Level 1
Federal Contract Information
For companies that only handle FCI. 15 basic safeguards and a self-assessment every year.
Where CMMC stands
What applies right now
CMMC requirements started showing up in defense contracts in November 2025, beginning with self-assessments (Phase 1).
On July 13, 2026, the Department of War suspended Phase 2, the third-party assessments that were set to start on November 10, 2026 (Department of War). As of late October it was still paused, with no decision on a restart (Federal News Network).
What didn't change: DFARS 252.204-7012 still requires you to protect CUI with the NIST SP 800-171 controls and report cyber incidents within 72 hours. The Phase 1 self-assessments stay in place: Level 1 every year, Level 2 every three years, each with a yearly affirmation in SPRS (DoD CIO). So a contract or a prime can still ask for your score today.
General information, not legal advice.
How it works
From scope to score
01
Scope
We find where Federal Contract Information and CUI live in your business, and shrink that footprint where we can.
02
Assess
A gap assessment against the 110 requirements in NIST 800-171, with the evidence for each one.
03
Document
Your System Security Plan, a plan of action for open gaps, and your SPRS score.
04
Fix and test
We close the technical gaps, then run a penetration test to prove the controls work.
Levels
Which CMMC level you need
Level 2
Controlled Unclassified Information
For companies that handle CUI. The 110 requirements of NIST 800-171, self-assessed every three years for now, with third-party assessments on hold.
Level 3
The most sensitive programs
Assessed by the government on top of Level 2. On hold along with Phase 2, and few small suppliers need it.
Oregon suppliers
Built for small shops, not enterprise programs
Many of Oregon's defense suppliers are small: machine shops, electronics makers, software firms and service companies. You don't need an enterprise compliance program. You need the right scope, honest documents and controls that actually work.
We keep the work in proportion. If your CUI can live in one tightly controlled system instead of across the whole company, that's usually the cheapest path, and we'll tell you so.
FAQ
Questions we get asked
Don't see yours? Email hello@portlandsecureit.com and you'll get a straight answer.
Is CMMC paused?
Only Phase 2, the third-party assessments. The Department of War suspended it on July 13, 2026, and it was still paused as of late October. NIST 800-171 and the Phase 1 self-assessments still apply, and contracts can still include them.
What's an SPRS score?
A score from -203 to 110 that shows how much of NIST 800-171 you've put in place. Contractors that handle CUI post it in the Supplier Performance Risk System, where primes and contracting officers can check it.
Do we need GCC High?
Not always. It depends on the kind of CUI you handle and what your contracts require. We sort that out during scoping, before you buy anything.
How long does it take to get ready?
It depends on your scope and how many gaps the assessment finds. You get a realistic timeline with the gap assessment, not before.
Keep reading