If you're a small manufacturer or machine shop in the defense supply chain, 2026 has been a confusing year for CMMC. The rollout timeline changed, third-party certification was paused, and the news cycle moved quickly. Through all of it, one thing hasn't changed: defense customers still expect suppliers to protect controlled unclassified information.
That's why many small suppliers are looking for a CMMC readiness partner. This guide explains where things stand and which questions to ask before choosing help.
Where CMMC Stands Today
The CMMC program rule took effect in December 2024, and the DFARS acquisition rule followed on November 10, 2025. That date started Phase 1, in which contracts could require CMMC Level 1 or Level 2 self-assessments.
Phase 2, which would have made third-party Level 2 certification standard for many contracts beginning November 10, 2026, was suspended by the Department on July 13, 2026, pending a program review. On September 3, 2026, a revised DFARS class deviation made that suspension binding on contracting officers. As of this writing, the results of the review have not been made public.
What still applies:
- DFARS 252.204-7012, which requires contractors handling CUI to implement the security requirements in NIST SP 800-171.
- Self-assessment scores submitted to the Supplier Performance Risk System (SPRS).
- CMMC Level 1 and Level 2 self-assessment requirements where contracts include them.
- Your prime contractors' own flow-down expectations.
Because policy is still evolving, confirm current requirements with your contracting officer, your prime customers, and qualified advisors. The safest assumption is that the underlying security work still matters, regardless of when third-party assessments return.
What a Readiness Partner Does
A CMMC readiness partner helps you prepare. That usually includes:
- Identifying where CUI lives in your business and defining your assessment scope.
- Comparing your current practices against NIST SP 800-171.
- Building a prioritized plan to close gaps.
- Helping implement technical controls.
- Writing your System Security Plan (SSP) and Plan of Action and Milestones (POA&M).
- Preparing for self-assessments and, eventually, third-party assessments.
A readiness partner is different from a C3PAO, the authorized third-party organization that performs certification assessments. Organizations generally shouldn't rely on the same firm to both prepare them and certify them.
Questions to Ask a Potential Partner
"How will you help us limit our scope?"
Scope drives cost. A good partner looks for ways to isolate CUI to a smaller part of your environment, such as specific systems, users, or an enclave, rather than treating your entire company as in scope.
"How do you stay current on CMMC policy changes?"
Given how much changed in 2026, your partner should be able to explain the current status clearly and tell you how they track updates.
"Will you help implement, or only advise?"
Some firms only produce assessments and documents. Others also configure systems, deploy tools, and manage ongoing security. Know which you're getting.
"What do your SSP and POA&M deliverables look like?"
Ask to see redacted examples. Documentation should describe your actual environment, not a generic template.
"How do you handle our shop floor?"
Manufacturers have CNC machines, CAD/CAM workstations, and engineering files that may contain CUI. Your partner should understand production environments, not just offices.
"What's your experience with Microsoft 365 GCC or GCC High?"
Many defense suppliers need cloud environments suited to CUI. Your partner should be able to explain when these are needed and what migration involves.
"What will this cost, and what drives the cost?"
Expect an honest explanation based on your size, scope, current maturity, and whether you need implementation help. Be cautious of anyone guaranteeing certification.
Red Flags
- Guaranteeing you will pass an assessment.
- Offering to both prepare and certify you.
- Selling a single product as "CMMC compliance in a box."
- Using fear about deadlines that may no longer apply.
- Producing documentation that doesn't match how you actually work.
Use the Pause Wisely
The suspension of Phase 2 gives many small suppliers more time. The suppliers in the strongest position will be the ones who use that time to improve their actual security, keep their SPRS scores accurate, and build documentation that reflects reality. If third-party assessments return, they'll be ready. If requirements change, the security improvements still protect the business. We discuss similar hidden risks in the compliance blind spot.
A Local Readiness Partner
Maise Technology provides CMMC readiness support for small manufacturers and defense suppliers through our compliance services, backed by hands-on IT and security implementation. Learn more about our manufacturing work on our IT services for manufacturing companies page.
Want an honest look at your CMMC readiness? Schedule A 15 Minute Discovery Call.
