Three military installations, a member-owned insurer and a city-owned utility, each with its own access gap.

Find where the CUI actually lives and shrink that footprint. Most small and mid-size contractors around the bases have CUI scattered across email, file shares and personal drives. Once it sits in a defined enclave, MFA, access reviews and audit logging cover far fewer systems. We prepare the identity and access evidence. The C3PAO does the assessment.

No. On 13 July 2026 the Department of War suspended Phase 2 pending a review by a CMMC Reform Task Force, and contracting officers are removing Phase 2 requirements from existing contracts by modification. Phase 1 self-assessments still apply. As of October 2026 no new Phase 2 date has been announced, so check each solicitation.

Location rules alone break for a membership that lives abroad. We move members to passkeys where their devices support it, use device and behavior signals for step-up checks, and lock down the call-center reset path, which is where many takeovers really start.

The DIR summary says the TDPSA does not apply to political subdivisions, so a municipal utility may fall outside it. Contractors and private partners that handle the utility's customer data may still be covered. Ask your counsel to confirm for your entity.

Yes, on the identity side. We connect authorization records, badge data and system accounts so the quarterly review is a report, and revocation happens within the timelines CIP-004 sets. Your compliance team still owns the CIP program and the audit.