI vs CUI determination decides whether you need CMMC Level 1 or Level 2. A plain-English guide to classifying purchase orders, drawings, and tech data.