CMMC Intelligence Reports
Monthly briefings on CMMC program updates, C3PAO assessment timelines, compliance deadlines, and the threat landscape facing the Defense Industrial Base.
Published on the 1st of each month. No fluff. Just what changed and what you need to do about it.
Small defense contractors may qualify for a free CMMC gap assessment.
Apply for a CMMC Gap Assessment Grant →CMMC Phase 2 Suspended: What Changed, What Didn’t, and Why Self-Attestation Risk Just Went Up
DoD suspended CMMC Phase 2 third-party certification on July 13 and froze Phases 3 and 4, lifting the November 10 enforcement deadline. Phase 1 self-assessment remains fully enforceable, and a new supply-chain executive order and an active exploitation campaign against defense manufacturing software round out the month.
Read the July 2026 report →
No More Runway: Flow-Down Wave, FIPS Final Stretch, and July's Critical Actions
The window for making November is closed for contractors who haven't started. Prime contractors are enforcing CMMC flow-down requirements ahead of DoD. FIPS 140-2 has three months left. Here is what changed in June and what must happen in July.
Read the June 2026 report →
Queue Crunch, FIPS 140-2 Four Months Out, and Ransomware Rotating to the DIB
C3PAO wait times are at their longest yet. FIPS 140-2 sunset is four months away. Ransomware groups are shifting focus to smaller defense suppliers. June is the last month where starting puts a contractor on a realistic path to November.
Read the May 2026 report →
Phase 2 Enforcement, C3PAO Wait Times, and the Volt Typhoon Threat to the DIB
Phase 2 is active and DoD contracting officers are enforcing CMMC requirements at award. C3PAO assessment queues are building. Volt Typhoon activity against small defense suppliers continues. What contractors need to act on this month.
Read the April 2026 report →
What Each Report Covers
Program Updates
DoD rule changes, DFARS clause updates, and CMMC program announcements from the Office of the Under Secretary of Defense.
Assessment Pipeline
C3PAO capacity, assessment wait times, DIBCAC activity, and what the queue looks like for companies starting now.
Compliance Deadlines
Upcoming contract milestones, SPRS submission windows, and enforcement dates affecting the DIB.
DIB Threat Landscape
Active threat actors targeting defense contractors, recent incidents, and what small suppliers need to watch.
Get a straight answer about your CMMC path.
Book a free 30-minute call with Rick. No sales pitch, just straight answers about your CMMC path.
Book a Free 30-Min Call with Rick