CMMC PHASE 2 GOES LIVE NOVEMBER 10, 2026
CMMC Compliance: Pass Phase 2 Before November 10.
CMMC Phase 2 takes effect November 10, 2026 — every DoD prime will require Level 2 certification on the contracts they award. We get your Level 2 evidence packet ready in a 30-minute call. If your current IT can already produce SPRS scoring, you don’t need us.
Updated May 3, 2026
What changed in CMMC 2.0 that affects small DoD subcontractors?
CMMC 2.0 collapsed the original five-level scheme to three (Foundational, Advanced, Expert), mandated third-party C3PAO assessment for Level 2, and tied certification to contract eligibility — not just contract performance. As of the 32 CFR final rule, every DoD prime now flows the Level 2 requirement down to subcontractors handling Controlled Unclassified Information.
Phase 2 is the consequential threshold. Starting November 10, 2026, the DoD will include Level 2 certification as a mandatory contract clause on new awards involving CUI. Bid without it, no award. Lose the certification mid-contract, the prime can terminate. The period of “self-attestation is fine for now” closed.
The technical scope is NIST SP 800-171 — 110 controls across 14 families covering access control, awareness training, audit logging, configuration management, incident response, and supply-chain risk. The Supplier Performance Risk System (SPRS) score that primes pull before subcontracting is your visible signal: a sub-100 score on the date of award is a disqualification flag.
The hidden scope is the System Security Plan and Plan of Action & Milestones — the documents the C3PAO assessor reads before they ever touch a workstation. A Level 2 assessment without those documents on file is not survivable. The work is the writing, not just the technical deployment.
What does the C3PAO actually inspect during a Level 2 assessment?
The C3PAO assessor inspects three artifacts before any technical evidence: your written System Security Plan (SSP) covering all 110 controls in scope, your Plan of Action & Milestones (POA&M) for any controls not yet at full implementation, and your CUI inventory documenting where Controlled Unclassified Information actually lives in your environment. Without those three, the assessment ends before it starts.
The technical evidence comes second — endpoint configuration baseline, multi-factor authentication enforcement scope, audit log retention with documented review cadence, incident response plan with named escalation contacts, and continuous monitoring evidence. Each control in 800-171 maps to a specific artifact. The assessor checks for the artifact, not the verbal explanation.
CUI scope is where most subcontractors fail. Tier-2 and tier-3 DIB suppliers commonly underestimate where CUI flows: drawings shared by email, specifications attached to project chat, finished-goods test data exported to spreadsheets. Every flow path must be in the SSP. The assessor will trace one path to verify the scope is honest.
Compliance is a snapshot, not a destination. A Level 2 certification is a three-year credential that requires continuous evidence collection — not a one-time assessment that you survive once. The firms that maintain certification are the ones whose IT operations produce the artifacts continuously, not the ones who assemble a binder every three years.
What happens if you miss the November 10 deadline?
New DoD contracts involving CUI will not award to subcontractors without a Level 2 certification on file as of the November 10 effective date. Existing contracts roll forward, but renewal cycles and option-year exercises increasingly include the clause. For Eastern CT submarine-corridor tier-2/3 suppliers serving Electric Boat — and Worcester DIB suppliers serving aerospace primes — losing certification eligibility means losing pipeline.
The path is mechanical. The prime’s contracting officer pulls SPRS scores during subcontract eligibility review. A sub-100 score with no certification flags the file. The prime either substitutes a Level 2-certified competitor or delays the award. By the second or third missed bid, the prime’s vendor list updates without you on it.
The C3PAO assessor backlog is the second-order risk. As of mid-2026, the assessment queue in the Northeast runs six to nine months from contract signing to certification issuance. A subcontractor who decides in September to “be ready by November 10” is not. The lead time on the assessor is longer than the lead time on the technical work.
The hardest reality is that losing pipeline for a quarter or two is recoverable. Losing the prime’s vendor-list slot is not. Every quarter you spend re-qualifying with displaced primes is a quarter your competitor banks against you. The sub who certified in Q1 holds a structural advantage that compounds.
How does Triton get your firm CMMC Level 2 ready before November 10?
We deploy Sophos Endpoint XDR, Microsoft Defender for Endpoint with GCC High where CUI requires it, AWS GovCloud or AWS commercial with appropriate boundary controls, and documented audit-log retention — then we author the SSP, POA&M, and CUI inventory the C3PAO needs to see before any technical inspection.
The stack matters because each component produces evidence that maps to specific 800-171 controls. Sophos XDR generates the endpoint coverage report mapping to controls 3.1.x (access control) and 3.6.x (incident response). Microsoft Defender produces the MFA enforcement attestation mapping to 3.5.x. AWS-backed immutable backup produces the restoration-test evidence for 3.8.x (media protection). The technical work and the documentation work are not separate — the stack writes most of the evidence file.
We deploy on AWS because downtime is not an option. When a critical system goes down, AWS support responds with enterprise urgency — not a ticket queue. For a manufacturer running shop-floor MES or contract-quality inspection workflows, every dollar of downtime is a dollar your IT provider owes you an answer for.
