{"id":561,"date":"2026-11-07T04:28:15","date_gmt":"2026-11-07T10:28:15","guid":{"rendered":"https:\/\/cmitsolutions.com\/casper-wy-1157\/?p=561"},"modified":"2026-11-07T04:29:17","modified_gmt":"2026-11-07T10:29:17","slug":"cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/","title":{"rendered":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now"},"content":{"rendered":"<p style=\"font-size:19px;line-height:1.6;border-left:4px solid #E04E3B;padding:4px 0 4px 18px;margin:0 0 24px\"><strong>Quick answer:<\/strong> CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, shrink the scope, run a gap assessment and fix the gaps before an assessment is due.<\/p>\n<div style=\"background:#F4F6F8;border-radius:10px;padding:18px 22px;margin:0 0 24px\">\n<p style=\"margin:0 0 6px;color:#0F3042\"><strong>Key takeaways<\/strong><\/p>\n<ul style=\"margin:0\">\n<li style=\"margin:6px 0\">Since November 10, 2026, applicable contracts can require Level 2 certification by a third-party assessor as a condition of award.<\/li>\n<li style=\"margin:6px 0\">Your CMMC level depends on the information you handle: FCI means Level 1, CUI usually means Level 2.<\/li>\n<li style=\"margin:6px 0\">Keeping CUI in a small, well-defined enclave is the most effective way to reduce cost and effort.<\/li>\n<li style=\"margin:6px 0\">Assessors want evidence for every requirement, so policies, settings and logs matter as much as tools.<\/li>\n<li style=\"margin:6px 0\">Certification is not the finish line; annual affirmations require controls that run every day.<\/li>\n<\/ul>\n<\/div>\n<div style=\"background:#F7F9FB;border:1px solid #DDE3E8;border-top:4px solid #0F3042;border-radius:12px;padding:22px 26px 14px;margin:0 0 32px\">\n<div style=\"display:flex;justify-content:space-between;align-items:baseline;flex-wrap:wrap;gap:6px 16px;margin:0 0 6px\">\n<p style=\"margin:0;color:#0F3042;font-size:21px\"><strong>In this guide<\/strong><\/p>\n<p style=\"margin:0;color:#5B6770;font-size:15px\">12 sections &middot; 18 min read &middot; Updated November 2026<\/p>\n<\/div>\n<div style=\"columns:2 280px;column-gap:36px\">\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">01<\/span><a href=\"#what-changed-when-cmmc-phase-2-started-on-november-10-2026\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">What changed when CMMC Phase 2 started on November 10, 2026?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">02<\/span><a href=\"#does-cmmc-apply-to-your-wyoming-business\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">Does CMMC apply to your Wyoming business?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">03<\/span><a href=\"#which-cmmc-level-do-you-need-level-1-2-or-3\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">Which CMMC level do you need: Level 1, 2 or 3?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">04<\/span><a href=\"#how-do-you-keep-your-cmmc-scope-as-small-as-possible\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">How do you keep your CMMC scope as small as possible?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">05<\/span><a href=\"#what-does-a-cmmc-gap-assessment-involve\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">What does a CMMC gap assessment involve?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">06<\/span><a href=\"#which-security-controls-trip-up-small-contractors-most\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">Which security controls trip up small contractors most?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">07<\/span><a href=\"#how-long-does-cmmc-readiness-take-and-what-drives-the-cost\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">How long does CMMC readiness take, and what drives the cost?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">08<\/span><a href=\"#how-do-you-maintain-cmmc-compliance-after-certification\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">How do you maintain CMMC compliance after certification?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">09<\/span><a href=\"#what-should-wyoming-defense-contractors-do-this-week-and-thi\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">What should Wyoming defense contractors do this week and this month?<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">10<\/span><a href=\"#faq\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">Frequently asked questions<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">11<\/span><a href=\"#keep-reading\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">Keep reading<\/a><\/div>\n<div style=\"display:flex;gap:12px;align-items:baseline;padding:9px 0;border-bottom:1px dashed #DDE3E8\"><span style=\"flex:none;color:#E04E3B;font-weight:700;font-size:15px;min-width:26px\">12<\/span><a href=\"#sources\" style=\"color:#0F3042;text-decoration:none;font-weight:600;font-size:17px;line-height:1.4\">Sources<\/a><\/div>\n<\/div>\n<\/div>\n<p>Picture a machine shop in Casper, an engineering firm in Mills or a small construction contractor that has quietly supplied parts, drawings or services to larger defense companies for years. This fall, the purchase order arrives with a new question attached: what is your CMMC status? For many small suppliers, that email is the moment CMMC compliance, something Wyoming shops have heard about for years, stops being a future problem and becomes a condition of the next contract.<\/p>\n<p>Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program began on November 10, 2026. From that date, contracts that involve Controlled Unclassified Information can require a Level 2 certification from an independent assessor before the award, not a promise to get there later. If your company touches defense work at any tier, the time to act is now, because the work to get ready usually takes longer than people expect.<\/p>\n<p>This guide explains what changed, how to tell which level applies to you, how to keep the scope small, what a gap assessment looks like, which controls trip up small contractors, and what to do this week. It is written for owners and office managers, not security specialists.<\/p>\n<div style=\"background:#F4F6F8;border-left:4px solid #E04E3B;border-radius:8px;padding:16px 20px;margin:28px 0\">\n<p style=\"margin:0 0 6px;color:#0F3042\"><strong>Not sure where your CUI lives?<\/strong><\/p>\n<p style=\"margin:0 0 8px\">Our assessment maps your systems, data and gaps so you can plan your CMMC scope with real information.<\/p>\n<p><a href=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/contact-us\/\" style=\"color:#E04E3B;font-weight:600\">Talk to our Casper team &rarr;<\/a><\/div>\n<h2 id=\"what-changed-when-cmmc-phase-2-started-on-november-10-2026\">What changed when CMMC Phase 2 started on November 10, 2026?<\/h2>\n<p>On November 10, 2026, the Department of Defense began requiring third-party Level 2 certification, performed by an authorized assessor, as a condition of award for applicable contracts. Before that date, most contractors could rely on self-assessments.<\/p>\n<p>CMMC has been rolling out in stages. According to the DoD CIO and the Federal Register, the program rule (32 CFR Part 170) took effect on December 16, 2024. The acquisition rule that puts CMMC into contracts (48 CFR, the DFARS rule) took effect on November 10, 2025, which started Phase 1. In Phase 1, contracting officers could require Level 1 or Level 2 self-assessments as a condition of award. Phase 2 adds the requirement many contractors have been waiting for: a Level 2 certification assessment by a CMMC Third-Party Assessment Organization (C3PAO) for contracts that call for it.<\/p>\n<p>Two more phases follow. Phase 3 begins on November 10, 2027, and Phase 4, full implementation, begins on November 10, 2028. Each phase widens the set of contracts that carry CMMC requirements, so a company that is not asked this year should still expect the question soon.