CMMC compliance, from assessment to certification
CMMC became a live contract clause on 10 November 2025, when the acquisition rule took effect. Phase 2 was suspended on 13 July 2026 pending a reform review, but Level 1 and Level 2 self-assessment, DFARS 252.204-7012 and your SPRS score all still bind. Thalorin maps your posture, closes the gaps, and holds you assessment-ready for whichever schedule returns.
Phase 1 — self-assessment. In force.
The acquisition rule took effect 10 November 2025, putting DFARS 252.204-7021 into applicable solicitations. Level 1 and Level 2 self-assessments are a condition of award, affirmed annually in SPRS.
Phase 2 — C3PAO certification. Suspended.
Level 2 third-party certification was to enter solicitations on 10 November 2026. The Department's Chief Information Officer suspended it on 13 July 2026, together with the remaining implementation milestones. It is not currently a condition of award.
Reform review reports
A 60-day review of the whole programme. Industry responses to the CMMC Reform Task Force closed 14 August 2026; recommendations are due to the CIO on or about 13 September 2026.
Level 3 and full implementation
Level 3 DIBCAC assessment against NIST SP 800-172 remains the eventual bar for the most sensitive CUI, but it carries no date while the review is open. What binds today is DFARS 252.204-7012, NIST SP 800-171 Rev 2 and a current SPRS score.
Three levels. One path to certification.
Each CMMC level builds on the previous one, with increasing practice requirements and assessment rigor based on the sensitivity of information you handle.
Thalorin automates self-assessment scoring and generates SPRS submission packages.
Full gap analysis, evidence automation, and C3PAO-ready documentation across all 110 practices.
Enhanced security requirements mapped and tracked, with air-gapped deployment for sensitive environments.
How Thalorin supports CMMC
From initial gap assessment through certification and ongoing monitoring, Thalorin provides purpose-built tooling for every phase of the CMMC compliance lifecycle.
Gap Analysis
Automated assessment against all 110 Level 2 practices. Identify exactly where you stand and what needs remediation before engaging a C3PAO.
Practice Implementation
Guided workflows for each NIST 800-171 practice family. Step-by-step implementation guidance with policy templates and configuration baselines.
Evidence Automation
Continuous evidence collection from your environment. System configurations, access logs, and policy artifacts gathered automatically and mapped to practices.
POA&M Management
Track and remediate findings with timelines, milestones, and accountability. Demonstrate progress to assessors with clear remediation documentation.
Supply Chain Flow-Down
Manage subcontractor CMMC requirements. Track flow-down clauses, monitor sub-tier compliance status, and document supply chain risk posture.
Continuous Monitoring
Maintain certification readiness between assessments. Detect control drift, track configuration changes, and keep evidence current for triennial reassessment.
CMMC work carries over
Work you do for CMMC carries over to other frameworks. Thalorin's Feynman Engine maps control relationships automatically—evidence collected once satisfies overlapping requirements.
Deploy where CUI lives
Most compliance platforms are cloud-only. When your CUI environment can't connect to a vendor's cloud, you need a platform that deploys where your data lives.
SaaS
Fully managed deployment with continuous updates and zero infrastructure overhead.
Hybrid
The platform inside your controlled environment, with the augmentation layer reachable only when you allow it. Your data never leaves your boundary.
Air-Gapped
Disconnected environments for classified and high-sensitivity CUI programs, SCIF included.