Is CMMC cancelled?
No — the verification mechanism is paused, not the security obligation. On July 13, 2026 the Department of War suspended CMMC Phase 2 and stopped C3PAO third-party assessment designations. Level 1 and Level 2 self-assessments entered contracts under Phase 1 in November 2025 and remain a current, valid requirement — still being written into new solicitations and flowed down by primes. The Reform Task Force's 60-day review ended September 11, 2026; its recommendations went to the Department's CIO, who decides when they are published. Nothing has been published yet, and recommendations are not final decisions. On September 3 the Department reissued the class deviation (2026-O0025, Revision 3) that directs contracting officers to remove third-party CMMC requirements and permits Level 1 and Level 2 self-assessments in every solicitation.
What happened to C3PAO certification? I already have one — or was scheduled.
Since July 13, requiring activities may designate only Level 1 (Self) or Level 2 (Self) — Level 2 (C3PAO) and Level 3 (DIBCAC) designations are not permitted and no waivers are granted. Existing C3PAO requirements are coming out of active solicitations now, and out of awarded contracts at the next option exercise or administrative modification. A certification you already hold still carries weight with primes — and it remains the strongest evidence behind the score and affirmations you still owe. If certification returns after the task force reports, the preparation is the same 110 controls.
Which level do I actually need?
It comes down to what you handle. Federal Contract Information only — contract data not meant for public release — puts you at Level 1: 15 requirements, annual self-assessment. Controlled Unclassified Information — drawings, specs, technical data — puts you at Level 2: all 110 NIST 800-171 controls, plus a current SPRS score under DFARS 7019. If you're not sure which data you hold, that's exactly what the free scoping wizard sorts out.
Do I still need an SPRS score?
If you handle CUI, yes. DFARS 252.204-7012, 7019 and 7020 all remain in force, and a current NIST SP 800-171 Basic self-assessment posted in SPRS — no more than three years old — is still required to be considered for award. An overstated score is a False Claims Act exposure, and that risk did not pause with certification.
Is my SPRS score different from CMMC Level 2?
Same 110 controls, two obligations. Your SPRS score comes from scoring those controls with the DoD Assessment Methodology (−203 to 110) under DFARS 7019. A CMMC Level 2 self-assessment attests against the same control set with an annual affirmation. Do the work once and both are covered — that's the point of working from one assessment.
Does NIST 800-171 Rev 3 change my requirements?
Not yet. SPRS scoring and CMMC are still based on NIST SP 800-171 Revision 2 and its 110 controls. DoD has not adopted Rev 3, which would require new rulemaking. Build to Rev 2 today. CMMC Map tracks rule changes and will update when a formal transition happens.
Do I need to upload CUI to use CMMC Map?
No. CMMC Map is a readiness and documentation tool. You upload compliance documentation — policies, configuration screenshots, training records — not controlled technical data. The AI assistant is not authorized for CUI and warns you before you paste into it. Keeping CUI out is your call, not something the tool detects for you.
Will CMMC Map replace a C3PAO?
No, and we're direct about that. CMMC Map is not a C3PAO and does not perform certified assessments. It prepares your documentation, your score and your affirmations. If the task force brings third-party certification back in some form, a C3PAO conducts that assessment — and you walk in with the binder already built.
I don't have any IT staff. Can I still use this?
That's exactly who this is built for. Every requirement is rewritten in plain English with a "what this means for your business" explainer, and the assistant answers questions about your specific setup. Most shops reach a defensible position in eight to twelve weeks of evening work.
Is CMMC Map free? How much does it cost?
The complete self-assessment is free, forever — the scoping wizard, every control in plain English, your live SPRS score, and a ranked gap list. No credit card, no trial clock. The paid plan adds the paperwork: $149/month generates the SSP, POA&M, and all 14 policies from your answers, with the AI assistant, the evidence readers and the MCP connector included. Consultants add client workspaces for $75 each. Month to month, cancel anytime.