Cybersecurity · CMMC
CMMC compliance for Southern California defense contractors
Gap assessments, SSPs, POA&Ms and NIST 800-171 control implementation, updated for the July 2026 Phase 2 suspension.
The short answer
WCC helps Southern California defense contractors prepare for CMMC: gap assessments against NIST SP 800-171, SPRS scoring, System Security Plans, POA&Ms and hands-on control implementation. Status as of October 2026: Phase 1 self-assessments are in effect, but the Department of War suspended the Phase 2 third-party certification requirement on July 13, 2026 pending a program review. WCC is not a C3PAO and doesn't perform certification assessments.
Current status
Where CMMC stands right now
The DFARS rule took effect on November 10, 2025, starting Phase 1: Level 1 and Level 2 self-assessments as a condition of award on applicable contracts. Phase 2, which would have made third-party C3PAO certification the standard for Level 2 starting November 10, 2026, was suspended on July 13, 2026, and the department said contracts already carrying C3PAO or Level 3 requirements would be amended. A CMMC Reform Task Force review closed in September 2026, and its recommendations are pending.
What hasn't changed: DFARS 252.204-7012 still requires NIST SP 800-171 controls for contractors handling CUI, SPRS scores still matter to primes, and false cybersecurity claims still carry False Claims Act risk. The work to get ready is the same; only the certification timing is uncertain. We'll update this page when the department announces next steps.
CMMC levels
The three CMMC levels
| Level | Protects | Requirements | Assessment |
|---|---|---|---|
| Level 1 | Federal Contract Information (FCI) | 15 basic safeguarding requirements | Annual self-assessment and affirmation |
| Level 2 | Controlled Unclassified Information (CUI) | 110 NIST SP 800-171 Rev 2 requirements | Self-assessment today; C3PAO certification was planned for Phase 2 |
| Level 3 | Highest-priority CUI | Level 2 plus 24 NIST SP 800-172 requirements | Government-led (DIBCAC); currently suspended |
Most Southern California suppliers that receive drawings, specifications or other CUI from a prime fall under Level 2.
What we do
What WCC handles
Gap assessment and SPRS
Current-state review against all 110 requirements, SPRS score calculation and a prioritized remediation plan.
SSP and POA&M
System Security Plan that defines the assessment boundary and CUI flows, plus a tracked plan of action for open items.
Control implementation
MFA, encryption, segmentation, logging, vulnerability management and secure configurations, done by our engineers.
Secure cloud setup
Microsoft 365 GCC High or other environments suited to CUI, planned around your workflows.
Physical protection
Access control, visitor logs and camera coverage for the PE requirements, installed by our own security team.
Ongoing support
Annual affirmations, evidence upkeep and readiness for a future assessment, often with a vCISO.
Independence
Why we don't certify you
Certification assessments are done by accredited C3PAOs or, for Level 3, by the government. A firm that helped implement your controls can't also be the one that certifies them. WCC helps you prepare and supports you during an assessment; the assessment itself comes from an independent C3PAO.
Who needs it
Southern California businesses affected
Aerospace suppliers
Machine shops, composites and component makers receiving controlled drawings from primes.
Defense electronics
RF, sensors and embedded systems suppliers, often with ITAR alongside CMMC.
Engineering firms
Design and systems engineering work that involves technical data.
IT and software vendors
Providers whose systems store or process a defense customer's CUI.
Research institutions
Universities and labs with DoD-funded work involving CUI.
Manufacturers
Plants with shop-floor systems in scope. See managed IT for manufacturing.
Cost
What CMMC preparation costs
Cost depends far more on your starting point than on company size. A business with mature NIST 800-171 practices may need a few months of documentation and cleanup; one starting from scratch can need a year or more of remediation, often including a move to a CUI-ready cloud environment. We price gap assessments as fixed-fee projects and remediation from the gap findings. Related: managed security pricing.
Timeline
CMMC rollout timeline
| Phase | Original start | Status (October 2026) |
|---|---|---|
| Phase 1: self-assessments | November 10, 2025 | In effect |
| Phase 2: Level 2 C3PAO certification | November 10, 2026 | Suspended July 13, 2026 |
| Phase 3: option periods and Level 3 | November 10, 2027 | Suspended |
| Phase 4: full implementation | November 10, 2028 | Suspended |
FAQ
CMMC questions
Is CMMC still required?
Yes, in part. Phase 1 self-assessment requirements have been in effect since November 10, 2025. The Phase 2 requirement for third-party C3PAO certification was suspended on July 13, 2026 pending a program review, and recommendations are pending as of October 2026.
What CMMC level do I need?
The contracting officer sets the level. Contracts involving only Federal Contract Information need Level 1; contracts involving Controlled Unclassified Information need Level 2. Most Southern California defense suppliers are Level 2.
What is the difference between CMMC and NIST 800-171?
NIST SP 800-171 is the set of 110 security requirements. CMMC is how the department verifies that contractors meet them. CMMC Level 2 maps directly to NIST SP 800-171 Rev 2.
Should I keep preparing while Phase 2 is suspended?
Yes. DFARS 7012 still requires NIST 800-171 controls for CUI, primes still ask for SPRS scores, and certification will likely return in some form. The preparation work is the same.
Is WCC a C3PAO?
No. WCC helps you prepare and supports you during an assessment, but certification is performed by an independent C3PAO.
How long does CMMC preparation take?
Organizations with mature NIST 800-171 practices may need 3 to 6 months. Those starting from scratch often need 12 to 18 months.
What happened to the November 10, 2026 deadline?
It was suspended. On July 13, 2026 the department paused the Phase 2 requirement for C3PAO certification and later phases while a reform task force reviews the program.
Related
Related guides and services
Get a recommendation
Talk to us about CMMC
Tell us your contracts, current posture and target level, and we'll scope a gap assessment.