<\/p>\n<div style=\"border:1px solid #DDE3E8;border-radius:10px;padding:16px 20px;margin:22px 0\">\n<p style=\"margin:0 0 4px;color:#E04E3B;font-size:13px;letter-spacing:.08em;text-transform:uppercase\"><strong>Definition<\/strong><\/p>\n<p style=\"margin:0;font-size:18px;line-height:1.55\"><strong style=\"color:#0F3042\">C3PAO:<\/strong> a CMMC Third-Party Assessment Organization, an independent company authorized to conduct Level 2 certification assessments of defense contractors.<\/p>\n<\/div>\n<h3>Why this matters for small suppliers<\/h3>\n<p>Prime contractors are responsible for making sure their subcontractors meet the CMMC level required for the information they handle. That means the pressure rarely comes from the government directly. It comes from the larger company you supply, through flow-down clauses in your subcontract and supplier questionnaires. If you cannot answer, the prime has a simple choice: find a supplier who can.<\/p>\n<p>That is a real business risk in Wyoming, where many small firms rely on a few long-standing customers. Losing one defense customer can mean losing a large share of revenue, and certification is not something you can arrange in a week once the request arrives.<\/p>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-content\/uploads\/sites\/94\/2026\/11\/cmmc-phase-timeline-9.png\" alt=\"CMMC phase timeline from the December 2024 program rule to full implementation in November 2028\"><\/figure>\n<h2 id=\"does-cmmc-apply-to-your-wyoming-business\">Does CMMC apply to your Wyoming business?<\/h2>\n<p>CMMC applies if your company handles Federal Contract Information or Controlled Unclassified Information under a Department of Defense contract or subcontract, at any tier. Selling only commercial off-the-shelf products is generally exempt.<\/p>\n<p>The level you need depends on the kind of information that flows to you, not on your size or how much defense work you do. Two terms matter:<\/p>\n<ul>\n<li><strong>Federal Contract Information (FCI)<\/strong> is information provided by or generated for the government under a contract that is not intended for public release. Order details, delivery schedules and contract correspondence often qualify.<\/li>\n<li><strong>Controlled Unclassified Information (CUI)<\/strong> is sensitive government information that requires safeguarding, such as technical drawings, specifications, test data or export-controlled details. CUI is usually marked, but not always, which is one reason scoping takes care.<\/li>\n<\/ul>\n<div style=\"border:1px solid #DDE3E8;border-radius:10px;padding:16px 20px;margin:22px 0\">\n<p style=\"margin:0 0 4px;color:#E04E3B;font-size:13px;letter-spacing:.08em;text-transform:uppercase\"><strong>Definition<\/strong><\/p>\n<p style=\"margin:0;font-size:18px;line-height:1.55\"><strong style=\"color:#0F3042\">Controlled Unclassified Information (CUI):<\/strong> sensitive government information, such as technical drawings or specifications, that is not classified but must be safeguarded under federal rules.<\/p>\n<\/div>\n<p>In practice, Wyoming companies that often fall into scope include machine and fabrication shops building parts to government drawings, engineering and surveying firms working on federal facilities, construction contractors on defense projects, IT and logistics providers that support primes, and energy-sector service companies with a federal customer. If you receive drawings or specifications from a prime and store them on your file server, in email or in a cloud folder, you very likely handle CUI.<\/p>\n<h3>Questions to answer before anything else<\/h3>\n<ol>\n<li>Which of your current contracts or subcontracts include the DFARS clauses that reference CMMC or safeguarding covered defense information?<\/li>\n<li>What information do you receive from customers, and is any of it marked CUI or export controlled?<\/li>\n<li>Where does that information land: email, a shared drive, laptops, a shop floor computer, a USB drive?<\/li>\n<li>Who in your company can open it, and who outside your company (vendors, IT providers, cloud services) can reach it?<\/li>\n<\/ol>\n<div style=\"background:#EEF4F8;border-left:4px solid #0F3042;border-radius:8px;padding:16px 20px;margin:24px 0\">\n<p style=\"margin:0 0 6px;color:#E04E3B;font-size:13px;letter-spacing:.08em;text-transform:uppercase\"><strong>Quick check<\/strong><\/p>\n<p style=\"margin:0\">Ask your largest defense customer which CMMC level it will require from you at your next renewal, and get the answer in writing. That single email shapes the rest of your plan.<\/p>\n<\/div>\n<h2 id=\"which-cmmc-level-do-you-need-level-1-2-or-3\">Which CMMC level do you need: Level 1, 2 or 3?<\/h2>\n<p>You need Level 1 if you handle only FCI, Level 2 if you handle CUI, and Level 3 only for a small set of high-priority programs that the DoD designates.<\/p>\n<p>Most small Wyoming suppliers that handle drawings or technical data will land at Level 2. The table below summarizes how the levels differ.<\/p>\n<table style=\"width:100%;border-collapse:collapse;margin:24px 0;font-size:16px;line-height:1.45\">\n<thead>\n<tr>\n<th style=\"text-align:left;vertical-align:bottom;background:#F4F6F8;color:#0F3042;padding:10px 12px;border-bottom:2px solid #0F3042\">Level<\/th>\n<th style=\"text-align:left;vertical-align:bottom;background:#F4F6F8;color:#0F3042;padding:10px 12px;border-bottom:2px solid #0F3042\">Information protected<\/th>\n<th style=\"text-align:left;vertical-align:bottom;background:#F4F6F8;color:#0F3042;padding:10px 12px;border-bottom:2px solid #0F3042\">Security basis<\/th>\n<th style=\"text-align:left;vertical-align:bottom;background:#F4F6F8;color:#0F3042;padding:10px 12px;border-bottom:2px solid #0F3042\">Who assesses<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Level 1 (Foundational)<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Federal Contract Information only<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Basic safeguarding requirements in FAR 52.204-21<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Annual self-assessment with an affirmation by a company official<\/td>\n<\/tr>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Level 2 (Advanced)<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Controlled Unclassified Information<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">The security requirements in NIST SP 800-171<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Self-assessment for some contracts; a C3PAO certification assessment for contracts that require it, starting in Phase 2<\/td>\n<\/tr>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Level 3 (Expert)<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">CUI in the highest-priority programs<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Level 2 plus selected requirements from NIST SP 800-172<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Government-led assessment, after Level 2 certification<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The key point for Phase 2 is that Level 2 is no longer always a self-assessment. Whether a given contract requires self-assessment or third-party certification is set in the solicitation. Do not assume your next contract will accept a self-score because the last one did.<\/p>\n<h3>Self-assessment is not a lighter standard<\/h3>\n<p>Some owners treat self-assessment as the easy option. It is not. A Level 2 self-assessment covers the same requirements as a certification assessment, and a senior official must affirm that the company meets them. A false affirmation can expose a company to serious legal and contract consequences. Prepare as if an outside assessor will check your work, because eventually one probably will.<\/p>\n<h2 id=\"how-do-you-keep-your-cmmc-scope-as-small-as-possible\">How do you keep your CMMC scope as small as possible?