On July 13, 2026, the Department of War announced an immediate suspension of CMMC Phase II requirements. Phase I self-assessment requirements remain in place. Your contract, solicitation, and applicable DFARS clauses determine the requirements for your work. We help defense contractors map FCI and CUI scope, assess controls against applicable NIST SP 800-171 requirements, and prepare practical remediation priorities, documentation, and evidence.
Deliverables are yours to keep and are written so your team can maintain them after the engagement ends.
It depends on the information you handle and on the contract. Contractors that handle only Federal Contract Information need Level 1. Contractors that handle Controlled Unclassified Information generally need Level 2. Since DoD suspended CMMC Phase 2 on July 13, 2026, solicitations can require only Level 1 or Level 2 self-assessments, though contractors can still choose a C3PAO assessment voluntarily. Level 3 applies to a small set of the most sensitive programs. Your solicitation and contract clauses determine what applies to you.
It depends on your starting point and scope. Organizations with a mature NIST SP 800-171 implementation may need a few months of evidence work. Organizations starting from a template SSP or an outdated SPRS score often need six to twelve months or more. A gap assessment gives you a realistic timeline.
No. Daytol provides readiness and advisory support. CMMC Level 2 certification assessments are performed by authorized C3PAOs, and CMMC conflict-of-interest rules prevent an assessment organization from certifying a company it has advised. We prepare you for the assessment and support you through it.
A Plan of Action and Milestones documents requirements you have not fully met and how you will close them. CMMC allows limited POA&Ms for certain lower-weighted requirements, subject to a minimum score and a 180-day closeout window. Some requirements cannot be on a POA&M at all and must be fully implemented before assessment.
We discuss what is driving the need and when it is due.
You receive a scope, deliverables, timeline, and fee.
We send a document request and schedule interviews with your team.
Policies, standards, and procedures written around how your organization operates.
Response plans, scenario playbooks, and tabletop exercises with the people who make the calls.
Senior security leadership to set priorities, facilitate risk reviews, and report to executives.
Tell us what is driving the need and when it is due. We will tell you plainly what it would take.