This article reflects publicly reported information as of its date and is not legal or contracting advice. CMMC requirements are subject to change.
Not long ago, a homeowner paid the plumber by check. Today, most home service companies take cards in the driveway, on a technician's phone, or through a link texted after the job. That's faster and more convenient for everyone.
It also means your company handles payment card data, and that brings the Payment Card Industry Data Security Standard, known as PCI DSS, into the picture. Here's what contractors need to know in plain language.
What Is PCI DSS?
PCI DSS is a set of security requirements created by the major card brands through the PCI Security Standards Council. Any business that accepts, processes, stores, or transmits payment card information is expected to follow it. Your obligation usually comes through your agreement with your payment processor or bank.
The current version is PCI DSS v4.0.1. Requirements that were marked as "future-dated" in version 4.0 became mandatory on March 31, 2025.
PCI DSS isn't a government law, but failing to meet it can lead to fees from your processor, higher costs after a breach, or even losing the ability to accept cards.
How It Applies to Most Contractors
Most home service companies are small merchants. That usually means:
- You complete a yearly Self-Assessment Questionnaire (SAQ) rather than a full audit.
- The specific SAQ depends on how you take payments.
- Your processor may provide a portal to complete and track it.
The way you accept cards makes a huge difference in how much work compliance takes. The less card data touches your systems, the simpler it gets.
Payment Methods, From Simplest to Riskiest
Card readers from your processor
Many modern mobile card readers encrypt card data the moment it's swiped, tapped, or inserted. Some are validated under the PCI point-to-point encryption (P2PE) program, which can significantly reduce your compliance scope.
Payment links and hosted pages
Texting or emailing a payment link that sends customers to your processor's secure page keeps card numbers off your devices entirely.
Card-on-file through your processor
Storing a customer's card for maintenance agreements is fine when the processor stores it using tokens. Your system keeps a reference number, not the actual card.
Typing card numbers into a phone or computer
Manually entering card numbers into a web browser or app on a shared office computer increases risk and scope.
Writing card numbers down
This is the riskiest practice. Card numbers on work orders, sticky notes, or spreadsheets are a common cause of compliance problems and breaches.
Practical Rules for Every Technician
- Never write down card numbers on paper work orders or notes.
- Never store the security code (CVV) for any reason.
- Never text or email card numbers to the office.
- Only use company-approved payment apps and readers.
- Keep devices locked with a PIN or fingerprint.
- Report a lost device or reader immediately.
Office Practices That Matter
- Use individual logins for payment and dispatch systems.
- Turn on multifactor authentication for payment platforms.
- Keep office computers updated and protected from malware.
- Shred any old paper records that contain card numbers.
- Review who has access to payment reports and refunds.
A Common Scenario
A customer calls the office to pay over the phone. A busy office assistant writes the card number on a notepad, then types it into the payment system later. The notepad sits on the desk for weeks.
The better approach: send the customer a secure payment link, or enter the card directly into the processor's virtual terminal while on the call, without writing it down. Then the number never lives anywhere in your office.
Where to Start
- Ask your processor which SAQ applies to your business.
- List every way your company accepts card payments.
- Eliminate any process that involves writing down or storing card numbers.
- Move toward encrypted readers, payment links, and tokenized card-on-file.
- Train technicians and office staff on the rules above.
Many businesses overlook requirements like these. We explore similar gaps in the compliance blind spot.
Make Payments Easy and Safe
The right payment setup protects customers, reduces your compliance workload, and gets you paid faster. Maise Technology helps contractors with compliance services and cybersecurity services sized for service businesses.
Want help reviewing how your company takes payments? Schedule A 15 Minute Discovery Call.
This article provides general information. Confirm your specific PCI DSS obligations with your payment processor or a qualified assessor.
A written information security plan (WISP) is a documented set of policies and safeguards that explains how a business protects sensitive customer information. It describes who is responsible for security, what risks the business faces, which protections are in place, and what happens if something goes wrong.
For many accounting firms, tax preparers, and other financial professionals, a WISP isn't optional. Federal rules require it. For other professional services firms, it's still one of the clearest ways to show clients that their information is handled responsibly.