<\/h2>\n<p>You keep scope small by isolating CUI into a defined enclave: a limited set of users, devices and cloud services that handle it, separated from the rest of the business.<\/p>\n<p>Scope is the single biggest factor in how much work, time and money CMMC takes. Every system that processes, stores or transmits CUI is in scope, along with the systems that protect those systems. If CUI is scattered across every laptop, every inbox and an old file server in the back room, your entire company is in scope. If CUI lives only in one controlled environment used by a handful of people, the assessment covers much less.<\/p>\n<h3>The asset categories assessors look at<\/h3>\n<ul>\n<li><strong>CUI assets:<\/strong> systems that process, store or transmit CUI, such as an engineering workstation or a document library.<\/li>\n<li><strong>Security protection assets:<\/strong> tools that protect the CUI environment, such as your firewall, endpoint protection, identity system and backup platform. These are in scope even if they never hold a drawing.<\/li>\n<li><strong>Contractor risk managed assets:<\/strong> systems that can reach CUI but are not intended to, managed under your policies.<\/li>\n<li><strong>Specialized assets:<\/strong> shop floor machines, test equipment and other operational technology that cannot be secured like a normal computer.<\/li>\n<li><strong>Out-of-scope assets:<\/strong> systems that cannot process, store or transmit CUI and are properly separated.<\/li>\n<\/ul>\n<p>For a small Casper fabrication shop, a realistic enclave might be a dedicated cloud tenant built for CUI, a few managed laptops for the people who work with drawings, and a documented process for getting files to the CNC machines on the floor. Everyone else keeps working in the normal business environment.<\/p>\n<div style=\"background:#EEF4F8;border-left:4px solid #0F3042;border-radius:8px;padding:16px 20px;margin:24px 0\">\n<p style=\"margin:0 0 6px;color:#E04E3B;font-size:13px;letter-spacing:.08em;text-transform:uppercase\"><strong>Watch out<\/strong><\/p>\n<p style=\"margin:0\">Your IT provider is part of your scope. If an outside company manages the systems that protect CUI, its people, tools and practices are part of what an assessor examines, so ask any provider how it supports CMMC clients before you rely on it.<\/p>\n<\/div>\n<div style=\"background:#0F3042;color:#ffffff;border-radius:12px;padding:26px 28px;margin:32px 0\">\n<p style=\"color:#ffffff;font-size:20px;margin:0 0 8px\"><strong>Get a CMMC readiness starting point<\/strong><\/p>\n<p style=\"color:#ffffff;margin:0 0 16px\">We review your network, devices, accounts and documentation, then send you a plain-English report on the gaps that matter most for Level 2.<\/p>\n<p><a href=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/contact-us\/\" style=\"display:inline-block;background:#E04E3B;color:#ffffff;padding:12px 22px;border-radius:8px;text-decoration:none;font-weight:600\">Book my free assessment<\/a><\/div>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-content\/uploads\/sites\/94\/2026\/11\/whole-company-vs-enclave-9.png\" alt=\"Comparison of whole-company CMMC scope versus a CUI enclave for a small defense contractor\"><\/figure>\n<h2 id=\"what-does-a-cmmc-gap-assessment-involve\">What does a CMMC gap assessment involve?<\/h2>\n<p>A CMMC gap assessment compares how your company actually handles CUI today against each Level 2 requirement, and produces a list of gaps, owners and fixes before an assessor arrives.<\/p>\n<p>The gap assessment is where most companies discover the size of the job. It is not a scan or a questionnaire you fill out in an afternoon. A useful one looks at policies, settings and evidence, and it ends with a written plan. Here is a practical procedure you can follow, whether you do it in-house or with an IT partner:<\/p>\n<h3 style=\"font-size:24px;margin:28px 0 12px\">How to run a CMMC Level 2 gap assessment<\/h3>\n<div style=\"display:flex;gap:16px;align-items:flex-start;background:#ffffff;border:1px solid #E3E8EE;border-radius:10px;padding:16px 18px;margin:0 0 12px\"><span style=\"flex:none;width:36px;height:36px;border-radius:50%;background:#0F3042;color:#ffffff;text-align:center;line-height:36px;font-weight:700;font-size:16px\">1<\/span><\/p>\n<div>\n<p style=\"margin:0 0 4px;color:#0F3042;font-size:19px;line-height:1.35\"><strong>Confirm the required level<\/strong><\/p>\n<p style=\"margin:0;font-size:17px;line-height:1.55\">Get written confirmation from each defense customer of the CMMC level and assessment type your contracts will require.<\/p>\n<\/div>\n<\/div>\n<div style=\"display:flex;gap:16px;align-items:flex-start;background:#ffffff;border:1px solid #E3E8EE;border-radius:10px;padding:16px 18px;margin:0 0 12px\"><span style=\"flex:none;width:36px;height:36px;border-radius:50%;background:#0F3042;color:#ffffff;text-align:center;line-height:36px;font-weight:700;font-size:16px\">2<\/span><\/p>\n<div>\n<p style=\"margin:0 0 4px;color:#0F3042;font-size:19px;line-height:1.35\"><strong>Map where CUI flows<\/strong><\/p>\n<p style=\"margin:0;font-size:17px;line-height:1.55\">Trace how drawings, specifications and other CUI arrive, where they are stored, who opens them and where they go next.<\/p>\n<\/div>\n<\/div>\n<div style=\"display:flex;gap:16px;align-items:flex-start;background:#ffffff;border:1px solid #E3E8EE;border-radius:10px;padding:16px 18px;margin:0 0 12px\"><span style=\"flex:none;width:36px;height:36px;border-radius:50%;background:#0F3042;color:#ffffff;text-align:center;line-height:36px;font-weight:700;font-size:16px\">3<\/span><\/p>\n<div>\n<p style=\"margin:0 0 4px;color:#0F3042;font-size:19px;line-height:1.35\"><strong>Define your boundary<\/strong><\/p>\n<p style=\"margin:0;font-size:17px;line-height:1.55\">Decide whether to scope the whole company or build an enclave, and list every asset by category, including security tools and shop floor machines.<\/p>\n<\/div>\n<\/div>\n<div style=\"display:flex;gap:16px;align-items:flex-start;background:#ffffff;border:1px solid #E3E8EE;border-radius:10px;padding:16px 18px;margin:0 0 12px\"><span style=\"flex:none;width:36px;height:36px;border-radius:50%;background:#0F3042;color:#ffffff;text-align:center;line-height:36px;font-weight:700;font-size:16px\">4<\/span><\/p>\n<div>\n<p style=\"margin:0 0 4px;color:#0F3042;font-size:19px;line-height:1.35\"><strong>Check each requirement<\/strong><\/p>\n<p style=\"margin:0;font-size:17px;line-height:1.55\">Walk through each Level 2 requirement and record whether it is met, partly met or not met, with the evidence you would show an assessor.<\/p>\n<\/div>\n<\/div>\n<div style=\"display:flex;gap:16px;align-items:flex-start;background:#ffffff;border:1px solid #E3E8EE;border-radius:10px;padding:16px 18px;margin:0 0 12px\"><span style=\"flex:none;width:36px;height:36px;border-radius:50%;background:#0F3042;color:#ffffff;text-align:center;line-height:36px;font-weight:700;font-size:16px\">5<\/span><\/p>\n<div>\n<p style=\"margin:0 0 4px;color:#0F3042;font-size:19px;line-height:1.35\"><strong>Write the SSP and POA&amp;M<\/strong><\/p>\n<p style=\"margin:0;font-size:17px;line-height:1.55\">Document how each requirement is met in your System Security Plan, and list every gap with an owner and a target date in your POA&amp;M.<\/p>\n<\/div>\n<\/div>\n<div style=\"display:flex;gap:16px;align-items:flex-start;background:#ffffff;border:1px solid #E3E8EE;border-radius:10px;padding:16px 18px;margin:0 0 12px\"><span style=\"flex:none;width:36px;height:36px;border-radius:50%;background:#0F3042;color:#ffffff;text-align:center;line-height:36px;font-weight:700;font-size:16px\">6<\/span><\/p>\n<div>\n<p style=\"margin:0 0 4px;color:#0F3042;font-size:19px;line-height:1.35\"><strong>Fix, then re-test<\/strong><\/p>\n<p style=\"margin:0;font-size:17px;line-height:1.55\">Close the gaps in priority order, starting with MFA, logging and encryption, then re-check before you book a C3PAO assessment.