cmmc for defense contractors
Get to an affirmation you can sign with confidence.
CMMC Level 1 and Level 2 readiness led by a CMMC Certified Assessor. We scope your environment tightly, close the gaps in priority order, and build evidence that holds up, so your Affirming Official knows exactly what they're signing.
where cmmc stands today
The pause changed who checks your work, but what your Affirming Official signs hasn't changed.
PAUSED
On July 13, 2026, the Department of War suspended Phase 2 of CMMC, which would have required third-party (C3PAO) certification assessments for Level 2 starting November 10, 2026. No new date has been announced.
Status as of October 2026. We will update this section as the Department publishes changes. Check your solicitation and contracting officer for requirements on a specific contract.
STILL REQUIRED
Level 1 and Level 2 self-assessments, SPRS reporting, and annual affirmations by your Affirming Official, along with FAR 52.204-21, DFARS 252.204-7012, and NIST SP 800-171 Rev 2.
WHAT IT MEANS FOR YOU
Your self-assessment is now the main way your compliance gets evaluated. An affirmation that your implementation doesn't actually support can create False Claims Act exposure for the business.
services
CMMC services
Level 1 readiness
For contractors handling Federal Contract Information (FCI). We take you through all 15 requirements in FAR 52.204-21. Level 1 doesn't allow a plan of action and milestones (POA&M), so every requirement has to be met before your Affirming Official affirms, and we make sure it is.
Level 2 readiness
For contractors handling Controlled Unclassified Information (CUI). We scope first, often to a dedicated enclave, then work through the 110 requirements of NIST SP 800-171 Rev 2 in priority order and build an evidence package that reflects how your systems actually run.
Mock assessment
An independent review, led by a CMMC Certified Assessor, of whether your implementation and evidence actually support the affirmation you're about to make. It's the outside view an internal review can't give you.
Continuous compliance
A certificate or affirmation shows your posture at one point in time, and it starts to drift the day after. We keep your controls, evidence, and annual affirmation current as part of the Fractional CISO + Compliance plan.
our approach
/
Scope first, then fix what matters most.
1
2
3
Discovery and scoping
Gap assessment
Remediation and verification
We define the systems, people, and data flows that are actually in scope before reviewing a single control. Scope is the biggest cost lever in CMMC, and a tight boundary is cheaper to build and easier to keep compliant.
A control-by-control view of where you stand, with a prioritized plan so you know what to fix first and why.
We close gaps in priority order and verify each one rather than take it as read, so the evidence behind your affirmation is current when you sign.
why summit cyber
Prepared by certified professionals who knows what an assessor looks for.
Our CMMC work is led by CMMC Certified Assessors, so we prepare you against the same assessment methodology a C3PAO assessor uses. We help you get ready; certification assessments themselves are performed by authorized C3PAOs.
.png)
.png)
common questions
CMMC questions we hear most
Does the Phase 2 pause mean we can wait?
No. The pause applies to third-party certification assessments. Self-assessments, SPRS reporting, and annual affirmations still apply to contracts that require them.
Do we need Level 1 or Level 2?
It depends on the information your contracts involve. Level 1 covers Federal Contract Information (FCI), and Level 2 covers Controlled Unclassified Information (CUI). We'll confirm which applies on a scoping call.
Can we use a POA&M at Level 1?
No. At Level 1, every requirement has to be met before your Affirming Official affirms. A POA&M isn't an option.
How is CMMC work priced?
Readiness and mock assessments are fixed-fee, quoted after a scoping call. Ongoing CMMC support is included in the Fractional CISO + Compliance plan at $7,500 a month.