CMMC readiness and uplift
Your US defence contracts now depend on a score you have to publish.
CMMC stopped being a future requirement in November 2025. If your business handles Federal Contract Information or Controlled Unclassified Information for the US Department of Defense — directly or three tiers down a prime's supply chain — award eligibility now turns on an assessment result sitting in SPRS. CyberBakery scopes it, closes the gaps, and keeps the evidence current.
Sydney-based · Independent of your assessor · Defence, financial services and critical infrastructure
Where the rules actually stand
Verified against primary sources — [LEAVE AS PLACEHOLDER — CLIENT TO CONFIRM DATE]
- 16 December 202432 CFR Part 170 in forceThe CMMC Program rule. Defines the three levels, assessment types, POA&M rules and SPRS scoring.
- 10 November 2025Acquisition rule in force — Phase 1 live48 CFR Subpart 204.75 puts CMMC into solicitations via DFARS 252.204-7021 and 252.204-7025. A current result in SPRS became a condition of award.
- 13 July 2026Phases 2, 3 and 4 suspendedA policy pause pending program review, not a repeal. Phase 1 self-assessment, DFARS 252.204-7012 and annual SPRS affirmations all remain in effect.
We re-verify this panel monthly. Ask us what changed this month.
Two categories of information decide everything else.
Scope is not about whether you are an American company. It is about what data touches your systems.
Most Australian suppliers land on Level 2.
The level is set by the contracting officer in the solicitation, not chosen by you.
Level 1 — Foundational
17 practices from FAR 52.204-21. Annual self-assessment, posted in SPRS. No POA&M permitted.
FCI
Level 2 — Advanced
110 controls from NIST SP 800-171. Self-assessment for lower-risk contracts, C3PAO certification for most CUI work.
CUI
Level 3 — Expert
Level 2 plus 24 selected controls from NIST SP 800-172. Government-led assessment by DIBCAC.
High-value CUI
Four stages, and the fourth one never ends.
CMMC carries an annual affirmation by a named official and a duty to keep the score honest between assessments.
Overlap is real. Equivalence is not.
DISP membership, Essential Eight Maturity Level 2 and ISO 27001 all move you forward. None of them produce a CMMC result, because CMMC scores specific NIST SP 800-171 controls against evidence. Here is where the reuse actually is.
DISP membership
What reuses
Personnel and physical security, governance, incident reporting discipline.
What it will not cover
The 800-171 control set, SPRS scoring, US assessment mechanics.
Essential Eight ML2
What reuses
Patching, application control, MFA, admin privilege restriction, backups.
What it will not cover
Media protection, CUI marking and handling, audit record content, personnel screening.
ISO 27001
What reuses
ISMS scaffolding, risk process, supplier management, internal audit habit.
What it will not cover
Prescriptive control implementation and the evidence depth an assessor expects.
APRA CPS 234 / CPS 230
What reuses
Control testing rigour, third-party assurance, board reporting cadence.
What it will not cover
Everything specific to CUI and the US contractual chain.
Start where your evidence gap actually is.
Scoping sprint
For businesses that have been asked the question by a prime and need a defensible answer fast.
Level 2 readiness assessment
The full 110-control assessment, scored the way an assessor will score it.
Uplift program
Implementation across identity, endpoint, data and logging, with evidence captured in flight.
Sustain retainer
Posture monitoring and the leadership cover that makes annual affirmation routine.
Certification itself is performed by accredited US C3PAOs, or by DIBCAC at Level 3. CyberBakery prepares you for assessment by any accredited C3PAO and does not assess its own uplift work — that separation is a requirement, and we keep it clean.
We assess for a living, so we know what evidence survives scrutiny.
CMMC, answered plainly.
Does the Phase 2 suspension mean we can wait?
No. Phase 1 is unaffected — the DFARS clause is already appearing in solicitations, and a current result in SPRS is already a condition of award. The suspension pauses the move to mandatory third-party certification on most CUI contracts. Businesses that use the pause to get their 800-171 house in order will be ready when it lifts; businesses that read it as a reprieve will be bidding against those that did.
We are Australian. Can an Australian firm certify us?
We already hold DISP. Isn't that enough?
What is SPRS and why does it matter so much?
Should we build an enclave or lift the whole environment?
What does a scoping sprint actually produce?
When you need method to the chaos
Find out which level is coming before the solicitation does.
A scoping call establishes whether CMMC reaches you, which level applies, and what a realistic path looks like from where you are. No obligation to proceed.
Related services