<\/p>\n<\/div>\n<\/div>\n<p>Two documents come out of this work. The <strong>System Security Plan (SSP)<\/strong> describes your CUI environment, its boundaries and how each requirement is met. The <strong>Plan of Action and Milestones (POA&amp;M)<\/strong> lists what is not yet in place, who will fix it and by when. CMMC allows a limited use of POA&amp;Ms for certain requirements, with strict rules on what can be deferred and how quickly it must be closed, so treat it as a short bridge, not a parking lot.<\/p>\n<h3>What evidence looks like<\/h3>\n<p>Assessors want proof, not intentions. For each requirement, plan to show a written policy or procedure, the setting or configuration that enforces it, and a record that it is working. For multi-factor authentication, that means the policy, a screenshot of the enforcement settings and sign-in logs showing it in use. For training, it means the course materials and completion records. A requirement you meet but cannot prove is, for assessment purposes, a requirement you do not meet.<\/p>\n<h2 id=\"which-security-controls-trip-up-small-contractors-most\">Which security controls trip up small contractors most?<\/h2>\n<p>Small contractors most often struggle with multi-factor authentication, logging and monitoring, encryption, incident response, managing outside vendors, and keeping documentation current.<\/p>\n<p>The underlying risks are not theoretical. According to the Verizon 2025 Data Breach Investigations Report, credential abuse (22%) and exploitation of vulnerabilities (20%) were the leading ways attackers got in, and third-party involvement in breaches doubled to 30%. Defense supply chains are exactly the kind of interconnected network those numbers describe.<\/p>\n<div style=\"background:#F4F6F8;border-radius:12px;padding:18px 20px 20px;margin:28px 0\">\n<p style=\"margin:0 0 12px;color:#0F3042;font-size:13px;letter-spacing:.08em;text-transform:uppercase\"><strong>By the numbers<\/strong><\/p>\n<div style=\"display:flex;flex-wrap:wrap;gap:12px\">\n<div style=\"flex:1 1 200px;background:#ffffff;border:1px solid #DDE3E8;border-top:4px solid #E04E3B;border-radius:10px;padding:16px 18px\">\n<p style=\"margin:0;color:#0F3042;font-size:34px;line-height:1.1\"><strong>30%<\/strong><\/p>\n<p style=\"margin:8px 0 8px;font-size:16px;line-height:1.45\">of breaches involved a third party, double the previous year.<\/p>\n<p style=\"margin:0;color:#5B6770;font-size:13px\">Source: <a href=\"https:\/\/www.verizon.com\/business\/resources\/reports\/dbir\/\" style=\"color:#5B6770\">Verizon 2025 DBIR<\/a><\/p>\n<\/div>\n<div style=\"flex:1 1 200px;background:#ffffff;border:1px solid #DDE3E8;border-top:4px solid #E04E3B;border-radius:10px;padding:16px 18px\">\n<p style=\"margin:0;color:#0F3042;font-size:34px;line-height:1.1\"><strong>22%<\/strong><\/p>\n<p style=\"margin:8px 0 8px;font-size:16px;line-height:1.45\">of breaches began with credential abuse, the leading way attackers got in.<\/p>\n<p style=\"margin:0;color:#5B6770;font-size:13px\">Source: <a href=\"https:\/\/www.verizon.com\/business\/resources\/reports\/dbir\/\" style=\"color:#5B6770\">Verizon 2025 DBIR<\/a><\/p>\n<\/div>\n<div style=\"flex:1 1 200px;background:#ffffff;border:1px solid #DDE3E8;border-top:4px solid #E04E3B;border-radius:10px;padding:16px 18px\">\n<p style=\"margin:0;color:#0F3042;font-size:34px;line-height:1.1\"><strong>99.22%<\/strong><\/p>\n<p style=\"margin:8px 0 8px;font-size:16px;line-height:1.45\">lower risk of account compromise when multi-factor authentication is turned on.<\/p>\n<p style=\"margin:0;color:#5B6770;font-size:13px\">Source: <a href=\"https:\/\/www.microsoft.com\/en-us\/research\/publication\/how-effective-is-multifactor-authentication-at-deterring-cyberattacks\/\" style=\"color:#5B6770\">Microsoft Research<\/a><\/p>\n<\/div>\n<\/div>\n<\/div>\n<h3>The usual gaps<\/h3>\n<ul>\n<li><strong>Multi-factor authentication (MFA):<\/strong> required for local and network access to privileged accounts and for network access to all other accounts in scope. A Microsoft Research study of Azure AD accounts found MFA reduced the risk of account compromise by 99.22%. Many small firms have MFA on email but not on remote access, admin accounts or shared shop computers.<\/li>\n<li><strong>Logging and monitoring:<\/strong> you need audit logs that record who did what, kept long enough to investigate an incident and actually reviewed. Default settings in many small-business tools fall short.<\/li>\n<li><strong>Encryption:<\/strong> When encryption protects CUI, for example on laptops, portable drives or data sent over networks, it must use FIPS-validated cryptography. Consumer-grade tools and personal cloud accounts usually do not qualify.<\/li>\n<li><strong>Cloud services:<\/strong> a cloud provider that stores or processes CUI must meet the FedRAMP Moderate baseline or its equivalent. Standard commercial email and file-sharing plans often do not meet this bar.<\/li>\n<li><strong>Incident response:<\/strong> you need a written plan, a tested process and the ability to report cyber incidents to the DoD as your contract clauses require.<\/li>\n<li><strong>Configuration and change control:<\/strong> a documented baseline for each type of device and a record of changes.<\/li>\n<li><strong>Physical protection:<\/strong> visitor logs, controlled access to areas where CUI is handled, and protection of printed drawings on the shop floor.<\/li>\n<\/ul>\n<blockquote style=\"border:none;border-left:4px solid #E04E3B;background:#ffffff;margin:28px 0;padding:6px 0 6px 22px\">\n<p style=\"margin:0 0 10px;color:#0F3042;font-size:22px;line-height:1.45;font-style:normal\">&ldquo;The DBIR&#8217;s findings underscore the importance of a multi-layered defense strategy.&rdquo;<\/p>\n<p style=\"margin:0;color:#5B6770;font-size:15px;font-style:normal\">&mdash; <a href=\"https:\/\/www.globenewswire.com\/news-release\/2025\/04\/23\/3066121\/0\/en\/Verizon-s-2025-Data-Breach-Investigations-Report-Alarming-surge-in-cyberattacks-through-third-parties.html\" style=\"color:#5B6770;text-decoration:none\"><strong>Chris Novak<\/strong>, Vice President, Global Cybersecurity Solutions, Verizon Business<\/a><\/p>\n<\/blockquote>\n<p>No single product closes these gaps. CMMC is built on layers: identity, devices, network, data and people, backed by documentation. Our <a href=\"https:\/\/cmitsolutions.com\/it-services\/cybersecurity\/\">cybersecurity services<\/a> page describes how those layers fit together for small businesses, and our <a href=\"https:\/\/cmitsolutions.com\/it-services\/network-management\/\">network management<\/a> work covers the firewall, segmentation and monitoring pieces that often anchor an enclave.<\/p>\n<h2 id=\"how-long-does-cmmc-readiness-take-and-what-drives-the-cost\">How long does CMMC readiness take, and what drives the cost?<\/h2>\n<p>Readiness typically takes several months for a small company starting from scratch, and cost depends mostly on scope, your current maturity and how much CUI work you do.<\/p>\n<p>No honest provider can quote CMMC readiness without seeing your environment, and you should be wary of anyone who does. What you can understand now is what pushes the effort up or down.