Phase 00–02 · 2026-09-30 · 5 min
Your first 30 days toward CMMC Level 2
If you're starting now, you're behind — but a focused first month can get you scoped, owned, and scored.
Phase 1 of CMMC enforcement began in November 2025, and requirements are already showing up in solicitations on sam.gov. Phase 2 brings third-party certification in November 2026.
Week 1: Name an owner
Pick one internal person who will know your policies backwards and forwards. They don't need to be a CMMC expert — they need to be the bridge between the regulation and how your company really works.
Weeks 2–3: Scope it
Find every place CUI lives and moves. Incorrect scoping is the single biggest gotcha I see in industry. An enclave can shrink your audit dramatically.
Week 4: Score it
Walk all 110 controls and calculate your SPRS score honestly. A negative number is normal at this stage. What matters is a ranked plan to close the gaps.
— Nathanael Dick, CISSP, CCP