Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, shrink the scope, run a gap assessment and fix the gaps before an assessment is due.
Key takeaways
- Since November 10, 2026, applicable contracts can require Level 2 certification by a third-party assessor as a condition of award.
- Your CMMC level depends on the information you handle: FCI means Level 1, CUI usually means Level 2.
- Keeping CUI in a small, well-defined enclave is the most effective way to reduce cost and effort.
- Assessors want evidence for every requirement, so policies, settings and logs matter as much as tools.
- Certification is not the finish line; annual affirmations require controls that run every day.
In this guide
12 sections · 18 min read · Updated November 2026
Picture a machine shop in Casper, an engineering firm in Mills or a small construction contractor that has quietly supplied parts, drawings or services to larger defense companies for years. This fall, the purchase order arrives with a new question attached: what is your CMMC status? For many small suppliers, that email is the moment CMMC compliance, something Wyoming shops have heard about for years, stops being a future problem and becomes a condition of the next contract.
Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program began on November 10, 2026. From that date, contracts that involve Controlled Unclassified Information can require a Level 2 certification from an independent assessor before the award, not a promise to get there later. If your company touches defense work at any tier, the time to act is now, because the work to get ready usually takes longer than people expect.
This guide explains what changed, how to tell which level applies to you, how to keep the scope small, what a gap assessment looks like, which controls trip up small contractors, and what to do this week. It is written for owners and office managers, not security specialists.
Not sure where your CUI lives?
Our assessment maps your systems, data and gaps so you can plan your CMMC scope with real information.
What changed when CMMC Phase 2 started on November 10, 2026?
On November 10, 2026, the Department of Defense began requiring third-party Level 2 certification, performed by an authorized assessor, as a condition of award for applicable contracts. Before that date, most contractors could rely on self-assessments.
CMMC has been rolling out in stages. According to the DoD CIO and the Federal Register, the program rule (32 CFR Part 170) took effect on December 16, 2024. The acquisition rule that puts CMMC into contracts (48 CFR, the DFARS rule) took effect on November 10, 2025, which started Phase 1. In Phase 1, contracting officers could require Level 1 or Level 2 self-assessments as a condition of award. Phase 2 adds the requirement many contractors have been waiting for: a Level 2 certification assessment by a CMMC Third-Party Assessment Organization (C3PAO) for contracts that call for it.
Two more phases follow. Phase 3 begins on November 10, 2027, and Phase 4, full implementation, begins on November 10, 2028. Each phase widens the set of contracts that carry CMMC requirements, so a company that is not asked this year should still expect the question soon.
Definition
C3PAO: a CMMC Third-Party Assessment Organization, an independent company authorized to conduct Level 2 certification assessments of defense contractors.
Why this matters for small suppliers
Prime contractors are responsible for making sure their subcontractors meet the CMMC level required for the information they handle. That means the pressure rarely comes from the government directly. It comes from the larger company you supply, through flow-down clauses in your subcontract and supplier questionnaires. If you cannot answer, the prime has a simple choice: find a supplier who can.
That is a real business risk in Wyoming, where many small firms rely on a few long-standing customers. Losing one defense customer can mean losing a large share of revenue, and certification is not something you can arrange in a week once the request arrives.
Does CMMC apply to your Wyoming business?
CMMC applies if your company handles Federal Contract Information or Controlled Unclassified Information under a Department of Defense contract or subcontract, at any tier. Selling only commercial off-the-shelf products is generally exempt.
The level you need depends on the kind of information that flows to you, not on your size or how much defense work you do. Two terms matter:
- Federal Contract Information (FCI) is information provided by or generated for the government under a contract that is not intended for public release. Order details, delivery schedules and contract correspondence often qualify.
- Controlled Unclassified Information (CUI) is sensitive government information that requires safeguarding, such as technical drawings, specifications, test data or export-controlled details. CUI is usually marked, but not always, which is one reason scoping takes care.
