CMMC compliance when the certificate is suspended and the obligation isn't
Trusted by
CMMC compliance, three pillars, one operator.
One Canadian team scopes the data, closes the controls, and scores you honestly. Defence contractor compliance starts with the clause your prime flowed down, not with a programme announcement.
Close the 110
The NIST 800-171 Rev 2 controls didn't move in July. Only the audit that checked them did, so the work is unchanged and the party asking for it is now your prime.
Score every family
Fourteen control families, scored one at a time, into an SPRS submission backed by a system security plan and a remediation plan you can hand to a contracting officer.
Ready for what lands
Phases 2, 3 and 4 are suspended, so no C3PAO can assess you at CMMC level 2 today. Phase 1 self-assessment and your DFARS clause carry on, and a restart finds you in shape.
Does CMMC Compliance work the same way in every industry?
No. The CMMC Compliance work is the same craft in every sector, but the conditions around it are not. In defence and aerospace that means controlled goods rules, CMMC and the flow-down from your prime; in financial services, OSFI's technology and cyber risk rules; and in government, Protected A, B and C data handling. We keep the service and change the part that bends.
The level your contract names, assessed against the real control set.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
OSFI's technology and cyber risk rules set what an examiner will ask to see.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
What do you need from CMMC Compliance?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- CMMC Compliance
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584CMMC compliance in Canada, made real.
You're a Canadian supplier and an American prime sent you a clause. That clause is what binds you, not a programme announcement.
Draw the boundary before you count controls.
Good work starts by drawing a boundary around the data. Which of your systems touch CUI, meaning controlled unclassified information, which touch only Federal Contract Information, and which touch neither. Most suppliers we meet have let controlled data spread across a general-purpose network because nobody drew the line, and that turns a manageable enclave into a company-wide project. Scope the enclave properly and the 110 controls apply to a fraction of your estate. Skip that step and they apply to all of it.
The score has to be one you can defend.
Then it's the score, and the score has to be honest. Your SPRS submission is a self-assessment with a number attached, backed by a system security plan and a remediation plan for anything open. An inflated score is a false claim to a government customer, which is a different category of problem from a low one. We would rather hand you a defensible 88 with dated remediation than a fictional 110.
What actually changed in July, clause by clause.
What changed is narrower than the headlines suggested. On 2026-07-13 the US Department of Defense (now the Department of War) suspended Phase 2, so third-party CMMC assessment is off and the requirement is being removed from live contracts by modification. Phase 1 self-assessment, SPRS reporting and DFARS 252.204-7012 all stayed. The review reports around 2026-09-13 and could restructure or scrap the certificate, but the Department has said plainly it is cutting audit burden and not the baseline. Every outcome leaves the 110 standing.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our NIST 800-171 and CMMC level 2 readiness work runs.
Four steps, and step 01 is reading your subcontract. Not the news. The clause your prime flowed down names a standard, a level and sometimes a date, and it survives announcements about the programme because it's a term of your contract until somebody modifies it. Suppliers who stood down in July on the strength of a headline are the ones who will scramble when their prime asks for a score. We start with the paperwork that binds you.
Engagement phases
Phases 01 to 04
Read the clause
Which DFARS clauses sit in your subcontract, whether you touch CUI or only Federal Contract Information, what level was named, and what your prime has actually asked for in writing.
Draw the enclave
A defensible boundary around the systems that handle controlled data, so the 110 controls land on a scoped environment rather than on your whole network.
Score and close
Every one of the 14 families assessed, a system security plan written, a remediation plan for what's open, and an SPRS score we can defend line by line.
Stay ready
Quarterly reassessment as your estate changes, and a read on the reform outcome when it lands. If third-party assessment returns, you're already in shape for it. We prepare you and never assess you.
CMMC compliance questions, answered straight.
Answers first, including the one where we tell you the certification you're asking about is suspended and the obligation behind it isn't. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedNIST Cybersecurity FrameworkNIST Cybersecurity Framework for Canadian organisations, starting with the Function CSF 2.0 put at the centre.
- RegulatedISO 27001 Certification SupportISO 27001 certification support in Canada, from the first scope decision to the audit an accredited body runs.
- RegulatedISO 22301 Business ContinuityISO 22301 business continuity for Canadian organisations, built so the business impact analysis and the infrastructure agree.