<\/p>\n<table style=\"width:100%;border-collapse:collapse;margin:24px 0;font-size:16px;line-height:1.45\">\n<thead>\n<tr>\n<th style=\"text-align:left;vertical-align:bottom;background:#F4F6F8;color:#0F3042;padding:10px 12px;border-bottom:2px solid #0F3042\">Cost driver<\/th>\n<th style=\"text-align:left;vertical-align:bottom;background:#F4F6F8;color:#0F3042;padding:10px 12px;border-bottom:2px solid #0F3042\">Pushes effort down<\/th>\n<th style=\"text-align:left;vertical-align:bottom;background:#F4F6F8;color:#0F3042;padding:10px 12px;border-bottom:2px solid #0F3042\">Pushes effort up<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Scope<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">CUI isolated to a small enclave<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">CUI spread across every system and inbox<\/td>\n<\/tr>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Current controls<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">MFA, patching and managed devices already in place<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Shared accounts, unmanaged laptops, no central logging<\/td>\n<\/tr>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Documentation<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Existing policies and an up-to-date asset list<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Nothing written down<\/td>\n<\/tr>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Cloud platform<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Already using a service that meets FedRAMP Moderate requirements<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Migration needed from a commercial platform<\/td>\n<\/tr>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Shop floor equipment<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Machines isolated with a documented file transfer process<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Machines on the main network with direct internet access<\/td>\n<\/tr>\n<tr>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\"><strong>Staff time<\/strong><\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">A named internal owner with time set aside<\/td>\n<td style=\"vertical-align:top;padding:10px 12px;border-bottom:1px solid #DDE3E8\">Compliance squeezed into an office manager&#8217;s spare hours<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The C3PAO assessment itself is a separate cost from readiness work, and assessor calendars fill up as more contracts require certification. Building in time for scheduling, and for fixing anything the assessor finds, is part of a realistic plan. Our <a href=\"https:\/\/cmitsolutions.com\/it-services\/it-guidance\/\">IT guidance and planning<\/a> service exists for exactly this kind of multi-month roadmap.<\/p>\n<div style=\"background:#EEF4F8;border-left:4px solid #0F3042;border-radius:8px;padding:16px 20px;margin:24px 0\">\n<p style=\"margin:0 0 6px;color:#E04E3B;font-size:13px;letter-spacing:.08em;text-transform:uppercase\"><strong>Casper tip<\/strong><\/p>\n<p style=\"margin:0\">Long winters and spread-out sites are part of doing business in Natrona County. Plan installation work, device rollouts and on-site evidence gathering for months when travel between locations is easier.<\/p>\n<\/div>\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-content\/uploads\/sites\/94\/2026\/11\/cmmc-readiness-steps-9.png\" alt=\"Five steps to CMMC Level 2 readiness for a small Wyoming defense supplier\"><\/figure>\n<h2 id=\"how-do-you-maintain-cmmc-compliance-after-certification\">How do you maintain CMMC compliance after certification?<\/h2>\n<p>You stay compliant by running the controls every day, reviewing them on a schedule, keeping your SSP current and affirming compliance each year as the program requires.<\/p>\n<p>Certification is a snapshot. The obligations behind it are continuous. A senior official must affirm ongoing compliance, and that affirmation is only as good as the processes behind it. Build these habits into the calendar:<\/p>\n<ul>\n<li><strong>Monthly:<\/strong> review security alerts and log summaries, confirm patches were applied, check that backups of the CUI environment completed and that a sample restore works.<\/li>\n<li><strong>Quarterly:<\/strong> review user access to CUI systems, remove anyone who no longer needs it, and walk through any changes to the enclave.<\/li>\n<li><strong>Annually:<\/strong> update the SSP, re-run a self-check against every requirement, refresh training and test the incident response plan with a tabletop exercise.<\/li>\n<li><strong>On every change:<\/strong> new hires, new software, new machines on the floor and new cloud services all need to be assessed against your boundary before they touch CUI.<\/li>\n<\/ul>\n<h3>Remember your other obligations<\/h3>\n<p>CMMC sits alongside other rules. If an incident at your company also exposes personal information about Wyoming residents, such as employee records, Wyoming&#8217;s breach law (W.S. 40-12-501 and 40-12-502) requires you to notify affected residents in the most expedient time possible and without unreasonable delay. For a broader view of rules that may apply to you, see our <a href=\"https:\/\/cmitsolutions.com\/it-services\/compliance\/\">compliance support<\/a> page.<\/p>\n<p>Ongoing compliance is also where a managed IT relationship pays off. Patching, monitoring, access reviews and backup testing are routine work for a <a href=\"https:\/\/cmitsolutions.com\/it-services\/managed-services\/\">managed services<\/a> provider, and having those records produced consistently makes the annual affirmation far easier to sign with confidence.<\/p>\n<h2 id=\"what-should-wyoming-defense-contractors-do-this-week-and-thi\">What should Wyoming defense contractors do this week and this month?<\/h2>\n<p>This week, confirm which contracts require which CMMC level and find where your CUI lives. This month, complete a gap assessment and set a dated plan to close the gaps.<\/p>\n<h3>This week<\/h3>\n<ul>\n<li>Email each defense customer and ask what CMMC level and assessment type they will require at your next award or renewal.<\/li>\n<li>Pull your current contracts and subcontracts and note any DFARS clauses about safeguarding information or CMMC.<\/li>\n<li>Name one internal owner for CMMC, with real authority and time set aside.<\/li>\n<li>List where drawings and specifications from customers are stored today, including email and personal devices.<\/li>\n<\/ul>\n<h3>This month<\/h3>\n<ul>\n<li>Decide on a scoping approach: whole company or a CUI enclave.<\/li>\n<li>Complete a gap assessment against the requirements for your level and start your SSP and POA&amp;M.<\/li>\n<li>Turn on MFA everywhere it is missing, starting with admin accounts, email and remote access.<\/li>\n<li>Ask your IT provider, in writing, how it supports clients pursuing CMMC and what it will document for you.<\/li>\n<li>If you are likely to need a C3PAO, start contacting assessors so you understand their timelines.<\/li>\n<\/ul>\n<p>Industry context helps too. If you run a shop or fabrication business, our <a href=\"https:\/\/cmitsolutions.com\/industries\/manufacturing\/\">manufacturing IT<\/a> page covers the equipment and network issues common on the shop floor, and engineering firms can find related guidance on our <a href=\"https:\/\/cmitsolutions.com\/industries\/engineering\/\">engineering IT<\/a> page.<\/p>\n<p>CMIT Solutions of Casper works with small businesses across Casper and Natrona County on the IT side of compliance: assessing where you stand, helping define a manageable scope, putting the technical controls in place and keeping them running through managed services. We do not certify companies; an authorized C3PAO does that. Our job is to help you arrive ready, with your systems and evidence in order. If you would like a starting point, <a href=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/contact-us\/\">contact our Casper team<\/a> to talk through an assessment.<\/p>\n<div style=\"max-width:872px;margin:28px auto 8px;text-align:center\">\n<iframe title=\"Cyber Security Exposed!\" width=\"872\" height=\"491\" src=\"https:\/\/www.youtube.com\/embed\/XBuXGUv1g6Q?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div>\n<p style=\"font-size:15px;color:#5B6770;text-align:center;margin:0 0 28px\">Cyber Security Exposed, a short CMIT Solutions video on the cyber risks businesses face (1:42).