Definition
Controlled Unclassified Information (CUI): sensitive government information, such as technical drawings or specifications, that is not classified but must be safeguarded under federal rules.
In practice, Wyoming companies that often fall into scope include machine and fabrication shops building parts to government drawings, engineering and surveying firms working on federal facilities, construction contractors on defense projects, IT and logistics providers that support primes, and energy-sector service companies with a federal customer. If you receive drawings or specifications from a prime and store them on your file server, in email or in a cloud folder, you very likely handle CUI.
Questions to answer before anything else
- Which of your current contracts or subcontracts include the DFARS clauses that reference CMMC or safeguarding covered defense information?
- What information do you receive from customers, and is any of it marked CUI or export controlled?
- Where does that information land: email, a shared drive, laptops, a shop floor computer, a USB drive?
- Who in your company can open it, and who outside your company (vendors, IT providers, cloud services) can reach it?
Quick check
Ask your largest defense customer which CMMC level it will require from you at your next renewal, and get the answer in writing. That single email shapes the rest of your plan.
Which CMMC level do you need: Level 1, 2 or 3?
You need Level 1 if you handle only FCI, Level 2 if you handle CUI, and Level 3 only for a small set of high-priority programs that the DoD designates.
Most small Wyoming suppliers that handle drawings or technical data will land at Level 2. The table below summarizes how the levels differ.
| Level | Information protected | Security basis | Who assesses |
|---|---|---|---|
| Level 1 (Foundational) | Federal Contract Information only | Basic safeguarding requirements in FAR 52.204-21 | Annual self-assessment with an affirmation by a company official |
| Level 2 (Advanced) | Controlled Unclassified Information | The security requirements in NIST SP 800-171 | Self-assessment for some contracts; a C3PAO certification assessment for contracts that require it, starting in Phase 2 |
| Level 3 (Expert) | CUI in the highest-priority programs | Level 2 plus selected requirements from NIST SP 800-172 | Government-led assessment, after Level 2 certification |
The key point for Phase 2 is that Level 2 is no longer always a self-assessment. Whether a given contract requires self-assessment or third-party certification is set in the solicitation. Do not assume your next contract will accept a self-score because the last one did.
Self-assessment is not a lighter standard
Some owners treat self-assessment as the easy option. It is not. A Level 2 self-assessment covers the same requirements as a certification assessment, and a senior official must affirm that the company meets them. A false affirmation can expose a company to serious legal and contract consequences. Prepare as if an outside assessor will check your work, because eventually one probably will.
How do you keep your CMMC scope as small as possible?
You keep scope small by isolating CUI into a defined enclave: a limited set of users, devices and cloud services that handle it, separated from the rest of the business.
Scope is the single biggest factor in how much work, time and money CMMC takes. Every system that processes, stores or transmits CUI is in scope, along with the systems that protect those systems. If CUI is scattered across every laptop, every inbox and an old file server in the back room, your entire company is in scope. If CUI lives only in one controlled environment used by a handful of people, the assessment covers much less.
The asset categories assessors look at
- CUI assets: systems that process, store or transmit CUI, such as an engineering workstation or a document library.
- Security protection assets: tools that protect the CUI environment, such as your firewall, endpoint protection, identity system and backup platform. These are in scope even if they never hold a drawing.
- Contractor risk managed assets: systems that can reach CUI but are not intended to, managed under your policies.
- Specialized assets: shop floor machines, test equipment and other operational technology that cannot be secured like a normal computer.
- Out-of-scope assets: systems that cannot process, store or transmit CUI and are properly separated.
For a small Casper fabrication shop, a realistic enclave might be a dedicated cloud tenant built for CUI, a few managed laptops for the people who work with drawings, and a documented process for getting files to the CNC machines on the floor. Everyone else keeps working in the normal business environment.
