Quick answer: In one full CMMC Level 2 readiness engagement for a US defense subcontractor (Microsoft 365 GCC, about 300 users, roughly 90 of them handling CUI), a C3PAO-style live walkthrough of Microsoft Intune and Entra ID ran 38 checks against the contractor’s own System Security Plan. One passed, 28 failed and 9 were partial. Of the 32 findings, 14 were contradictions: the SSP, a policy or a previously submitted evidence file asserted a state that the live tenant did not hold. At intake, 20 of 110 practices were fully implemented and the honest SPRS-method score was −159. The lesson for every contractor posting a score in SPRS during the Phase 2 pause: your documentation is not your evidence, and the gap between the two is now the main False Claims Act exposure in the Defense Industrial Base.
Why this matters now: the Phase 2 pause moved the risk, it did not remove it
On 13 July 2026 the Department of War suspended the CMMC Phase 2 requirement that would have put third-party Level 2 certification into new solicitations from 10 November 2026, and opened a 60-day review by a CMMC Reform Task Force (Holland & Knight, Crowell & Moring). Class Deviation 2026-O0025 Revision 3 of 3 September 2026 tells contracting officers to accept Level 1 and Level 2 self-assessments and to remove third-party assessment requirements at the next option or modification. The review closed around 11 September; as this report went live the task force report had not been published and no replacement date exists (Secureframe CMMC news tracker). A large share of the market read Revision 3 as “CMMC moved to 2028”. It did not: 10 November 2028 is the original Phase 4 date in 32 CFR 170.3 (KSG). We cover the scenarios on CMMC Phase 2 suspended: what still applies and Class Deviation Revision 3 explained.
Three things did not pause. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 remain contractually binding. Self-assessment scores in SPRS remain a condition of award. And enforcement continued: on 1 September 2026 Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations that one network under a DoD contract did not meet NIST SP 800-171, and in June 2026 the Department of Justice announced the LOGZONE case, where the contractor self-scored 110 in SPRS and a DCMA assessment of the same environment produced −170 (The Defense Compliance Report, CMMC statistics). That 280-point gap between a posted score and a tested environment is the subject of this report. We explain the legal mechanism on CMMC and the False Claims Act and the practical risk on CMMC paused: the self-assessment risk.
The scale of the gap in the market: the Cyber AB reported 2,362 final Level 2 certificates and 117 authorized or accredited C3PAOs at its 29 September 2026 town hall, against a DFARS final rule projection of 118,289 entities needing Level 2 certification by year four. About 2 percent of that population holds a certificate. The Merrill Research survey for 2025 found 17 percent of contractors reporting a negative SPRS score and 1 percent feeling fully prepared for assessment, and Redspin’s 1 October 2026 survey found 76.6 percent of subcontractors had heard nothing from their primes about the pause.
How the data was collected
ITSECOPS ran the engagement from May to September 2026 in three stages. First, an intake gap assessment against all 110 NIST SP 800-171 practices and the CMMC Level 2 scoping guide. Second, three evidence reviews of the contractor’s submitted artefacts (access control in July; awareness through incident response at the end of July; maintenance through system integrity in August). Third, on 8 September 2026, a mock C3PAO live console walkthrough: the contractor’s IT staff drove the Intune and Entra ID consoles on screen while we tested 38 expected states drawn from the contractor’s own policies, SSP and prior evidence, using the Examine, Interview and Test methods in NIST SP 800-171A and the DoD CMMC Assessment Guide Level 2 v2.13. The method matters: each check was judged against the state the contractor had documented, not against a generic good-practice baseline. Where the tenant and the documentation disagreed, the disagreement was itself recorded as a finding, because an SSP that does not describe the system as configured fails CA.L2-3.12.4 regardless of how strong the underlying control is.
Everything below is readiness language. ITSECOPS is a consultant, not a C3PAO; nothing here is a certification assessment. The contractor and its people, sites and vendors are anonymised; the numbers are not.