<\/p>\n<h2 id=\"faq\">Frequently asked questions<\/h2>\n<div style=\"margin:18px 0 28px\">\n<details style=\"background:#ffffff;border:1px solid #E3E8EE;border-radius:6px;box-shadow:3px 3px 0 #E3E8EE;margin:0 0 12px\">\n<summary style=\"cursor:pointer;display:flex;align-items:center;gap:14px;padding:18px 20px;color:#0F3042;font-size:20px;font-weight:600;line-height:1.4\"><span aria-hidden=\"true\" style=\"flex:none;display:inline-block;width:24px;height:24px;border:2px solid #E04E3B;border-radius:50%;color:#E04E3B;text-align:center;font-size:19px;line-height:21px;font-weight:700\">+<\/span><span>When did CMMC Phase 2 start?<\/span><\/summary>\n<div style=\"padding:0 20px 16px 58px;font-size:18px;line-height:1.6\">\n<p style=\"margin:0 0 10px;font-size:18px;line-height:1.6\">CMMC Phase 2 started on November 10, 2026. From that date, contracts that require it can make a Level 2 certification assessment by an authorized C3PAO a condition of award. Phase 1 began a year earlier, on November 10, 2025, with self-assessments. Phase 3 begins November 10, 2027, and full implementation follows on November 10, 2028.<\/p>\n<\/div>\n<\/details>\n<details style=\"background:#ffffff;border:1px solid #E3E8EE;border-radius:6px;box-shadow:3px 3px 0 #E3E8EE;margin:0 0 12px\">\n<summary style=\"cursor:pointer;display:flex;align-items:center;gap:14px;padding:18px 20px;color:#0F3042;font-size:20px;font-weight:600;line-height:1.4\"><span aria-hidden=\"true\" style=\"flex:none;display:inline-block;width:24px;height:24px;border:2px solid #E04E3B;border-radius:50%;color:#E04E3B;text-align:center;font-size:19px;line-height:21px;font-weight:700\">+<\/span><span>Do subcontractors need CMMC certification?<\/span><\/summary>\n<div style=\"padding:0 20px 16px 58px;font-size:18px;line-height:1.6\">\n<p style=\"margin:0 0 10px;font-size:18px;line-height:1.6\">Yes, if they handle FCI or CUI. CMMC requirements flow down from the prime contractor to subcontractors at every tier, based on the information each one receives. A small Wyoming machine shop that stores a prime&#8217;s technical drawings needs the level that matches that information, even if it never contracts with the DoD directly. Ask your customer which level it will require from you.<\/p>\n<\/div>\n<\/details>\n<details style=\"background:#ffffff;border:1px solid #E3E8EE;border-radius:6px;box-shadow:3px 3px 0 #E3E8EE;margin:0 0 12px\">\n<summary style=\"cursor:pointer;display:flex;align-items:center;gap:14px;padding:18px 20px;color:#0F3042;font-size:20px;font-weight:600;line-height:1.4\"><span aria-hidden=\"true\" style=\"flex:none;display:inline-block;width:24px;height:24px;border:2px solid #E04E3B;border-radius:50%;color:#E04E3B;text-align:center;font-size:19px;line-height:21px;font-weight:700\">+<\/span><span>What is the difference between CMMC Level 1 and Level 2?<\/span><\/summary>\n<div style=\"padding:0 20px 16px 58px;font-size:18px;line-height:1.6\">\n<p style=\"margin:0 0 10px;font-size:18px;line-height:1.6\">Level 1 protects Federal Contract Information with basic safeguarding requirements and an annual self-assessment. Level 2 protects Controlled Unclassified Information using the requirements in NIST SP 800-171, and many Level 2 contracts now require a certification assessment by a C3PAO. Level 2 involves far more documentation, technical controls and evidence than Level 1.<\/p>\n<\/div>\n<\/details>\n<details style=\"background:#ffffff;border:1px solid #E3E8EE;border-radius:6px;box-shadow:3px 3px 0 #E3E8EE;margin:0 0 12px\">\n<summary style=\"cursor:pointer;display:flex;align-items:center;gap:14px;padding:18px 20px;color:#0F3042;font-size:20px;font-weight:600;line-height:1.4\"><span aria-hidden=\"true\" style=\"flex:none;display:inline-block;width:24px;height:24px;border:2px solid #E04E3B;border-radius:50%;color:#E04E3B;text-align:center;font-size:19px;line-height:21px;font-weight:700\">+<\/span><span>Can my IT provider certify my company for CMMC?<\/span><\/summary>\n<div style=\"padding:0 20px 16px 58px;font-size:18px;line-height:1.6\">\n<p style=\"margin:0 0 10px;font-size:18px;line-height:1.6\">No. Level 2 certification assessments are performed by an authorized C3PAO, and Level 3 assessments are led by the government. An IT provider helps you prepare by scoping, closing gaps and documenting controls. If a provider manages systems that protect your CUI, it becomes part of your assessment scope, so choose one that understands <a href=\"https:\/\/cmitsolutions.com\/it-services\/compliance\/\">compliance work<\/a>.<\/p>\n<\/div>\n<\/details>\n<details style=\"background:#ffffff;border:1px solid #E3E8EE;border-radius:6px;box-shadow:3px 3px 0 #E3E8EE;margin:0 0 12px\">\n<summary style=\"cursor:pointer;display:flex;align-items:center;gap:14px;padding:18px 20px;color:#0F3042;font-size:20px;font-weight:600;line-height:1.4\"><span aria-hidden=\"true\" style=\"flex:none;display:inline-block;width:24px;height:24px;border:2px solid #E04E3B;border-radius:50%;color:#E04E3B;text-align:center;font-size:19px;line-height:21px;font-weight:700\">+<\/span><span>How much does CMMC compliance cost for a small business?<\/span><\/summary>\n<div style=\"padding:0 20px 16px 58px;font-size:18px;line-height:1.6\">\n<p style=\"margin:0 0 10px;font-size:18px;line-height:1.6\">It depends mostly on scope, your current security maturity and your cloud platform. A company with CUI isolated in a small enclave and MFA, patching and managed devices already in place will spend far less than one with CUI on every system. The C3PAO assessment is a separate cost. A gap assessment is the only reliable way to estimate your effort.<\/p>\n<\/div>\n<\/details>\n<details style=\"background:#ffffff;border:1px solid #E3E8EE;border-radius:6px;box-shadow:3px 3px 0 #E3E8EE;margin:0 0 12px\">\n<summary style=\"cursor:pointer;display:flex;align-items:center;gap:14px;padding:18px 20px;color:#0F3042;font-size:20px;font-weight:600;line-height:1.4\"><span aria-hidden=\"true\" style=\"flex:none;display:inline-block;width:24px;height:24px;border:2px solid #E04E3B;border-radius:50%;color:#E04E3B;text-align:center;font-size:19px;line-height:21px;font-weight:700\">+<\/span><span>Where should a Wyoming defense contractor start with CMMC?<\/span><\/summary>\n<div style=\"padding:0 20px 16px 58px;font-size:18px;line-height:1.6\">\n<p style=\"margin:0 0 10px;font-size:18px;line-height:1.6\">Start by asking each defense customer which CMMC level and assessment type it will require, then map where CUI lives in your company. From there, decide your scope, run a gap assessment and build a dated plan. CMIT Solutions of Casper can help with the IT side; <a href=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/contact-us\/\">contact our Casper team<\/a> to talk through an assessment.<\/p>\n<\/div>\n<\/details>\n<\/div>\n<div style=\"background:#0F3042;color:#ffffff;border-radius:12px;padding:26px 28px;margin:32px 0;text-align:center\">\n<p style=\"color:#ffffff;font-size:24px;margin:0 0 8px\"><strong>Talk to CMIT Solutions of Casper<\/strong><\/p>\n<p style=\"color:#ffffff;margin:0 0 16px\">Local IT support for Casper and Natrona County businesses.<\/p>\n<p><a href=\"tel:+13072158800\" style=\"display:inline-block;background:#E04E3B;color:#ffffff;padding:12px 22px;border-radius:8px;text-decoration:none;font-weight:600\">Call (307) 215-8800<\/a><\/div>\n<h2 id=\"keep-reading\">Keep reading<\/h2>\n<div style=\"display:flex;flex-wrap:wrap;gap:14px;margin:16px 0 32px\"><a href=\"https:\/\/cmitsolutions.com\/it-services\/compliance\/\" style=\"flex:1 1 300px;display:block;background:#ffffff;border:1px solid #DDE3E8;border-radius:10px;padding:16px 18px;text-decoration:none\"><span style=\"display:block;color:#E04E3B;font-size:12px;letter-spacing:.08em;text-transform:uppercase;font-weight:700;margin:0 0 6px\">Service<\/span><span style=\"display:block;color:#0F3042;font-weight:700;font-size:17px;line-height:1.35\">Compliance support<\/span><span style=\"display:block;color:#5B6770;font-size:15px;margin-top:6px;line-height:1.5\">Help meeting CMMC, HIPAA and other IT requirements.