Watch out
Your IT provider is part of your scope. If an outside company manages the systems that protect CUI, its people, tools and practices are part of what an assessor examines, so ask any provider how it supports CMMC clients before you rely on it.
Get a CMMC readiness starting point
We review your network, devices, accounts and documentation, then send you a plain-English report on the gaps that matter most for Level 2.
What does a CMMC gap assessment involve?
A CMMC gap assessment compares how your company actually handles CUI today against each Level 2 requirement, and produces a list of gaps, owners and fixes before an assessor arrives.
The gap assessment is where most companies discover the size of the job. It is not a scan or a questionnaire you fill out in an afternoon. A useful one looks at policies, settings and evidence, and it ends with a written plan. Here is a practical procedure you can follow, whether you do it in-house or with an IT partner:
How to run a CMMC Level 2 gap assessment
Confirm the required level
Get written confirmation from each defense customer of the CMMC level and assessment type your contracts will require.
Map where CUI flows
Trace how drawings, specifications and other CUI arrive, where they are stored, who opens them and where they go next.
Define your boundary
Decide whether to scope the whole company or build an enclave, and list every asset by category, including security tools and shop floor machines.
Check each requirement
Walk through each Level 2 requirement and record whether it is met, partly met or not met, with the evidence you would show an assessor.
Write the SSP and POA&M
Document how each requirement is met in your System Security Plan, and list every gap with an owner and a target date in your POA&M.
Fix, then re-test
Close the gaps in priority order, starting with MFA, logging and encryption, then re-check before you book a C3PAO assessment.
Two documents come out of this work. The System Security Plan (SSP) describes your CUI environment, its boundaries and how each requirement is met. The Plan of Action and Milestones (POA&M) lists what is not yet in place, who will fix it and by when. CMMC allows a limited use of POA&Ms for certain requirements, with strict rules on what can be deferred and how quickly it must be closed, so treat it as a short bridge, not a parking lot.
What evidence looks like
Assessors want proof, not intentions. For each requirement, plan to show a written policy or procedure, the setting or configuration that enforces it, and a record that it is working. For multi-factor authentication, that means the policy, a screenshot of the enforcement settings and sign-in logs showing it in use. For training, it means the course materials and completion records. A requirement you meet but cannot prove is, for assessment purposes, a requirement you do not meet.
Which security controls trip up small contractors most?
Small contractors most often struggle with multi-factor authentication, logging and monitoring, encryption, incident response, managing outside vendors, and keeping documentation current.
The underlying risks are not theoretical. According to the Verizon 2025 Data Breach Investigations Report, credential abuse (22%) and exploitation of vulnerabilities (20%) were the leading ways attackers got in, and third-party involvement in breaches doubled to 30%. Defense supply chains are exactly the kind of interconnected network those numbers describe.
By the numbers
22%
of breaches began with credential abuse, the leading way attackers got in.
Source: Verizon 2025 DBIR
99.22%
lower risk of account compromise when multi-factor authentication is turned on.
Source: Microsoft Research
The usual gaps
- Multi-factor authentication (MFA): required for local and network access to privileged accounts and for network access to all other accounts in scope. A Microsoft Research study of Azure AD accounts found MFA reduced the risk of account compromise by 99.22%. Many small firms have MFA on email but not on remote access, admin accounts or shared shop computers.
- Logging and monitoring: you need audit logs that record who did what, kept long enough to investigate an incident and actually reviewed. Default settings in many small-business tools fall short.
- Encryption: When encryption protects CUI, for example on laptops, portable drives or data sent over networks, it must use FIPS-validated cryptography. Consumer-grade tools and personal cloud accounts usually do not qualify.
- Cloud services: a cloud provider that stores or processes CUI must meet the FedRAMP Moderate baseline or its equivalent. Standard commercial email and file-sharing plans often do not meet this bar.
- Incident response: you need a written plan, a tested process and the ability to report cyber incidents to the DoD as your contract clauses require.