Who Needs a WISP?
The FTC Safeguards Rule requires businesses that the rule treats as "financial institutions" to develop, implement, and maintain a written information security program. That category is broader than most people expect. It includes tax preparers, many accounting firms, mortgage brokers, and other businesses that handle consumers' financial information.
The IRS reinforces this for tax professionals. It published IRS Publication 5708, a guide and template for creating a WISP for tax and accounting practices.
Other firms, such as consultants, engineers, architects, and marketing agencies, may not fall under the Safeguards Rule. Many still create a WISP because clients ask for one, cyber insurance carriers expect one, or state privacy laws encourage reasonable security programs.
What Goes Into a WISP?
A WISP should fit your firm's size and complexity. Under the FTC Safeguards Rule, a written program generally covers these elements:
- A qualified individual who oversees the security program. This can be an employee or an outside provider.
- A written risk assessment identifying threats to customer information.
- Safeguards to control those risks, such as access controls, encryption, and multifactor authentication.
- Testing and monitoring to confirm those safeguards work.
- Staff training on security awareness.
- Service provider oversight for vendors who handle customer data.
- An incident response plan describing what to do after a security event.
- Regular reporting to firm leadership on the program's status.
Some requirements are scaled back for smaller businesses that maintain information on fewer than 5,000 consumers. Check the rule carefully, or with a qualified advisor, to see which apply to you.
WISP vs. IT Policy: What's the Difference?
An IT policy usually describes rules for employees, such as acceptable use or password requirements. A WISP is broader. It ties policies to risks, assigns responsibility, and explains how the whole program is maintained over time. Think of IT policies as chapters inside the WISP.
Common Mistakes Firms Make
Downloading a template and stopping there
Templates are helpful starting points. But a WISP that describes safeguards you don't actually have can create more trouble than having no plan at all. The document must match reality.
Writing it once and never updating it
Your firm changes. You add software, hire staff, open remote access, or switch vendors. The WISP should be reviewed at least once a year and after significant changes.
Leaving out the incident response plan
Many WISPs explain how to prevent problems but not what to do when one happens. Under amendments to the Safeguards Rule, covered businesses must also notify the FTC of certain security events involving the information of 500 or more consumers. Knowing your steps in advance matters.
Forgetting vendors
Cloud tax software, document portals, and outsourced bookkeeping all handle client data. Your WISP should explain how you evaluate and monitor them.
Frequently Asked Questions
How long should a WISP be?
Long enough to cover your real systems and risks. For a small firm, that might be 10 to 20 pages. Larger firms often have more.
Do I need to file my WISP with the government?
No. You keep it on file. You may need to show it to regulators, auditors, insurers, or clients who ask.
Can my IT provider write it for me?
An IT provider can help significantly, especially with the technical safeguards. Firm leadership should still review and own the final plan, because it reflects business decisions about risk.
Is a WISP the same as being compliant?
No. A WISP documents your program. Compliance depends on actually carrying out what the plan describes.
Getting Started
Begin with an inventory of the client information you hold and where it lives. Then review the IRS template or another reputable framework, adapt it honestly to your firm, and assign a qualified individual to keep it current.
For a look at what firms commonly overlook, see the compliance blind spot that could cost you thousands. Maise Technology helps firms build practical security programs through our compliance services, and we support accounting and financial practices through our IT support for financial firms.
Have a question about your firm's WISP? Get In Touch.
This article provides general information and is not legal advice. Consult qualified counsel about how the FTC Safeguards Rule applies to your business.
Short answer: Yes. Under the HIPAA Security Rule, every covered health care provider that handles electronic protected health information must conduct an accurate and thorough risk analysis. That includes a three-provider family practice, a solo therapist, and a small dental office. Size changes how detailed the analysis needs to be, but not whether it's required.
Below, we explain what a security risk analysis is, what it usually covers, how often to do one, and how small practices can get it done without stopping patient care.
What Is a HIPAA Security Risk Analysis?
A security risk analysis is a structured review of how your practice protects electronic patient information, often called ePHI. It answers three basic questions:
- Where does patient information live and travel in our practice?
