In this article
CMMC Pre-Assessment in 2026: Independent Evidence in a Changing Defense Cybersecurity Landscape
- Sajjad Syed
CMMC Has Entered a Different Phase, but the Evidence Question Remains
For defense contractors and technology providers, 2026 has complicated what had appeared to be a relatively predictable CMMC implementation timeline. On July 13, 2026, the U.S. Department of War announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect on November 10, 2026. Phase I self-assessment requirements remain in place while the Department conducts a broader review of the program (U.S. Department of War, 2026). (War Governance)
The policy change matters, but its significance should not be overstated. Current Department materials state that CMMC implementation remains paused in Phase I and that cybersecurity requirements associated with NIST SP 800-171 Revision 2 continue to be enforced through self-assessments and selected government-led assessments. The Department also states that the suspension does not eliminate contractors’ obligations to protect covered information under applicable requirements (U.S. Department of War Chief Information Officer, n.d.). (U.S. Department of War)
For leadership teams, this creates an important distinction between regulatory timing and cybersecurity evidence. A government implementation milestone can move while the underlying systems, identities, cloud platforms, engineering environments, records, and technical controls remain unchanged. The contractual and governance questions surrounding those environments therefore do not disappear simply because a future phase of CMMC has been suspended.
A CMMC Pre-Assessment from Consilium Labs provides an independent, standards-based examination of the defined environment against the criteria established for the engagement. The assessment can examine applicable controls, documentation, implementation, scope, and supporting evidence and record the resulting findings through formal reporting. The engagement remains separate from the official CMMC assessment mechanisms and does not confer CMMC certification or formal CMMC status.
Leadership Should Separate Policy Timing From Cybersecurity Condition
Current CMMC policy makes this distinction particularly important. The Department’s CMMC materials state that Phase I may require self-assessments at Level 1 and Level 2. Level 1 is based on 15 safeguarding requirements associated with Federal Contract Information, while Level 2 self-assessment continues to use the 110 requirements in NIST SP 800-171 Revision 2 for the protection of Controlled Unclassified Information (U.S. Department of War Chief Information Officer, n.d.). (U.S. Department of War)
The operational condition of an environment, however, is not determined by the regulatory calendar. Access privileges remain configured as they are configured. Security events continue to generate records. Cloud services remain connected to production environments. Administrative accounts continue to operate. Policies either correspond with observed practices or they do not. Evidence continues to exist regardless of when the government schedules a particular assessment requirement.
That distinction deserves greater attention at the executive level because cybersecurity assurance is often reduced to an upcoming milestone. The more durable governance question is whether assertions about the organization’s security posture can be connected to a defined scope, an applicable set of requirements, and evidence capable of objective examination.
An independent CMMC Pre-Assessment can provide leadership with that documented view at a defined point in time. It does not predict future government policy and it does not substitute for an official CMMC assessment. Its value lies in establishing what the evidence demonstrates within the agreed assessment boundary.
The NIST Revision Question Makes Assessment Precision More Important
The current CMMC environment also illustrates why organizations should distinguish between the newest cybersecurity publication and the standard that is actually applicable to a particular assessment.
NIST finalized SP 800-171 Revision 3 and its companion assessment publication, SP 800-171A Revision 3, in May 2024. Revision 3 superseded Revision 2 as NIST’s current publication and introduced changes to the structure and organization of requirements, including closer alignment with NIST SP 800-53 and the use of organization-defined parameters (Ross & Pillitteri, 2024a, 2024b). (NIST Computer Security Resource Center)
CMMC has not simply moved to that newer publication. Current Department materials continue to identify the 110 requirements of NIST SP 800-171 Revision 2 as the basis for CMMC Level 2 self-assessment during Phase I. Department FAQs further state that Revision 3 is expected to be incorporated through future rulemaking and that Revision 2 remains the CMMC assessment basis in the interim (U.S. Department of War Chief Information Officer, n.d.). (U.S. Department of War)
For leadership, the practical lesson is not that one revision is preferable to another. It is that the assessment basis needs to be explicit. An organization can operate within a broader cybersecurity program influenced by newer NIST publications while still facing contractual or CMMC requirements tied to Revision 2. Conflating those two circumstances can weaken the precision of internal reporting and assessment conclusions.