<\/span><span style=\"display:block;color:#E04E3B;font-weight:600;font-size:15px;margin-top:10px\">Read more &rarr;<\/span><\/a><a href=\"https:\/\/cmitsolutions.com\/it-services\/cybersecurity\/\" style=\"flex:1 1 300px;display:block;background:#ffffff;border:1px solid #DDE3E8;border-radius:10px;padding:16px 18px;text-decoration:none\"><span style=\"display:block;color:#E04E3B;font-size:12px;letter-spacing:.08em;text-transform:uppercase;font-weight:700;margin:0 0 6px\">Service<\/span><span style=\"display:block;color:#0F3042;font-weight:700;font-size:17px;line-height:1.35\">Cybersecurity<\/span><span style=\"display:block;color:#5B6770;font-size:15px;margin-top:6px;line-height:1.5\">Layered protection for identities, devices and data.<\/span><span style=\"display:block;color:#E04E3B;font-weight:600;font-size:15px;margin-top:10px\">Read more &rarr;<\/span><\/a><a href=\"https:\/\/cmitsolutions.com\/industries\/manufacturing\/\" style=\"flex:1 1 300px;display:block;background:#ffffff;border:1px solid #DDE3E8;border-radius:10px;padding:16px 18px;text-decoration:none\"><span style=\"display:block;color:#E04E3B;font-size:12px;letter-spacing:.08em;text-transform:uppercase;font-weight:700;margin:0 0 6px\">Industry<\/span><span style=\"display:block;color:#0F3042;font-weight:700;font-size:17px;line-height:1.35\">IT for manufacturers<\/span><span style=\"display:block;color:#5B6770;font-size:15px;margin-top:6px;line-height:1.5\">Technology support for shops and production floors.<\/span><span style=\"display:block;color:#E04E3B;font-weight:600;font-size:15px;margin-top:10px\">Read more &rarr;<\/span><\/a><a href=\"https:\/\/cmitsolutions.com\/it-services\/it-guidance\/\" style=\"flex:1 1 300px;display:block;background:#ffffff;border:1px solid #DDE3E8;border-radius:10px;padding:16px 18px;text-decoration:none\"><span style=\"display:block;color:#E04E3B;font-size:12px;letter-spacing:.08em;text-transform:uppercase;font-weight:700;margin:0 0 6px\">Service<\/span><span style=\"display:block;color:#0F3042;font-weight:700;font-size:17px;line-height:1.35\">IT guidance and planning<\/span><span style=\"display:block;color:#5B6770;font-size:15px;margin-top:6px;line-height:1.5\">Roadmaps that turn requirements into dated plans.<\/span><span style=\"display:block;color:#E04E3B;font-weight:600;font-size:15px;margin-top:10px\">Read more &rarr;<\/span><\/a><\/div>\n<h2 id=\"sources\">Sources<\/h2>\n<ol style=\"margin:12px 0 28px\">\n<li style=\"margin:6px 0;font-size:16px;line-height:1.5\"><a href=\"https:\/\/dodcio.defense.gov\/CMMC\/\" rel=\"noopener\">Cybersecurity Maturity Model Certification (CMMC)<\/a> <span style=\"color:#5B6770\">(DoD Chief Information Officer, 2025)<\/span><\/li>\n<li style=\"margin:6px 0;font-size:16px;line-height:1.5\"><a href=\"https:\/\/www.federalregister.gov\/d\/2025-17359\" rel=\"noopener\">DFARS: Assessing Contractor Implementation of Cybersecurity Requirements<\/a> <span style=\"color:#5B6770\">(Federal Register, 2025)<\/span><\/li>\n<li style=\"margin:6px 0;font-size:16px;line-height:1.5\"><a href=\"https:\/\/www.verizon.com\/business\/resources\/reports\/dbir\/\" rel=\"noopener\">2025 Data Breach Investigations Report<\/a> <span style=\"color:#5B6770\">(Verizon Business, 2025)<\/span><\/li>\n<li style=\"margin:6px 0;font-size:16px;line-height:1.5\"><a href=\"https:\/\/www.globenewswire.com\/news-release\/2025\/04\/23\/3066121\/0\/en\/Verizon-s-2025-Data-Breach-Investigations-Report-Alarming-surge-in-cyberattacks-through-third-parties.html\" rel=\"noopener\">Verizon&apos;s 2025 Data Breach Investigations Report: Alarming surge in cyberattacks through third parties<\/a> <span style=\"color:#5B6770\">(GlobeNewswire, 2025)<\/span><\/li>\n<li style=\"margin:6px 0;font-size:16px;line-height:1.5\"><a href=\"https:\/\/www.microsoft.com\/en-us\/research\/publication\/how-effective-is-multifactor-authentication-at-deterring-cyberattacks\/\" rel=\"noopener\">How effective is multifactor authentication at deterring cyberattacks?<\/a> <span style=\"color:#5B6770\">(Microsoft Research, 2023)<\/span><\/li>\n<li style=\"margin:6px 0;font-size:16px;line-height:1.5\"><a href=\"https:\/\/wyoleg.gov\/statutes\/compress\/title40.pdf\" rel=\"noopener\">Wyoming Statutes Title 40 (W.S. 40-12-501 and 40-12-502)<\/a> <span style=\"color:#5B6770\">(Wyoming Legislature, 2025)<\/span><\/li>\n<\/ol>\n<div style=\"display:flex;flex-wrap:wrap;gap:16px;align-items:center;border-top:1px solid #DDE3E8;border-bottom:1px solid #DDE3E8;padding:20px 0;margin:32px 0\"><span style=\"flex:none;width:56px;height:56px;border-radius:50%;background:#0F3042;color:#ffffff;text-align:center;line-height:56px;font-weight:700;font-size:20px\">C<\/span><\/p>\n<div style=\"flex:1 1 240px\">\n<p style=\"margin:0;color:#5B6770;font-size:13px;letter-spacing:.08em;text-transform:uppercase\">Written by<\/p>\n<p style=\"margin:2px 0 4px;color:#0F3042;font-size:19px\"><strong><a href=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/about\/\" style=\"color:#0F3042;text-decoration:none\">CMIT Solutions of Casper<\/a><\/strong> <span style=\"color:#5B6770;font-size:16px;font-weight:400\">&middot; Local IT team<\/span><\/p>\n<p style=\"margin:0;font-size:16px\">We provide managed IT, cybersecurity and IT support for businesses across Casper and Natrona County, backed by the CMIT Solutions national network.<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh<\/p>\n","protected":false},"author":156,"featured_media":625,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[26,59,58,60,27,61],"class_list":["post-561","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-local-it","tag-cmmc-compliance-wyoming","tag-cmmc-for-casper-defense-contractors","tag-cmmc-level-2-certification","tag-cmmc-phase","tag-cmmc-phase-2","tag-has-started"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"shendrickson\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Casper, WY 1157 | CMIT Solutions\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper\" \/>\n\t\t<meta property=\"og:description\" content=\"Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-11-07T10:28:15+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-07T10:29:17+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#blogposting\",\"name\":\"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper\",\"headline\":\"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now\",\"author\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/author\\\/shendrickson\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/wp-content\\\/uploads\\\/sites\\\/94\\\/2026\\\/11\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now-2.jpg\",\"width\":1200,\"height\":630},\"datePublished\":\"2026-11-07T04:28:15-06:00\",\"dateModified\":\"2026-11-07T04:29:17-06:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#webpage\"},\"articleSection\":\"Local IT, cmmc compliance wyoming, cmmc for casper defense contractors, cmmc level 2 certification, CMMC Phase, cmmc phase 2, Has Started\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"name\":\"Local IT\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"position\":2,\"name\":\"Local IT\",\"item\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/category\\\/local-it\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#listItem\",\"name\":\"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#listItem\",\"position\":3,\"name\":\"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"name\":\"Local IT\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/#organization\",\"name\":\"CMIT Solutions Cedar Hill\",\"description\":\"CMIT Solutions\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"http:\\\/\\\/cmitsolutions.com\\\/template\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/09\\\/CMMIT-Solutions-Logo.png\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/author\\\/shendrickson\\\/#author\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/author\\\/shendrickson\\\/\",\"name\":\"shendrickson\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/e65017f217a94c970d6763e55ae40ef0ca3846e0fcf0ceae6afb903e7d565120?