- What could realistically go wrong with it?
- How likely and how harmful would each problem be?
The requirement comes from the HIPAA Security Rule's administrative safeguards at 45 CFR 164.308(a)(1)(ii)(A). The U.S. Department of Health and Human Services publishes guidance on risk analysis that explains what regulators expect.
Isn't This Just for Hospitals?
No. This is one of the most common misunderstandings we hear from small practices. HIPAA applies to covered entities based on what they do, not how big they are. If your practice bills insurance electronically, you're almost certainly a covered entity.
The rule is designed to scale. HHS expects a small practice's analysis to reflect its size, budget, and technology. A clinic with five computers and a cloud-based EHR won't need the same documentation as a hospital system. It still needs a real analysis, written down.
What a Risk Analysis Usually Covers
A useful analysis looks at technology, people, and procedures together. Common areas include:
- Where ePHI is stored: EHR systems, imaging software, billing platforms, email, scanned documents, and personal devices.
- Who can access it: staff accounts, shared logins, former employees, vendors, and remote access.
- How it's protected: passwords, multifactor authentication, encryption, and screen locks.
- Backup and recovery: whether you can restore patient records after a ransomware attack or hardware failure.
- Physical security: front-desk screens, unlocked server closets, and paper records near computers.
- Vendors: business associates who handle patient data on your behalf.
For each risk, the analysis should note how likely it is and how much harm it could cause. That's what turns a list of worries into a plan.
Risk Analysis vs. Risk Management
These two terms are related but different. The risk analysis identifies and rates risks. Risk management is what you do about them. HIPAA requires both. Finding a problem and leaving it alone doesn't meet the intent of the rule.
A practical approach is to rank findings by priority and assign each one an owner and a target date. For example, "Turn on multifactor authentication for the EHR" might be a high-priority item for this month. "Replace the aging front-desk computer" might be planned for next quarter.
How Often Should a Practice Do One?
The HIPAA Security Rule doesn't set an exact schedule. It expects risk analysis to be an ongoing process. Many practices review their analysis at least once a year. You should also update it after major changes, such as:
- Switching EHR or practice management systems.
- Opening a new location.
- Moving to cloud services.
- Experiencing a security incident.
- Adding remote work or telehealth.
What About the Proposed HIPAA Security Rule Changes?
HHS proposed significant updates to the HIPAA Security Rule in January 2025. As of this writing, those changes have not been finalized, and federal regulators have signaled that final action won't come until at least mid-2027. The current Security Rule, including the risk analysis requirement, remains fully in effect. Practices shouldn't wait for new rules to address the requirements already on the books.
Free Tools and Where They Fit
The Office of the National Coordinator for Health IT offers a free Security Risk Assessment Tool designed for small and medium-sized providers. It walks you through questions and helps organize your answers.
The tool is a solid starting point. Keep in mind that it records what you tell it. If nobody on your team knows how backups are configured or which vendors still have remote access, the results will have gaps. That's where an outside review often helps.
Frequently Asked Questions
Is a vulnerability scan the same as a risk analysis?
No. A vulnerability scan checks computers for technical weaknesses. It can be one input to a risk analysis, but it doesn't cover people, procedures, vendors, or physical security.
Do we need an outside company to do it?
HIPAA doesn't require outside help. Many small practices still use a third party because staff are busy and an independent view tends to catch blind spots.
What happens if we never did one?
Start now. A current, documented analysis with an active remediation plan is far better than none. The HHS Office for Civil Rights has repeatedly cited missing risk analyses in enforcement actions.
Getting It Done Without Disrupting Patients
Most small practices can complete a solid analysis with a few short interviews, a review of systems, and a written report with priorities. It doesn't need to take your front desk offline.
Maise Technology helps practices meet compliance requirements with practical, plain-language findings. You can also read about our approach on our IT services for healthcare organizations page, or see how a cybersecurity risk assessment works in general.
Have a question about where your practice stands? Get In Touch and we'll point you in the right direction.
This article provides general information and is not legal advice. Consult qualified counsel about your practice's specific HIPAA obligations.