Consilium Labs therefore treats the defined assessment criteria as foundational to the CMMC Pre-Assessment. The engagement should identify what requirements are being evaluated, what environment falls within scope, what evidence is relevant to those requirements, and what period the resulting findings represent. That approach allows conclusions to remain traceable even as external policy develops.
CMMC Pre-Assessment Is Fundamentally an Evidence Exercise
CMMC-related cybersecurity evaluation cannot be reduced to whether an organization possesses a collection of policies. Documentation is important, but assessment conclusions depend on the relationship between documented requirements, actual implementation, and objective evidence.
The Department’s Level 2 Assessment Guide reflects this principle. It describes assessment as the testing or evaluation of security controls to determine the extent to which those controls are correctly implemented, operating as intended, and producing the intended outcome relative to applicable security requirements. The methodology uses examine, interview, and test as core assessment methods (U.S. Department of War Chief Information Officer, 2024). (U.S. Department of War)
A policy may describe how privileged access is intended to operate, for example, while access records, account configurations, technical settings, interviews, and operational evidence provide information about how that requirement is actually represented in the environment. Neither type of evidence should be considered in isolation when the applicable assessment objective requires a broader view.
A Consilium Labs CMMC Pre-Assessment applies that evidence-centered approach within the agreed pre-assessment scope. Depending on the criteria and environment established for the engagement, the examination may include policies, procedures, technical configurations, access information, operational records, system artifacts, security records, interviews, and other relevant evidence.
The resulting findings are based on the evidence observed during the engagement. Where the evidence does not demonstrate alignment with an applicable criterion, that condition can be documented. Responsibility for management decisions, system design, control implementation, and subsequent organizational actions remains with the organization being assessed.
Scope Determines What an Assessment Conclusion Actually Means
For many technology organizations, scope may be one of the most consequential aspects of CMMC-related evaluation.
Modern defense environments are rarely confined to a single corporate network. A manufacturer may operate engineering workstations, production systems, cloud repositories, identity services, supplier portals, managed services, remote-access systems, and multiple facilities. A SaaS provider may rely on several infrastructure platforms, external identity providers, development systems, production environments, logging services, administrative consoles, and third-party dependencies. An MSP may hold privileged access to environments belonging to several customers.
An assessment conclusion has meaning only in relation to the environment that was actually examined. A control observed in one system cannot automatically establish the condition of another system outside the assessment boundary. Likewise, evidence produced for one process may not establish implementation across technologies or locations that were not part of the evaluation.
A disciplined CMMC Pre-Assessment therefore establishes the assessment boundary before broader conclusions are drawn. The scope connects the applicable requirements to the systems, processes, personnel, technologies, and evidence presented for examination. It also defines the limits of what the resulting report can reasonably state.
This becomes particularly important when findings move beyond the security function and into board reporting, customer discussions, contractual decision-making, or enterprise governance. Leadership needs to understand not only the conclusion but also what was actually examined to produce that conclusion.
Formal Reporting Preserves Assessment Context
Regulatory change increases the importance of preserving context around an assessment.
An evaluation conducted in 2026 exists within a particular CMMC environment. Phase II has been suspended, Phase I remains active, current CMMC Level 2 self-assessment continues to reference NIST SP 800-171 Revision 2, and NIST itself has already published Revision 3 (U.S. Department of War, 2026; U.S. Department of War Chief Information Officer, n.d.; Ross & Pillitteri, 2024a). (War Governance)
That context matters when assessment results are interpreted months or years later. Formal pre-assessment reporting can preserve the assessment basis, defined scope, evidence examined, criteria evaluated, and findings identified during the engagement. If government requirements subsequently change, the organization can distinguish between what was independently evaluated at a particular point in time and what changed later at the policy or regulatory level.
