On July 13, 2026 the Department of War suspended Phase 2 and opened a 60-day review, so the November 10 third-party assessment mandate is on hold. What did not pause: DFARS 252.204-7012, all 110 controls of NIST SP 800-171, and the SPRS score your senior executive signs each year. Without a C3PAO standing behind that number, the False Claims Act exposure sits entirely with the signer. Atom8 gets small defense subcontractors ready on a fixed price — and remediating now means you can book an assessment the week the freeze lifts, instead of queuing behind everyone who waited.
Every requirement you miss subtracts weighted points from a maximum of 110. In our assessments, a typical small subcontractor that hasn't formally tackled 800-171 meets roughly half the requirements — and lands below zero. Certification needs 88 or better with a plan for the rest.
*A score of 88–109 with a Plan of Action & Milestones can earn Conditional Level 2 at assessment — remaining items must close within 180 days, and certain high-weight requirements can't be deferred at all. That's why sequencing matters as much as effort.
The path below reflects how we actually run it: shrink the assessment boundary first, knock out the highest-weight controls early, and get in the assessor queue before it fills.
Gap assessment across all 110 requirements. You get your real SPRS score, a prioritized roadmap, and a POA&M — not a lecture.
Scope a CUI enclave to shrink cost, migrate CUI to a FedRAMP-authorized environment, land the 5-point controls (MFA, FIPS crypto) first.
System Security Plan, policies, and an evidence register an assessor can actually follow. No SSP, no certification — full stop.
Internal mock assessment against 800-171A objectives, then we coordinate your C3PAO — whose queue you want to be in early.
Only handle FCI, not CUI? Level 1 readiness is a flat $3,500. Billed separately in every engagement: the independent C3PAO's certification fee (typically $30k–60k for small firms) and cloud licensing, passed through at partner rates.
You approve a number before work starts. No discovery retainers, no hourly meter running while you learn acronyms.
The person who assesses you is the person who remediates and preps you for the assessor. Nothing gets lost in handoffs.
SSP, scoring workbook, policies, and evidence register in the structure C3PAOs expect — see the sample below before you spend a dollar.
An enclave approach that keeps your CNC floor running and your assessment boundary — and cost — as small as defensibly possible.
Under the CMMC program, the certified assessment organization (C3PAO) that audits you is barred from consulting for you on the same scope. Anyone offering to do both is a red flag.
Atom8 sits deliberately on the preparation side: we get you ready, assemble the evidence, and coordinate with the independent assessor of your choice. The certification decision stays theirs — which is exactly what makes it credible to your primes.
We built a full engagement for a fictitious 42-person machining subcontractor: scoping, gap assessment with a real SPRS calculation, remediation deliverables, readiness attestation, and ongoing reporting. It's exactly what you'd receive.
Two quick checks: does DFARS 252.204-7012 appear in your contracts or POs, and do you receive technical data with distribution statements or export-control markings? If yes to either, you almost certainly handle CUI and will need Level 2. If you only handle Federal Contract Information (FCI), Level 1 self-assessment applies instead — a much lighter lift we also cover.
No — right now is the least painful moment this work will ever have. Remediation for a typical small shop runs 8–12 weeks after a 2–3 week assessment, then you need an assessor slot. The pause removed the deadline pressure but not the workload, so you can do this properly instead of in a scramble. When the Task Force reports and the mandate returns, C3PAO capacity will be the bottleneck — firms that remediated during the freeze will be at the front of that queue with documentation already defensible to their primes.
Industry-wide, small contractors typically spend $75k–150k in the first year all-in. Our readiness work is fixed-price (assessment $4,950; remediation from $24,950). The independent assessor's fee — commonly $30k–60k for small firms — and cloud licensing are separate and paid directly. We keep both down by shrinking your assessment boundary.
No — and the pause arguably raised your risk. What was suspended on July 13, 2026 is the third-party assessment mandate that was going to phase into new CUI contracts from November 10. What was not suspended: DFARS 252.204-7012, the 110 requirements of NIST SP 800-171 Rev 2, your SPRS score, and the annual affirmation a senior executive signs. A C3PAO assessment was, in effect, protection — an accredited third party stood behind your number. Without one, an overstated score is a signed misrepresentation with your executive's name on it. Primes also set their own flowdown terms and most have not relaxed them.
You can attest — you cannot attest inaccurately. Self-assessment has been required as a condition of award in applicable contracts since November 2025, and that requirement is unaffected by the Phase 2 pause. Submitting an SPRS score your environment doesn't support is a False Claims Act exposure: DOJ has recovered tens of millions from contractors whose scores didn't match reality. Our assessment exists to give you a number you can actually defend.
No — and be wary of anyone who says they can prep you and certify you. Certification comes only from an independent C3PAO, which is prohibited from consulting on what it assesses. We prepare you, then coordinate the assessment.
Yes — that's our core client. The workload lands on us, not your IT person: we design the enclave, implement controls, write the SSP and policies, and hand your team a defined operating rhythm. Your part is decisions and access, roughly a few hours a week during the sprint.
One call: we confirm whether Level 2 applies to you, estimate your likely score range, and map what's achievable before your next re-compete. If we're not the right fit, we'll tell you.
Book my free scoping call