Briefings · The library

Straight answers on CMMC

Short, sourced briefings on the questions small defense contractors actually ask, written from the primary documents, dated, and revised when the program moves. No scare copy, no vendor fog.

7 briefingsPrimary sources onlyReviewed & dated

§ 01 · Latest

The programReviewed July 23, 2026

The CMMC pause, explained

On July 13, 2026, DoD suspended the third-party assessment rollout and every later milestone with it while a Reform Task Force reviews the program, and directed contracting officers to amend active contracts the next day. What stopped, what still binds clause by clause, and what a small contractor should do with the time.

Read the briefing

§ 02 · The index

Every briefing, one register

Jul 2026 The program The CMMC pause, explained What DoD suspended on July 13, what the task force decides next, and the clauses that never moved. Jul 2026 Assessment What evidence does Level 2 actually require? 320 objectives, three assessment methods, and the two standards every artifact has to meet. Jul 2026 Boundary CMMC scoping: what's actually in bounds Five asset categories, the enclave move, the VDI rule, and how providers change your boundary. Jul 2026 Readiness Where CMMC readiness actually fails Six failure modes and the POA&M rules that forgive almost none of them. Jul 2026 Budget CMMC compliance cost: what actually drives it Why the assessment fee is the smallest line, and the three levers that move the total. Jul 2026 Assessment Self-assessment vs. C3PAO assessment Three assessment paths, one bar, and why "self" is never the easy one. Jul 2026 The record SPRS scoring, explained How the −203 to 110 scale works, why 88 matters, and why the number is a legal one.

Every briefing lists its sources, including the rule text, the DoD guides, and the clauses, and carries the date it was last reviewed. When the program moves, the register moves.

§ 03 · In research

On the bench

Being written from the same primary sources. They publish when they hold up, not before.

— Boundary Building a CMMC enclave The architecture that shrinks scope: what a real enclave takes, and what it can't hide. In research
— Cryptography FIPS-validated cryptography, plainly Why "we use AES-256" fails the most-failed control, and what a CMVP certificate proves. In research
— The flow-down CMMC for subcontractors What a prime can require of you, what actually flows down, and how to read the ask. In research
Thirty minutes

Rather talk it through?

Bring your contract situation to a scoping call. You get a straight answer on scope, fit, and timeline, including "you don't need us" when that's the truth.

Schedule a Demo