This is more than an administrative consideration. A report whose scope and assessment basis are clearly documented is more useful to governance stakeholders because its conclusions remain connected to the conditions under which they were reached. The alternative is a generalized statement about cybersecurity posture that can become increasingly difficult to interpret as standards and requirements evolve.
Existing Safeguarding Obligations Remain Material
The CMMC Phase II suspension should also be understood alongside the contractual cybersecurity requirements that remain in force.
DFARS 252.204-7012 requires contractors to provide adequate security on covered contractor information systems and addresses systems that process, store, or transmit covered defense information. The clause also incorporates NIST SP 800-171 requirements in applicable circumstances and includes requirements concerning cyber incident reporting and the protection of covered defense information (Acquisition.gov, n.d.). (Acquisition.gov)
Current CMMC program materials explicitly state that the Phase II suspension does not eliminate the requirement for organizations to protect information in accordance with DFARS 252.204-7012 (U.S. Department of War Chief Information Officer, n.d.). (U.S. Department of War)
For leadership teams, this is a reason to avoid treating CMMC solely as a future certification event. The broader assurance question concerns the environment that exists today and the evidence available to demonstrate how applicable safeguarding requirements are represented within it.
Industry Use Cases
Defense Manufacturers With Complex Engineering Environments
Defense manufacturers may handle technical drawings, specifications, engineering records, quality documentation, production data, and other information associated with government programs. Those materials can move through engineering workstations, manufacturing systems, cloud storage, collaboration platforms, identity infrastructure, supplier interfaces, and external technology providers.
In that environment, a CMMC Pre-Assessment can examine the defined assessment boundary as an interconnected system rather than treating cybersecurity as a collection of policy documents. Applicable requirements can be evaluated against the technical and operational evidence presented for examination, while the resulting report records what was observed within the established scope.
For executives overseeing manufacturing operations and government contracts, this can provide a clearer basis for understanding the condition of the environment without converting the pre-assessment into an implementation engagement or implying a formal CMMC determination.
B2B SaaS Providers Serving the Defense Ecosystem
Cloud-based SaaS environments present a different assessment profile. Production workloads, application services, identity platforms, administrative interfaces, logging systems, encryption mechanisms, development environments, monitoring platforms, and external technology services may collectively contribute to the environment being evaluated.
This architecture can be sophisticated while still presenting an evidence challenge. Technical maturity does not by itself establish that an applicable assessment criterion has been demonstrated. The assessment conclusion depends on whether the relevant evidence within the defined boundary can be connected to the applicable requirement.
For SaaS organizations operating within or adjacent to the defense industrial base, a CMMC Pre-Assessment can provide an independent examination of that relationship between architecture, implementation, documentation, and evidence.
Managed Service Providers and Shared Responsibilities
Managed service providers can occupy a consequential position in defense-sector technology environments. An MSP may administer endpoints, identity platforms, infrastructure, security systems, backups, monitoring tools, cloud services, or other technologies relevant to a contractor’s environment.
These arrangements can complicate assessment evidence because responsibilities may be distributed across different entities. Technical records may reside with one organization, policies with another, and operational responsibilities may be shared.
A CMMC Pre-Assessment can examine the relevant responsibilities and evidence within the agreed boundary and document what those conditions demonstrate against the applicable criteria. The engagement does not prescribe how the service relationship should be redesigned; its purpose is to evaluate and report on what is presented within scope.
Prime Contractors and Supply-Chain Governance
CMMC exists within a defense industrial base where sensitive information and contractual obligations can extend beyond a single organization. Current Department materials emphasize that the CMMC model is intended to protect Federal Contract Information and Controlled Unclassified Information and includes requirements relevant to information flowed down to subcontractors (U.S. Department of War Chief Information Officer, n.d.). (U.S. Department of War)
For prime contractors, suppliers, and subcontractors operating within that ecosystem, independent evaluation of a defined environment can provide an additional source of documented assurance for governance discussions. The resulting pre-assessment does not establish formal CMMC status, but it can provide a structured record of the criteria applied, evidence examined, and findings observed.