Our typical Level 2 readiness engagement delivers the SSP + POA&M + CUI inventory + SPRS scoring inside 60 days, scheduled around the C3PAO assessor lead time so your pre-assessment package is ready when the slot opens. We do not displace your existing CMMC-RP if you have one — we provide the technical evidence and documentation file the RP needs to walk into the assessment.
What artifacts does the C3PAO assessor actually want on file?
Six artifacts, in the format the assessor expects to see during the in-scope evidence review. Every one maps to specific 800-171 controls. The assessor walks the file before they walk your environment.
Why start now? Because the C3PAO backlog is longer than the runway.
C3PAO assessor lead times in the Northeast run six to nine months from contract signing to certification issuance. SSP and POA&M authoring takes another four to six weeks. Technical readiness deployment takes 60 to 90 days. Subcontractors who target a November 10, 2026 certification window need to be in the assessor queue by Q2 2026.
Eastern CT submarine-corridor suppliers and Worcester aerospace tier-2/3 firms that we have helped through prior cycles started SSP work 12 months before primes’ clause effective dates. The firms that started in February 2026 are in the C3PAO queue. The firms that wait until summer 2026 will not certify before November 10.
Frequently Asked Questions
Does CMMC Level 2 apply to my firm if we are a small subcontractor?
If you handle Controlled Unclassified Information on a DoD contract — drawings, specifications, test data, supplier-quality records — Level 2 applies. The threshold is the data, not the firm size. Tier-2 and tier-3 suppliers handling CUI are in scope identically to tier-1 primes for the controls. The path to award narrows for small subs without certification.
What is the difference between CMMC Level 1, Level 2, and Level 3?
Level 1 covers Federal Contract Information (FCI) only — 17 basic safeguarding requirements, self-attested. Level 2 covers CUI — 110 NIST 800-171 controls, third-party C3PAO assessed, three-year cycle. Level 3 covers CUI under heightened threat — additional NIST 800-172 controls, government-led assessment. Most DoD subcontractors handling drawings, specs, or supplier data need Level 2. Level 3 is rare and prime-driven.
How much does CMMC Level 2 cost for a small manufacturer?
Total readiness investment for a 25-100 employee manufacturer typically runs $35,000 to $95,000 over the first year. The split: technical readiness deployment ($15-40K depending on starting state), SSP and POA&M authoring ($8-20K), C3PAO assessment fee ($10-30K), and the first year of continuous evidence collection. PreVeil or GCC High licensing for CUI handling adds $40-180/user/month depending on scope.
PreVeil vs Microsoft GCC High — which one do I need for CMMC Level 2?
Both satisfy the CUI handling requirement; the choice is operational. GCC High integrates with the standard Microsoft 365 stack but costs more per user (~$45-65/mo) and requires a license migration. PreVeil overlays on existing Microsoft 365 at lower cost (~$30-40/mo for the CUI-handling user subset only). Manufacturers with under 25 CUI-handling users typically save with PreVeil; firms standardized on GCC High Defender benefit from the integrated stack.
How long does CMMC Level 2 readiness take?
Sixty to ninety days for technical deployment plus four to six weeks for SSP and POA&M authoring puts a typical small manufacturer at 90-120 days from engagement start to assessor-ready. The C3PAO queue adds another six to nine months. The end-to-end window from “decided to certify” to “certificate in hand” is ten to fourteen months in 2026.
What if my DoD prime has already required Level 2 in a contract clause?
You are on a clock. Most prime clauses require certification by a specific date or contract milestone. Missing the date typically triggers cure-period notice followed by termination for default. The prime’s contracting officer is not the negotiating party — DoD has set the date. Engage Triton or an equivalent CMMC-RP immediately to compress the readiness timeline; we have run 90-day pre-assessment packages for primes’ deadline-pressured tier-2 subs.
Does Triton have a CMMC-RP on staff?
We work with named CMMC-RPs through partnership rather than maintaining one in-house. The technical readiness, evidence collection, SSP authoring, and POA&M maintenance are our scope. The pre-assessment readiness review and the C3PAO interaction are the RP’s scope. The split is intentional — our engineers are full-time on the stack, your RP is full-time on the assessment.
Do we need dark web monitoring as part of CMMC compliance?
No. Dark web monitoring is a notification service, not a CMMC control or a Level 2 requirement. The 110 NIST 800-171 controls do not reference it. The correct investment is the proactive hardening 800-171 actually requires — endpoint XDR, MFA enforcement, audit logging, segmentation, and incident response — not a monthly alert. We do not bundle dark web monitoring and it does not appear on any CMMC assessment artifact list.
Founded in 2001
25 Years of IT Expertise
Worcester · Providence · Hartford
Regional Offices
Ranked 84th Percentile Nationally
National Benchmark
Under 10 Minute Response
Third-Party Verified
HIPAA · CMMC · SOC 2 · PCI
Multi-Framework Compliance
Let's Discuss Your IT Needs
Triton Technologies delivers managed IT services, cybersecurity, and IT support for businesses across Connecticut, Massachusetts, New York, Rhode Island, and beyond. Contact our team today to start a conversation about your technology environment.
