How Texas Defense Contractors Should Prepare for CMMC 2.0 in 2026

CMMC Level 1 (FCI)

17 basic safeguarding practices. Annual self-assessment with senior officer affirmation. Required for any contract handling FCI but not CUI.

CMMC Level 2 (CUI)

110 NIST 800-171 controls. Either self-assessment with senior officer affirmation OR third-party certification by an accredited C3PAO depending on contract type. Under the CMMC 2.0 rule as written, most Texas DoD subcontractors handling CUI would need Level 2 with C3PAO certification. With the Phase 2 assessment requirement suspended, the operative requirement for most of them is the Level 2 self-assessment: a NIST 800-171 score in SPRS plus senior officer affirmation, unless a prime's flow-down still calls for a C3PAO.

CMMC Level 3

NIST 800-172 controls (24 enhanced practices on top of Level 2). Government-led assessment. Required for the highest-sensitivity programs. Most Texas SMB subcontractors will not be Level 3.

Month 0-1: Scoping

• Identify in-scope contracts and the FCI/CUI they handle
• Define the system boundary — which networks, applications, and devices touch CUI
• Identify Asset Categories (CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Out-of-Scope Assets)
• Document data flows for CUI from receipt through processing, storage, transmission, and disposal

Month 1-3: Gap Analysis + Remediation Plan

• Formal gap assessment against all 110 NIST 800-171 controls across the 14 control families
• Plan of Action & Milestones (POA&M) for every gap, prioritized by risk and assessment timeline
• Budget allocation for remediation work — the gap assessment sets the number, and it swings widely with how much of your environment touches CUI

Month 2-6: Technical Control Deployment

The technical controls that move the needle:

• Privileged Access Management (PAM) — application allowlisting and ringfencing satisfies CM.L2-3.4.6, CM.L2-3.4.8, and SC.L2-3.13.4 in a single deployment
• MFA on all accounts — including service principals; satisfies IA.L2-3.5.3
• FIPS 140-2/3 validated encryption — for CUI at rest, in transit, and in cloud storage; satisfies SC.L2-3.13.8 and SC.L2-3.13.11
• Audit logging — comprehensive logging satisfying AU.L2-3.3.1 through 3.3.9
• Incident response capability — documented IR plan with the DoD-required 72-hour cyber incident reporting workflow via DIBNet, satisfying IR.L2-3.6.1 through 3.6.3

Month 4-8: SSP Authoring

The System Security Plan is the most-scrutinized document in CMMC certification. It must:

• Describe each of the 110 NIST 800-171 controls as implemented in your specific environment
• Reference deployed technology, documented procedures, and audit evidence for every control statement
• Be defensible under DIBCAC interview and document review — assessors will probe inconsistencies between SSP claims and operational reality

Template SSPs are a red flag. The SSP must be authored from your real environment.

Month 6-9: Internal Mock Assessment

Whether or not a C3PAO ever enters the picture, run an internal DIBCAC-style mock assessment. It's also the fastest way to find out if your SPRS score reflects reality. The mock must:

• Cover all 110 NIST 800-171 practices through interview, document review, and technical inspection
• Identify residual gaps that need POA&M closure before formal assessment
• Build assessor-facing artifacts — audit log samples, incident response runbooks, training records, vendor BAAs and DPAs, encryption attestation evidence

Month 9-12: C3PAO Engagement (On Hold While Phase 2 Is Suspended)

With the third-party assessment requirement suspended as of September 2026, this phase applies only if a prime's flow-down language still requires certification, or once DoD reinstates it. Keep the plan on the shelf; don't book an assessor on the strength of the old rollout calendar.

• Select an accredited C3PAO from the Cyber AB marketplace
• Schedule the formal assessment 60-90 days out
• Address any findings; reassessment is significantly more expensive than getting it right the first time

From our engagement data with Texas defense contractors: PAM (Privileged Access Management) is the single highest-ROI investment a defense subcontractor can make.

A PAM deployment satisfies:

• CM.L2-3.4.6 Least functionality (configure systems for essential capabilities only)
• CM.L2-3.4.8 Application execution policy (deny-all/permit-by-exception via allowlisting)
• SC.L2-3.13.4 Information flow control between security domains (ringfencing)
• AC.L2-3.1.5 Least privilege (just-in-time elevation)
• AC.L2-3.1.7 Non-privileged accounts for non-security functions

Five controls satisfied in one deployment — and PAM also blocks the ransomware that DoD contractors are increasingly being targeted with.

Before any of this, run our free CMMC 2.0 Self-Assessment Tool. It scores you against 19 representative NIST 800-171 practices, highlights PAM as a quick win, and exports a documented gap report you can bring to your prime, your insurer, or an eventual C3PAO conversation.

In our experience, Texas defense subcontractors tend to over-estimate their CMMC posture, often by a wide margin. The tool forces you to confront each practice honestly with Yes / Partial / No answers.

For a typical Texas defense subcontractor of 25-100 employees, plan for three separate line items. Pricing varies widely by scope, vendor, and how much of your environment touches CUI, so get quotes against your own system boundary instead of planning from someone else's number:

• Initial readiness: the 6-12 month preparation cycle (gap assessment, POA&M, technical control deployment, SSP authoring, mock assessment). Usually the largest line item, and it scales with the size of your CUI boundary.
• Ongoing managed services: CMMC-aligned operations (continuous monitoring, evidence collection, annual self-assessment refresh, POA&M tracking). A recurring monthly cost that's smaller than the readiness work but never goes away.
• C3PAO formal assessment: a one-time fee set by the assessor and driven by scope. On hold for most contractors while Phase 2 is suspended, but keep the line in the plan.

Compare to losing your DoD contracts. The math is straightforward.

• Fort Worth and DFW — Lockheed Martin F-35 supply chain, Bell tiltrotor and helicopter operations, the broader Triumph supply chain, AllianceTexas defense logistics
• Clear Lake (Bay Area Houston) — NASA JSC contractor community, commercial spaceflight engineering, lunar program work
• Greater Houston Energy Corridor — defense-adjacent engineering and energy services contractors handling CUI
• San Antonio — Air Force, Army Medical Command, NSA San Antonio contractor ecosystem
• Austin — emerging defense tech and dual-use technology companies

1. Run the free CMMC Self-Assessment Tool
2. Read our CMMC 2.0 Compliance services overview
3. Read our CMMC Self-Assessment Guide for the methodology behind the tool
4. Schedule a 30-minute conversation — call 888-792-8080 or use the contact form to discuss whether you are positioned for the timeline your contracts require

For Texas defense contractors: the deadline that matters is the one in your specific contract and your prime's flow-down language, not the suspended Phase 2 rollout calendar. The NIST 800-171 self-attestation under DFARS 252.204-7012 is already in force, and most subcontractors handling CUI still need 6-12 months to make that score honest. Start now.