IT, OT and CMMC
under one roof.

Not as scheduled. Phase 2, the requirement for third-party (C3PAO) Level 2 certification set for November 10, 2026, was suspended by the Department of War on July 13, 2026. The 60-day review window closed about Sept 11. As of Oct 16, no results or restart date have been published. Phase 1, which began November 10, 2025, covers Level 1 and Level 2 self-assessments.

It turns the suspension into contracting instructions. The CMMC language first appeared in Revision 2 (July 16, 2026); the current Revision 3 was signed September 3, 2026. Contracting officers must remove suspended Phase 2 requirements: open solicitations are amended as soon as practicable, and existing contracts are modified before the next option or scheduled administrative modification. Baseline NIST SP 800-171 Rev 2 compliance under DFARS 252.204-7012 stays in place. From Nov 10, 2028, the deviation puts the CMMC clause in any contract where you handle FCI or CUI (except COTS-only contracts), not only where a level is specified. It is not a Phase 2 restart date.

DFARS 252.204-7012 remains in effect: safeguard covered defense information (CUI) to the 110 requirements of NIST SP 800-171 Rev 2, report cyber incidents to DoD within 72 hours, and flow the clause down to subcontractors that handle CUI. Federal contract information (FCI) still needs basic safeguarding under FAR 52.204-21. CMMC self-assessments and annual affirmations in SPRS apply where a contract specifies a level (DFARS 252.204-7021). DoD solicitations and contracts also carry a NIST SP 800-171 DoD Assessment requirement (DFARS 252.240-7997 under the current class deviation).

SPRS is the Supplier Performance Risk System, where defense contractors post their NIST SP 800-171 self-assessment scores. (It is often misheard as “SPURS.”) Your posted score and annual affirmation are statements your customers and contracting officers rely on, so the score should be accurate and backed by evidence. Our Assess and Sustain work keeps it that way.

We don't recommend it. The obligations above apply now, and certification will need the same controls whenever it restarts. The suspension is time to prepare properly: scope CUI, close gaps, document the System Security Plan, and keep evidence current.

No. Victory is not a C3PAO (an authorized third-party assessment organization). That keeps implementation and certification independent. When you're ready for assessment, we work with the C3PAO you choose and, if needed, help you select one.

Often not. Legacy controllers can stay in production behind layered segmentation and managed OT firewalls, mapped to NIST SP 800-171 alongside ISA/IEC 62443 and NIST SP 800-82. We assess each system rather than defaulting to rip-and-replace.

Yes. Victory Ready is built for exactly that: we add CMMC expertise alongside your in-house IT or current provider. For AZ MEP clients, we fit the MEP's assess, implement and advise model, under a single vendor qualification.