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"shendrickson\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#webpage\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/\",\"name\":\"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper\",\"description\":\"Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/author\\\/shendrickson\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/author\\\/shendrickson\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/wp-content\\\/uploads\\\/sites\\\/94\\\/2026\\\/11\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now-2.jpg\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#mainImage\",\"width\":1200,\"height\":630},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/blog\\\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\\\/#mainImage\"},\"datePublished\":\"2026-11-07T04:28:15-06:00\",\"dateModified\":\"2026-11-07T04:29:17-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/#website\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/\",\"name\":\"CMIT Solutions Cedar Hill\",\"description\":\"CMIT Solutions\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/casper-wy-1157\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper<\/title>\n\n","aioseo_head_json":{"title":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper","description":"Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh","canonical_url":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#blogposting","name":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper","headline":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now","author":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/author\/shendrickson\/#author"},"publisher":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-content\/uploads\/sites\/94\/2026\/11\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now-2.jpg","width":1200,"height":630},"datePublished":"2026-11-07T04:28:15-06:00","dateModified":"2026-11-07T04:29:17-06:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#webpage"},"isPartOf":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#webpage"},"articleSection":"Local IT, cmmc compliance wyoming, cmmc for casper defense contractors, cmmc level 2 certification, CMMC Phase, cmmc phase 2, Has Started"},{"@type":"BreadcrumbList","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/#listItem","position":1,"name":"Home","item":"https:\/\/cmitsolutions.com\/casper-wy-1157\/","nextItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/category\/local-it\/#listItem","name":"Local IT"}},{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/category\/local-it\/#listItem","position":2,"name":"Local IT","item":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/category\/local-it\/","nextItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#listItem","name":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now"},"previousItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#listItem","position":3,"name":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now","previousItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/category\/local-it\/#listItem","name":"Local IT"}}]},{"@type":"Organization","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/#organization","name":"CMIT Solutions Cedar Hill","description":"CMIT Solutions","url":"https:\/\/cmitsolutions.com\/casper-wy-1157\/","logo":{"@type":"ImageObject","url":"http:\/\/cmitsolutions.com\/template\/wp-content\/uploads\/sites\/2\/2022\/09\/CMMIT-Solutions-Logo.png","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#organizationLogo"},"image":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/author\/shendrickson\/#author","url":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/author\/shendrickson\/","name":"shendrickson","image":{"@type":"ImageObject","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/e65017f217a94c970d6763e55ae40ef0ca3846e0fcf0ceae6afb903e7d565120?s=96&d=mm&r=g","width":96,"height":96,"caption":"shendrickson"}},{"@type":"WebPage","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#webpage","url":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/","name":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper","description":"Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/#website"},"breadcrumb":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#breadcrumblist"},"author":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/author\/shendrickson\/#author"},"creator":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/author\/shendrickson\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-content\/uploads\/sites\/94\/2026\/11\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now-2.jpg","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#mainImage","width":1200,"height":630},"primaryImageOfPage":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/#mainImage"},"datePublished":"2026-11-07T04:28:15-06:00","dateModified":"2026-11-07T04:29:17-06:00"},{"@type":"WebSite","@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/#website","url":"https:\/\/cmitsolutions.com\/casper-wy-1157\/","name":"CMIT Solutions Cedar Hill","description":"CMIT Solutions","inLanguage":"en-US","publisher":{"@id":"https:\/\/cmitsolutions.com\/casper-wy-1157\/#organization"}}]},"og:locale":"en_US","og:site_name":"Casper, WY 1157 | CMIT Solutions","og:type":"article","og:title":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper","og:description":"Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh","og:url":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/","article:published_time":"2026-11-07T10:28:15+00:00","article:modified_time":"2026-11-07T10:29:17+00:00","twitter:card":"summary_large_image","twitter:title":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now | CMIT Solutions Casper","twitter:description":"Quick answer: CMMC Phase 2 began on November 10, 2026. Defense contracts that involve Controlled Unclassified Information can now require a Level 2 certification from an independent C3PAO before award. Wyoming suppliers should confirm their required level with each customer, find where CUI lives, sh"},"aioseo_meta_data":{"post_id":"561","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":null,"created":"2026-11-06 18:31:48","updated":"2026-11-07 10:47:58","seo_analyzer_scan_date":"2026-11-07 10:32:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/category\/local-it\/\" title=\"Local IT\">Local IT<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tCMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/cmitsolutions.com\/casper-wy-1157\/"},{"label":"Local IT","link":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/category\/local-it\/"},{"label":"CMMC Phase 2 Has Started: What Wyoming Defense Contractors Need to Do Now","link":"https:\/\/cmitsolutions.com\/casper-wy-1157\/blog\/cmmc-phase-2-has-started-what-wyoming-defense-contractors-need-to-do-now\/"}],"_links":{"self":[{"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/posts\/561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/users\/156"}],"replies":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/comments?post=561"}],"version-history":[{"count":0,"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/posts\/561\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/media\/625"}],"wp:attachment":[{"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/media?parent=561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/categories?post=561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cmitsolutions.com\/casper-wy-1157\/wp-json\/wp\/v2\/tags?post=561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}