CMMC LEVEL 2 COMPLIANCE FOR DEFENSE CONTRACTORS
CMMC Compliance for Defense Contractors
The rules changed. Your obligations did not.
Most defense contractors now self-assess against NIST SP 800-171 and affirm their compliance in the Supplier Performance Risk System (SPRS) every year. That affirmation is a legal certification, and getting it wrong carries real False Claims Act risk.
Justice IT Consulting is CMMC Level 2 certified. We have been through the same assessment we prepare you for, and we help you build a security program that holds up whether you are self-assessing today or pursuing certification for your next contract.
WE CAN HELP. Talk to a CMMC Expert: 817-803-4603
Last updated: October 2026
HOW WE GET YOU COMPLIANT
Our Proven Process
- Assess Where You Stand. We evaluate your environment against all 110 NIST SP 800-171 controls and deliver a CMMC Report Card that shows exactly where you are compliant and where you have gaps.
- Document Your Program. We develop your System Security Plan (SSP) and Plan of Action and Milestones (POA&M), the core documents behind an accurate SPRS score.
- Close the Gaps. Our team implements your POA&M, fixing technical and policy gaps so your environment matches what you report.
- Affirm and Certify with Confidence. Submit your SPRS score and annual affirmation knowing they will hold up. When your contracts or primes require Level 2 certification, you will be ready for your C3PAO assessment.
WHERE THINGS STAND RIGHT NOW
Where CMMC Stands Today
In July 2026, the Department of War (DoW, formerly the Department of Defense) paused Phase 2 of CMMC. Phase 2 would have made third-party (C3PAO) certification mandatory for most Level 2 contracts.
The pause did not remove your obligations. Every contractor that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) still has to:
- Meet the 110 NIST SP 800-171 security controls required by DFARS 252.204-7012
- Keep a current, accurate score in SPRS
- Have a senior official affirm compliance every year, which is required for contract award
The Department of Justice continues to pursue contractors whose cybersecurity claims do not match reality. And many prime contractors are still requiring Level 2 certification from their suppliers, regardless of the pause.
The pause is temporary. A reformed Phase 2 is expected. Contractors who keep building now will be ready when it returns. Those who stop will be starting over on a shorter timeline.
Military Grade Cyber Security Management
Few small and mid-sized defense contractors can afford an in-house security team or a full-time CISO. Justice IT Consulting fills that role. We monitor and manage your environment, maintain your compliance documentation, and respond to incidents, including the 72-hour cyber incident reporting required under DFARS 252.204-7012.
A Fast, Thorough Assessment
Our assessment is designed to keep your contract work moving. We deliver a clear picture of your compliance status, a prioritized list of gaps, and a realistic roadmap, so your next SPRS affirmation is one you can stand behind.
Industries Served
Machining
DoD Subcontractors
Metallurgy
Manufacturing
Plastics
Consulting
Aerospace
Fasteners
Firearms and Weaponry
And More....
Client Testimonials
V.P. of Operations, Aero CNC
I had an emergency this morning when I walked in at 6:40 a.m. and my server was not working. I called Justice I.T. and they were here in 15 minutes and fixed my problem within 5 minutes. We rely on our server to communicate with customer portals and run our shop. Without Justice I.T. I would have not been able to get the job done. When it comes to computer services, cyber security and friendly service Justice I.T. is the Best.
Owner, Diesel Dynamics
I can't possible express how thankful I am for them. Austin help me get our computer up and running when I was in a pinch and literally had our business on shutdown. Thank you so much for taking care of us and making us priority!!
Owner, FMR Chemical
Austin and the team at Justice IT are the most personable/professional/efficient IT group I've used over the past 20 years. We are a small business that doesn't have the time or infrastructure to handle IT needs so we outsourced this function to Justice IT upon a recommendation of a client. We are pleased to say that after nearly two years, Justice IT is still exceeding our expectations.
Partner, Agile Management Enterprises
I have been working with Justice IT Consulting for several years now. I continue to be impressed by their quality of work, and customer service. I highly recommend them to anyone looking for a refreshing IT experience!
FREQUENTLY ASKED QUESTIONS
CMMC Questions We Hear Most
Is CMMC paused?
Partially. In July 2026, the Department of War paused Phase 2, which would have made third-party (C3PAO) certification mandatory for most Level 2 contracts. Phase 1 remains in effect, so self-assessments, SPRS scores, and annual affirmations are still required.
Do I still need to comply with NIST SP 800-171?
Yes. If you handle Controlled Unclassified Information (CUI), DFARS 252.204-7012 still requires you to implement all 110 NIST SP 800-171 controls and report cyber incidents. The pause did not change that.
What is an SPRS affirmation, and why does it matter?
A senior official at your company must affirm in the Supplier Performance Risk System (SPRS) that you meet your CMMC requirements, at least once a year. A current affirmation is required for contract award. Because it is a legal certification, an inaccurate affirmation can create False Claims Act liability.
Should I still get CMMC Level 2 certified?
For many contractors, yes. Many prime contractors still require Level 2 certification from their suppliers, and C3PAOs are still conducting assessments and issuing certifications. Certification also verifies that your self-assessment holds up. Check your subcontract requirements and talk with us about the right timing.
What happens when Phase 2 returns?
The DoW CMMC Reform Task Force has submitted recommendations, and a revised Phase 2 is expected. Contractors who keep maturing their programs now will be ready. Those who stop will be starting over on a shorter timeline.
Is Justice IT Consulting CMMC certified?
Yes. Justice IT Consulting is CMMC Level 2 certified. We have completed the same assessment process we prepare our clients for.