Finding 1: the tenant failed 28 of 38 checks against its own SSP
The single outright pass was Terms of Use, and that pass itself had been a July downgrade (both policies were then scoped to one pilot user) that the contractor had since recovered. Nine partial results were cases where the capability existed but in the wrong scope, in audit mode rather than enforcing, or with no proof that it had ever operated. Identity and Conditional Access carried the most failures in absolute terms (9 of 11), and apps and mobile application management failed every check it faced (5 of 5). If your readiness plan rests on “we have Intune and Conditional Access”, the question an assessor asks next is “scoped to whom, enforcing what, since when, and show me the capture”.
Finding 2: 14 of 32 findings were accuracy findings, and assessors weight those most
Thirty-two findings came out of the session: 13 assessment stoppers (S1), 16 majors (S2) and 3 moderates (S3). Nearly half were not control findings at all but accuracy findings: places where a policy, the SSP, the customer responsibility matrix or a previously submitted evidence file asserted something the live tenant contradicted. The register ran to 14 rows. Among them:
- The SSP and a privileged access standard described approval-gated Privileged Identity Management with a small set of monitored break-glass accounts. PIM was not in use and a named admin account held Global Administrator with a permanent end time.
- Evidence submitted in July showed “MFA for all users” set to all users. The live policy excluded a service-account group of seven generic identities, a guest group and an executive exception group.
- July evidence stated the shared admin account had been renamed and no shared identities remained. Seven shared or generic accounts were live.
- The identity policy required inactive accounts to be reviewed at 90 days and deactivated within five business days. The tenant held roughly 100 stale user accounts, 17 stale guests and 30 stale devices.
- The media protection policy restricted removable media to registered, company-issued devices. The USB block policy carried exclusion groups, one containing a daily-driver account.
- The mobile device policy said copy and paste of CUI from managed to unmanaged apps shall be blocked. The app protection policy permitted 250 characters of cut and copy and the PIN never expired.
- July evidence stated users could not consent to applications. A user-consented application held full control of all site collections.
- The SSP changelog recorded a third-party backup platform as removed. Two registrations remained, one with no owner.
- The SSP and the customer responsibility matrix placed a cloud secure web gateway at FedRAMP High and IL5. The tenant was confirmed commercial, and its root CA was deployed to endpoints, which means CUI was being decrypted inside a commercial service.
An assessor reading a register like this does not narrow sampling. They widen it, because every other assertion in the package has just become less reliable. This is the mechanism behind the LOGZONE gap: a posted 110 built on documentation, and a tested −170 built on the tenant. It is also why we tell every client that an SSP is a description of the system as configured, not a statement of intent.
Finding 3: “partially implemented” is the most common state, and it scores as Not Met
At intake, 20 of 110 practices were fully implemented and the honest SPRS-method score was −159, formally “No Score” because the SSP practice CA.L2-3.12.4 was unmet. By the September mock stage the all-110 position was 8 Met, 55 Partial and 47 Not Met at assessment-objective granularity. The drop in “Met” from 20 to 8 is not regression: it is what happens when every practice is tested objective by objective instead of being self-declared. Under 32 CFR 170.24, a Partial scores as Not Met except in the narrow cases the rule allows, so for scoring purposes the contractor had 102 practices to close, not 47. Conditional certification requires a score of at least 88 of 110. Run your own objective-level check with the free CMMC Level 2 gap analysis tool and convert it with the SPRS score calculator; the full practice list is on the NIST 800-171 controls list.
Finding 4: the POA&M trap
| Rule (32 CFR 170.21 and 170.24) | What it means | What we found |
|---|---|---|
| Only requirements valued at 1 point may be on a POA&M | 5-point and 3-point practices must be Met before the assessment, with one exception: SC.L2-3.13.11 where encryption is employed but is not FIPS-validated | Three 5-point practices were on the POA&M: MA.L2-3.7.2 and CM.L2-3.4.8 (application control in audit mode with device exclusions) and IR.L2-3.6.2 (no DIBNet reporting path or medium-assurance certificate) |
| Six named requirements are barred from a POA&M at any value | Includes AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4 and the physical access practices PE.L1-3.10.3, 3.10.4, 3.10.5 | The intake “POA&M” of 90 items carried several of these, which tells an assessor the rule was never applied when the plan was built |
| Conditional status needs score ÷ 110 ≥ 0.8 | 88 or better before any POA&M helps you | −159 at intake; far below the gate even after the application control practices close |
| POA&M items close within 180 days | Otherwise the conditional certificate expires | See our answer on what happens when the 180-day window expires |
A 90-item internal tracker is a useful remediation tool. Calling it the POA&M, and letting it carry practices that can never be on one, is the single most common documentation error we see in defense subcontractors, and it is visible to any assessor in the first ten minutes.
