Rutter's CMMC Readiness Hub

 When the Department of War suspended the transition to CMMC Phase II on July 13, 2026, many defense contractors read it as permission to stop. That is a risky reading. The Phase II transition and its third-party assessment requirements were suspended. The obligation to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) was not.

Rutter built the CMMC Readiness Hub for this moment. It is a single place to understand what still applies, what may change, and what technical work keeps its value as the program evolves.

Rutter built the CMMC Readiness Hub for this moment. It is a single place to understand what still applies, what may return, 

What Changed, and What Did Not

Here is the status as of mid-October 2026:

• Suspended: the Phase II transition that had been scheduled for November 10, 2026. During the suspension, program managers may not designate Level 2 C3PAO or Level 3 DIBCAC assessment requirements.
• Still in place: Phase I self-assessment requirements. Applicable solicitations and contracts may require Level 1 or Level 2 self-assessments.
• Still the technical baseline: the Department continues to enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments during the interim period.
• Still contractually important: DFARS 252.204-7012 safeguarding and cyber incident reporting requirements remain in effect, including applicable subcontract flow-down obligations.
• Still pending publicly: the Department launched a 60-day CMMC Reform Task Force review in July, with recommendations to be delivered to the DoW CIO. As of mid-October, the Department had not publicly announced a replacement implementation framework.

In short, the suspension did not eliminate defense contractors' underlying cybersecurity obligations. Applicable solicitations and contracts can still require Level 1 or Level 2 self-assessments, while existing safeguarding, reporting, and flow-down requirements continue to apply.

Why the Pause Is a Planning Window, Not a Reprieve

A self-assessment still carries consequences. Contractors are responsible for accurately representing the cybersecurity controls they have implemented, and the government may conduct its own assessments.

In June 2026, the Justice Department announced a $507,144 False Claims Act settlement resolving allegations that a defense contractor failed to comply with required NIST SP 800-171 cybersecurity controls. A later government assessment produced a score of -170 after the contractor had previously reported a self-assessment score of 110. The settlement involved allegations, with no determination of liability, but it illustrates the risk of reporting a cybersecurity posture that the implemented environment does not support.

The current CMMC pause also does not eliminate the underlying cybersecurity requirements. The Department continues to enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments while it reviews the program.

Organizations can use this period to clarify scope, close technical gaps, improve evidence practices, and make sure reported assessment results accurately reflect how their environments operate.

What the Work Actually Looks Like

CMMC readiness is rarely just a documentation problem. Organizations also need an IT environment that can demonstrate that required controls are operating as intended.

Common readiness gaps include:

• No clear picture of where CUI enters, moves through, is stored, and leaves the organization
• Inconsistent MFA, privileged access, and account review practices
• Laptops and engineering workstations that are only partially managed
• Logs that exist but are not consistently reviewed or retained in a usable way
• Backups that have not been tested through restoration
• Evidence gathered as last-minute screenshots instead of produced through repeatable operational routines

These issues can affect an organization's security posture, self-assessment results, evidence quality, and ability to demonstrate that required controls are operating consistently.

Inside the CMMC Readiness Hub

The Hub is organized around common questions defense contractors and suppliers face. Start with the resource closest to where your organization is today.

• Who Needs CMMC?: Learn how contract language, FCI, CUI, and prime contractor requirements can affect whether CMMC requirements apply to your organization.
• CMMC Readiness Process: Explore Rutter's seven-step, infrastructure-first approach, from defining scope to establishing sustainable evidence routines.
• CMMC IT Requirements: Review the technical areas that support NIST SP 800-171 alignment, including identity, endpoints, logging, backup, remote access, and evidence.
• Azure for CMMC: Understand how Azure, Azure Arc, Entra ID, Intune, and Microsoft 365 can support readiness when configured appropriately, and why no platform makes an organization CMMC ready by itself.
• CMMC Resources: Find FAQs, guides, case studies, and information about the current CMMC suspension.
• Request a Readiness Assessment: Start a technical readiness conversation with Rutter.

What Rutter Does, and What It Does Not Do

Rutter is not a C3PAO and does not perform formal CMMC certification assessments. That distinction matters, and the Hub makes it clear.

Rutter's role focuses on the technical environment behind CMMC readiness. That can include helping organizations understand where FCI and CUI reside, hardening identity and access, bringing endpoints under management, improving logging and backup practices, prioritizing technical remediation, and establishing repeatable evidence practices.

Rutter can also support the environment over time through managed IT and security operations, helping organizations maintain the technical controls and operational practices they have put in place.

When a formal third-party assessment is required, that assessment must be performed by an authorized assessment organization. Rutter's role is to help organizations build, remediate, document, and operate the technical environment that will ultimately be evaluated.

Use the Review Period Well

Organizations do not need to wait for the next CMMC announcement to strengthen the underlying environment.

A practical starting checklist for the next 90 days:

1. Map where FCI and CUI enter, move through, are stored, and leave your organization.
2. Confirm which CMMC level, DFARS clauses, and cybersecurity requirements apply to your current contracts, solicitations, and flow-down obligations.
3. Review your System Security Plan and existing POA&M items, including ownership and remediation timelines.
4. Check that your current self-assessment accurately reflects how the environment operates today.
5. Establish repeatable evidence routines, such as access reviews, device compliance reporting, and backup recovery testing.

The value of this work extends beyond any single CMMC implementation milestone. Better identity controls, managed endpoints, tested recovery, useful logging, accurate scoping, and repeatable evidence practices strengthen the environment regardless of how the program evolves.

Start With the Hub

If you know you need technical help, request a CMMC-aware readiness assessment.

If your organization uses Microsoft technologies and you want to understand how Azure can support your readiness strategy, download the Azure CMMC Guide.

If you have a specific question about your environment, ask a Rutter expert.

Or begin at the CMMC Readiness Hub and follow the path that best fits your organization.

Requirements depend on your solicitations, contracts, flow-down clauses, information types, and other applicable obligations. Consult appropriate contractual, legal, and compliance advisors when interpreting requirements specific to your organization.