If you're a small manufacturer or machine shop in the defense supply chain, 2026 has been a confusing year for CMMC. The rollout timeline changed, third-party certification was paused, and the news cycle moved quickly. Through all of it, one thing hasn't changed: defense customers still expect suppliers to protect controlled unclassified information.
That's why many small suppliers are looking for a CMMC readiness partner. This guide explains where things stand and which questions to ask before choosing help.
Where CMMC Stands Today
The CMMC program rule took effect in December 2024, and the DFARS acquisition rule followed on November 10, 2025. That date started Phase 1, in which contracts could require CMMC Level 1 or Level 2 self-assessments.
Phase 2, which would have made third-party Level 2 certification standard for many contracts beginning November 10, 2026, was suspended by the Department on July 13, 2026, pending a program review. On September 3, 2026, a revised DFARS class deviation made that suspension binding on contracting officers. As of this writing, the results of the review have not been made public.
What still applies:
- DFARS 252.204-7012, which requires contractors handling CUI to implement the security requirements in NIST SP 800-171.
- Self-assessment scores submitted to the Supplier Performance Risk System (SPRS).
- CMMC Level 1 and Level 2 self-assessment requirements where contracts include them.
- Your prime contractors' own flow-down expectations.
Because policy is still evolving, confirm current requirements with your contracting officer, your prime customers, and qualified advisors. The safest assumption is that the underlying security work still matters, regardless of when third-party assessments return.
What a Readiness Partner Does
A CMMC readiness partner helps you prepare. That usually includes:
- Identifying where CUI lives in your business and defining your assessment scope.
- Comparing your current practices against NIST SP 800-171.
- Building a prioritized plan to close gaps.
- Helping implement technical controls.
- Writing your System Security Plan (SSP) and Plan of Action and Milestones (POA&M).
- Preparing for self-assessments and, eventually, third-party assessments.
A readiness partner is different from a C3PAO, the authorized third-party organization that performs certification assessments. Organizations generally shouldn't rely on the same firm to both prepare them and certify them.
Questions to Ask a Potential Partner
"How will you help us limit our scope?"
Scope drives cost. A good partner looks for ways to isolate CUI to a smaller part of your environment, such as specific systems, users, or an enclave, rather than treating your entire company as in scope.
"How do you stay current on CMMC policy changes?"
Given how much changed in 2026, your partner should be able to explain the current status clearly and tell you how they track updates.
"Will you help implement, or only advise?"
Some firms only produce assessments and documents. Others also configure systems, deploy tools, and manage ongoing security. Know which you're getting.
"What do your SSP and POA&M deliverables look like?"
Ask to see redacted examples. Documentation should describe your actual environment, not a generic template.
"How do you handle our shop floor?"
Manufacturers have CNC machines, CAD/CAM workstations, and engineering files that may contain CUI. Your partner should understand production environments, not just offices.
"What's your experience with Microsoft 365 GCC or GCC High?"
Many defense suppliers need cloud environments suited to CUI. Your partner should be able to explain when these are needed and what migration involves.
"What will this cost, and what drives the cost?"
Expect an honest explanation based on your size, scope, current maturity, and whether you need implementation help. Be cautious of anyone guaranteeing certification.
Red Flags
- Guaranteeing you will pass an assessment.
- Offering to both prepare and certify you.
- Selling a single product as "CMMC compliance in a box."
- Using fear about deadlines that may no longer apply.
- Producing documentation that doesn't match how you actually work.
Use the Pause Wisely
The suspension of Phase 2 gives many small suppliers more time. The suppliers in the strongest position will be the ones who use that time to improve their actual security, keep their SPRS scores accurate, and build documentation that reflects reality. If third-party assessments return, they'll be ready. If requirements change, the security improvements still protect the business. We discuss similar hidden risks in the compliance blind spot.
A Local Readiness Partner
Maise Technology provides CMMC readiness support for small manufacturers and defense suppliers through our compliance services, backed by hands-on IT and security implementation. Learn more about our manufacturing work on our IT services for manufacturing companies page.
Want an honest look at your CMMC readiness? Schedule A 15 Minute Discovery Call.
This article reflects publicly reported information as of its date and is not legal or contracting advice. CMMC requirements are subject to change.