Technology Companies Entering the Defense Market
Technology companies entering defense contracting may already operate sophisticated cybersecurity programs. Cloud-native infrastructure, centralized identity management, automated deployments, encryption, security monitoring, and formal governance processes can all be present before the organization encounters CMMC requirements.
CMMC-related evaluation nevertheless asks a narrower question: what does the evidence demonstrate against the specific criteria being applied within the defined scope?
For organizations navigating defense-sector requirements alongside existing security programs, a CMMC Pre-Assessment can establish a documented assessment baseline. The result gives leadership an evidence-based view of the environment presented for examination without assuming that technical sophistication alone establishes alignment with CMMC criteria.
The Consilium Labs Approach to CMMC Pre-Assessment
Consilium Labs approaches CMMC Pre-Assessment as an independent, evidence-based assessment activity built around clearly defined criteria, established assessment boundaries, objective examination, documented findings, and formal reporting.
That distinction is important because an independent pre-assessment should remain separate from responsibility for the systems and controls being evaluated. Consilium Labs examines the environment and evidence presented within the agreed scope and documents what the assessment demonstrates. Management retains responsibility for its systems, controls, implementation decisions, and subsequent actions.
This assessment-first posture is especially relevant in the current CMMC environment. Standards and government implementation mechanisms can evolve, but the fundamentals of a defensible assessment remain consistent: the assessment basis should be explicit, the scope should be defined, the evidence should be traceable, and conclusions should not extend beyond what was actually examined.
For Consilium Labs, authority in CMMC Pre-Assessment is therefore grounded in the discipline of the evaluation itself. Credible assessment is built through objective evidence and clearly bounded conclusions rather than expansive claims about outcomes that the pre-assessment does not control.
Frequently Asked Questions
What is a CMMC Pre-Assessment?
A CMMC Pre-Assessment is a non-certification assessment engagement in which a defined environment is evaluated against applicable CMMC-related criteria established for the engagement. Consilium Labs examines relevant scope information, controls, documentation, implementation evidence, technical records, interviews, and other applicable evidence and documents the resulting findings through formal reporting.
Is a CMMC Pre-Assessment the same as an official CMMC assessment?
A CMMC Pre-Assessment is separate from the official mechanisms through which formal CMMC status is established and does not itself confer CMMC certification or status. This distinction is particularly important in 2026 because CMMC implementation is currently paused in Phase I after the Department suspended Phase II requirements in July (U.S. Department of War, 2026; U.S. Department of War Chief Information Officer, n.d.). (War Governance)
What is currently required under CMMC Phase I?
Current Department materials state that CMMC remains paused in Phase I and may require self-assessments at Levels 1 and 2. Level 1 includes an annual self-assessment against the applicable 15 safeguarding requirements, while Level 2 self-assessment is based on the 110 requirements of NIST SP 800-171 Revision 2 and is conducted every three years, with annual affirmation requirements (U.S. Department of War Chief Information Officer, n.d.). (U.S. Department of War)
Why does NIST SP 800-171 Revision 2 remain relevant when Revision 3 has been published?
NIST finalized SP 800-171 Revision 3 in May 2024, but the current CMMC framework continues to use Revision 2 for Level 2 assessment. Department FAQs state that Revision 3 is expected to be incorporated into CMMC through future rulemaking and that Revision 2 remains the assessment basis in the interim (Ross & Pillitteri, 2024a; U.S. Department of War Chief Information Officer, n.d.). (NIST Computer Security Resource Center)
Does the suspension of CMMC Phase II remove existing cybersecurity obligations?
The suspension does not remove applicable safeguarding requirements. Current Department materials specifically state that organizations remain responsible for protecting information in accordance with DFARS 252.204-7012, and the clause continues to require adequate security on covered contractor information systems in applicable contracts (Acquisition.gov, n.d.; U.S. Department of War Chief Information Officer, n.d.). (Acquisition.gov)
What evidence may be examined during a CMMC Pre-Assessment?
