Compliance Frameworks
CMMC compliance, without the panic
Updated September 2026
CMMC exists because the Department of Defense stopped trusting self-reported security. If you handle Controlled Unclassified Information - as a prime or a subcontractor - your NIST 800-171 posture is becoming a contract requirement, not a suggestion. The recent DoD pause on the CMMC program changed timelines. It did not change your obligations: DFARS 252.204-7020 and NIST 800-171 remain in force today, and the requirement is flowing down to subcontractors regardless of when final rulemaking lands. Class IV treats CMMC as an operating condition, not a certification event. Our fractional CISO runs the gap assessment against NIST 800-171, builds the remediation plan with named owners, produces the evidence your assessor will actually ask for, and manages the SPRS scoring so your posture is current - not a snapshot from last year. For defense-adjacent companies in Denver and Houston, that means when the requirement lands in your contract, you are already there.
Level 1 vs Level 2: which applies to you
Level 1 covers companies that handle Federal Contract Information but not Controlled Unclassified Information. It rests on a small set of foundational safeguards, such as access control, authentication, and basic system protection, confirmed through an annual self-assessment and an affirmation from a senior official. Level 2 applies when you handle CUI. It maps directly to the NIST 800-171 control set, and depending on the contract, it is met through a self-assessment or an assessment by an authorized third party. You do not choose your level. Your contract language does, along with the data your prime flows down to you. The first step is reading the DFARS clauses in your current and pending contracts and mapping where CUI actually lives in your environment, which is often wider than companies expect.
What the DoD pause did and did not change
The Defense Department pause slowed the timeline for CMMC requirements showing up in new solicitations. That is the only thing it paused. DFARS 252.204-7020 still requires contractors handling CUI to implement NIST 800-171 and post a current assessment score, and the controls themselves did not change. Primes are still flowing those requirements down to their subcontractors, because their own compliance depends on it. Waiting is the expensive choice. Remediation takes real time: policies have to be written, technical controls deployed, and evidence produced before an assessor will accept them. Companies that start when a contract demands CMMC end up compressing that work, paying for rush remediation, or losing the bid to a competitor that started earlier. Treat the pause as runway, not relief.
SPRS scoring, in plain terms
Your SPRS score is the result of a self-assessment against the NIST 800-171 controls, posted to the Supplier Performance Risk System that the Defense Department and primes use to evaluate suppliers. Every unimplemented control deducts from a maximum score, with heavier deductions for the controls that matter most. Primes ask for it because your posture becomes part of their risk, and a weak score can take you out of consideration before pricing is discussed. A wrong score is worse than a low one. Posting a score that overstates your implementation creates exposure under the False Claims Act and puts current contracts at risk if an assessment finds the gap. We build the score from verified controls and evidence, then keep it current as your environment changes.
From gap to evidence: how the work actually runs
The work starts with a gap assessment against every NIST 800-171 control, grounded in how your systems actually run rather than how policies describe them. Findings go into a Plan of Action and Milestones, the POA&M, with a named owner and a target for every open item. Our managed services team implements the technical controls: access management, logging, encryption, configuration baselines, and endpoint protection. Our fractional CISO owns the policies, the system security plan, and the evidence artifacts an assessor will request, from access reviews to incident response records. Then the program keeps running. Controls are monitored, evidence is collected as part of normal operations, and the SPRS score is updated when your posture changes, so readiness is a standing condition instead of a project that decays after the assessment.
Start before the contract asks
The companies that handle CMMC calmly are the ones that started before a prime or a solicitation forced the issue. The 10-day Stabilization Sprint is the entry point: it maps your IT and security posture, surfaces the CUI and control gaps, and turns them into a prioritized plan with owners. From there, your fractional CISO and our managed services team carry the remediation through to evidence.
Frequently asked questions
- Did the CMMC program get cancelled?
- No. The Defense Department paused parts of the rollout, which changed when CMMC requirements appear in new contracts. The program itself continues, and the underlying obligations never stopped. DFARS 252.204-7020 and NIST 800-171 remain in force today, and primes are still flowing requirements down to subcontractors that handle Controlled Unclassified Information.
- Do subcontractors need CMMC or just primes?
- Subcontractors need it too. CMMC requirements flow down through the supply chain to any company that handles Federal Contract Information or Controlled Unclassified Information for a defense contract. Your required level depends on the data you receive, not your position in the chain. Many primes are already asking subcontractors for their NIST 800-171 posture and SPRS score.
- What is an SPRS score and why does my prime care?
- It is the score from your self-assessment against NIST 800-171, posted to the Supplier Performance Risk System. Primes care because your security posture becomes part of their contract risk. A weak score can cost you the work, and an inflated one creates legal exposure for you and them. Accuracy matters as much as the number.
- What is the difference between NIST 800-171 and CMMC?
- NIST 800-171 is the set of security controls for protecting Controlled Unclassified Information. CMMC is the Defense Department program that verifies you actually implemented them, through self-assessment or third-party assessment depending on your level and contract. Think of NIST 800-171 as the standard and CMMC as the proof. Level 2 maps directly to NIST 800-171.
- Do you work with defense companies outside Colorado?
- Yes. Class IV serves defense-adjacent companies in Denver and Houston as primary markets, and our fractional CISO leadership and managed services are delivered remotely nationwide. Gap assessments, remediation planning, SPRS scoring, and evidence management all work across locations, with on-site support arranged when an engagement calls for it.