- Configuration and change control: a documented baseline for each type of device and a record of changes.
- Physical protection: visitor logs, controlled access to areas where CUI is handled, and protection of printed drawings on the shop floor.
“The DBIR’s findings underscore the importance of a multi-layered defense strategy.”
— Chris Novak, Vice President, Global Cybersecurity Solutions, Verizon Business
No single product closes these gaps. CMMC is built on layers: identity, devices, network, data and people, backed by documentation. Our cybersecurity services page describes how those layers fit together for small businesses, and our network management work covers the firewall, segmentation and monitoring pieces that often anchor an enclave.
How long does CMMC readiness take, and what drives the cost?
Readiness typically takes several months for a small company starting from scratch, and cost depends mostly on scope, your current maturity and how much CUI work you do.
No honest provider can quote CMMC readiness without seeing your environment, and you should be wary of anyone who does. What you can understand now is what pushes the effort up or down.
| Cost driver | Pushes effort down | Pushes effort up |
|---|---|---|
| Scope | CUI isolated to a small enclave | CUI spread across every system and inbox |
| Current controls | MFA, patching and managed devices already in place | Shared accounts, unmanaged laptops, no central logging |
| Documentation | Existing policies and an up-to-date asset list | Nothing written down |
| Cloud platform | Already using a service that meets FedRAMP Moderate requirements | Migration needed from a commercial platform |
| Shop floor equipment | Machines isolated with a documented file transfer process | Machines on the main network with direct internet access |
| Staff time | A named internal owner with time set aside | Compliance squeezed into an office manager’s spare hours |
The C3PAO assessment itself is a separate cost from readiness work, and assessor calendars fill up as more contracts require certification. Building in time for scheduling, and for fixing anything the assessor finds, is part of a realistic plan. Our IT guidance and planning service exists for exactly this kind of multi-month roadmap.
Casper tip
Long winters and spread-out sites are part of doing business in Natrona County. Plan installation work, device rollouts and on-site evidence gathering for months when travel between locations is easier.
How do you maintain CMMC compliance after certification?
You stay compliant by running the controls every day, reviewing them on a schedule, keeping your SSP current and affirming compliance each year as the program requires.
Certification is a snapshot. The obligations behind it are continuous. A senior official must affirm ongoing compliance, and that affirmation is only as good as the processes behind it. Build these habits into the calendar:
- Monthly: review security alerts and log summaries, confirm patches were applied, check that backups of the CUI environment completed and that a sample restore works.
- Quarterly: review user access to CUI systems, remove anyone who no longer needs it, and walk through any changes to the enclave.
- Annually: update the SSP, re-run a self-check against every requirement, refresh training and test the incident response plan with a tabletop exercise.
- On every change: new hires, new software, new machines on the floor and new cloud services all need to be assessed against your boundary before they touch CUI.
Remember your other obligations
CMMC sits alongside other rules. If an incident at your company also exposes personal information about Wyoming residents, such as employee records, Wyoming’s breach law (W.S. 40-12-501 and 40-12-502) requires you to notify affected residents in the most expedient time possible and without unreasonable delay. For a broader view of rules that may apply to you, see our compliance support page.
Ongoing compliance is also where a managed IT relationship pays off. Patching, monitoring, access reviews and backup testing are routine work for a managed services provider, and having those records produced consistently makes the annual affirmation far easier to sign with confidence.
What should Wyoming defense contractors do this week and this month?
This week, confirm which contracts require which CMMC level and find where your CUI lives. This month, complete a gap assessment and set a dated plan to close the gaps.
This week
- Email each defense customer and ask what CMMC level and assessment type they will require at your next award or renewal.
- Pull your current contracts and subcontracts and note any DFARS clauses about safeguarding information or CMMC.
- Name one internal owner for CMMC, with real authority and time set aside.
- List where drawings and specifications from customers are stored today, including email and personal devices.
This month
- Decide on a scoping approach: whole company or a CUI enclave.