The evidence depends on the defined scope and assessment criteria. Relevant material may include policies, procedures, system configurations, access information, operational records, security records, technical artifacts, interviews, and other evidence associated with the applicable requirements. The official CMMC Level 2 Assessment Guide uses examine, interview, and test as assessment methods, reinforcing the evidence-centered character of CMMC evaluation (U.S. Department of War Chief Information Officer, 2024). (U.S. Department of War)
Why is assessment scope important?
The assessment scope defines the environment to which the assessment findings apply. Systems, personnel, services, processes, and technologies outside the defined boundary cannot automatically be represented by conclusions reached about the environment that was actually examined. A clear scope therefore improves the precision and traceability of the resulting findings.
Does Consilium Labs implement cybersecurity controls as part of the CMMC Pre-Assessment?
Consilium Labs maintains separation between independent evaluation and responsibility for the environment being assessed. The engagement examines applicable criteria and evidence and documents the resulting findings. Responsibility for system design, control implementation, operational decisions, and subsequent organizational actions remains with management.
What does Consilium Labs provide at the conclusion of the pre-assessment?
The approved CMMC Pre-Assessment offering includes formal reporting that documents the assessment results within the defined engagement scope. The report provides a record of the environment examined, applicable assessment basis, evidence reviewed, and findings identified during the evaluation. It is a pre-assessment output and does not constitute a CMMC certificate or formal CMMC status.
CMMC Reform Changes the Context, but Defensible Evidence Remains Central
The most significant CMMC development of 2026 is larger than a changed implementation date. The Department is reviewing the future direction of the program while Phase I self-assessment requirements remain in force, existing information-protection obligations continue, and the broader NIST framework has already progressed to Revision 3. Organizations are therefore operating across overlapping contractual, regulatory, and technical timelines rather than a single static compliance environment (U.S. Department of War, 2026; U.S. Department of War Chief Information Officer, n.d.; Ross & Pillitteri, 2024a). (War Governance)
For leadership teams, the durable question is whether cybersecurity assertions can be connected to the correct criteria, a clearly defined assessment boundary, objective evidence, and conclusions that remain within the limits of what was actually examined. Those principles retain their value even when government implementation mechanisms change.
Consilium Labs’ CMMC Pre-Assessment offering is positioned around that discipline. Through independent evaluation, evidence-based findings, and formal reporting, the engagement provides a documented view of the defined environment while preserving a clear distinction from official CMMC status and from responsibility for the systems being assessed.
Bring greater independent visibility to your CMMC environment through a structured, evidence-based pre-assessment.
References
Acquisition.gov. (n.d.). 252.204-7012 Safeguarding covered defense information and cyber incident reporting. Retrieved September 25, 2026. Official DFARS source
Ross, R., & Pillitteri, V. (2024a). Protecting controlled unclassified information in nonfederal systems and organizations (NIST Special Publication 800-171 Revision 3). National Institute of Standards and Technology. NIST SP 800-171 Revision 3
Ross, R., & Pillitteri, V. (2024b). Assessing security requirements for controlled unclassified information (NIST Special Publication 800-171A Revision 3). National Institute of Standards and Technology. NIST SP 800-171A Revision 3
U.S. Department of War. (2026, July 13). Forging the Arsenal of Freedom: Department of War suspends CMMC Phase II requirements. Official release
U.S. Department of War Chief Information Officer. (2024). CMMC assessment guide—Level 2. CMMC Level 2 Assessment Guide
U.S. Department of War Chief Information Officer. (n.d.). About CMMC. Retrieved September 25, 2026. Official CMMC program page
Related Articles
Let's get in touch
Start your audit now. Achieving cybersecurity audit can be complex. We have made it our mission to simplify the process, giving you access to the professional expertise you need to prepare your company for the future. Get in touch with us today!