- Complete a gap assessment against the requirements for your level and start your SSP and POA&M.
- Turn on MFA everywhere it is missing, starting with admin accounts, email and remote access.
- Ask your IT provider, in writing, how it supports clients pursuing CMMC and what it will document for you.
- If you are likely to need a C3PAO, start contacting assessors so you understand their timelines.
Industry context helps too. If you run a shop or fabrication business, our manufacturing IT page covers the equipment and network issues common on the shop floor, and engineering firms can find related guidance on our engineering IT page.
CMIT Solutions of Casper works with small businesses across Casper and Natrona County on the IT side of compliance: assessing where you stand, helping define a manageable scope, putting the technical controls in place and keeping them running through managed services. We do not certify companies; an authorized C3PAO does that. Our job is to help you arrive ready, with your systems and evidence in order. If you would like a starting point, contact our Casper team to talk through an assessment.
Cyber Security Exposed, a short CMIT Solutions video on the cyber risks businesses face (1:42).
Frequently asked questions
When did CMMC Phase 2 start?
CMMC Phase 2 started on November 10, 2026. From that date, contracts that require it can make a Level 2 certification assessment by an authorized C3PAO a condition of award. Phase 1 began a year earlier, on November 10, 2025, with self-assessments. Phase 3 begins November 10, 2027, and full implementation follows on November 10, 2028.
Do subcontractors need CMMC certification?
Yes, if they handle FCI or CUI. CMMC requirements flow down from the prime contractor to subcontractors at every tier, based on the information each one receives. A small Wyoming machine shop that stores a prime’s technical drawings needs the level that matches that information, even if it never contracts with the DoD directly. Ask your customer which level it will require from you.
What is the difference between CMMC Level 1 and Level 2?
Level 1 protects Federal Contract Information with basic safeguarding requirements and an annual self-assessment. Level 2 protects Controlled Unclassified Information using the requirements in NIST SP 800-171, and many Level 2 contracts now require a certification assessment by a C3PAO. Level 2 involves far more documentation, technical controls and evidence than Level 1.
Can my IT provider certify my company for CMMC?
No. Level 2 certification assessments are performed by an authorized C3PAO, and Level 3 assessments are led by the government. An IT provider helps you prepare by scoping, closing gaps and documenting controls. If a provider manages systems that protect your CUI, it becomes part of your assessment scope, so choose one that understands compliance work.
How much does CMMC compliance cost for a small business?
It depends mostly on scope, your current security maturity and your cloud platform. A company with CUI isolated in a small enclave and MFA, patching and managed devices already in place will spend far less than one with CUI on every system. The C3PAO assessment is a separate cost. A gap assessment is the only reliable way to estimate your effort.
Where should a Wyoming defense contractor start with CMMC?
Start by asking each defense customer which CMMC level and assessment type it will require, then map where CUI lives in your company. From there, decide your scope, run a gap assessment and build a dated plan. CMIT Solutions of Casper can help with the IT side; contact our Casper team to talk through an assessment.
Talk to CMIT Solutions of Casper
Local IT support for Casper and Natrona County businesses.
Keep reading
Sources
- Cybersecurity Maturity Model Certification (CMMC) (DoD Chief Information Officer, 2025)
- DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (Federal Register, 2025)
- 2025 Data Breach Investigations Report (Verizon Business, 2025)
- Verizon's 2025 Data Breach Investigations Report: Alarming surge in cyberattacks through third parties (GlobeNewswire, 2025)
- How effective is multifactor authentication at deterring cyberattacks? (Microsoft Research, 2023)
- Wyoming Statutes Title 40 (W.S. 40-12-501 and 40-12-502) (Wyoming Legislature, 2025)
Written by
CMIT Solutions of Casper · Local IT team
We provide managed IT, cybersecurity and IT support for businesses across Casper and Natrona County, backed by the CMIT Solutions national network.