Finding 5: the exposures the SSP never mentioned
The live session surfaced an estate that appeared in no artefact: 53 enterprise applications registered in the tenant, many without an owner, several holding tenant-wide read and write permissions over SharePoint, OneDrive and mail, plus a managed service provider’s service principal with a standing privileged role. None of this was in the SSP, the customer responsibility matrix or the plan of action. We treated it as the highest priority new workstream, because AC.L2-3.1.20 (connections to external systems) is one of the six requirements that can never be deferred to a POA&M.
Finding 6: scope drift
The SSP declared a single in-scope facility and a CUI enclave of roughly 90 users. The console showed CUI groups of 109, 118 and 130 members all describing the same population, a remote desktop host group at an overseas site, application control exclusions for two out-of-scope countries, and CUI-relevant policies assigned to between 130 and 576 objects. Scope is settled before practices are assessed, so this is a gate rather than a finding: an assessor will not start on the 110 until the boundary in the SSP matches the boundary in the tenant. Read our explainer on what a CMMC enclave is and whether you need GCC High. For the record, nothing in DFARS 252.204-7012, 32 CFR Part 170 or the scoping guide requires a separate tenant for CUI users; what the rules require is a defined, defensible boundary inside one.
What was working: the problem is targeting and enforcement, not absence
The same session recorded real progress between July and September: update rings and automatic patch compliance reporting (against an August position of none), LAPS and BitLocker healthy on a sampled device, the “Global Administrators as local administrators” policy at zero, Defender tamper protection and controlled folder access scoped to the CUI group, a device clean-up rule, and enrolment, compliance and configuration policies present and actively maintained. The contractor was not missing tools. It was missing enforcement mode, correct targeting and dated captures. A C3PAO accepts a capture with a visible system clock as Test evidence; a consultant’s written note proves only that the consultant says so. That one lesson, applied to every control, is worth more than any new licence.
Ten checks to run in your own tenant this week
- Export Entra role assignments. Any Global Administrator with a permanent end time and no PIM is finding one.
- Open your “MFA for all users” Conditional Access policy and read the exclusions aloud. Service accounts, guests and executives are the usual leaks.
- List every enabled account with no sign-in for 90 days, users and guests, and every device not checked in for 90 days. Compare the count with your policy.
- Count your CUI security groups. If more than one group claims to be “the CUI users”, your scope is undefined.
- Open Enterprise Applications, sort by permissions, and find every app with Sites.Read.All, Mail.ReadWrite or Directory.ReadWrite.All. Then find the owner. Then find it in your SSP.
- Check application control (WDAC or AppLocker): audit or enforce, and which device groups are excluded.
- Check the USB block policy for exclusion groups and the app protection policy for cut-and-copy limits and PIN expiry.
- Confirm the FedRAMP authorisation level of every external service that touches CUI against what your SSP claims, including any root CA your proxy deploys.
- Read your POA&M against 32 CFR 170.21: remove every 3-point and 5-point item and every barred practice.
- Take one dated capture per control this week, with the system clock visible. Notes are not evidence.
The continuous compliance checklist turns these into a weekly, monthly and quarterly calendar with the hours each run takes.
Extended edition · PDF
Get the full findings register and the POA&M worksheet
The extended edition is the working document: all 32 findings anonymised with the observed state, the practices affected, the required fix and the evidence to produce; the 14-row contradiction register; the 38-check Intune and Entra ID live checklist a C3PAO walks through; the 32 CFR 170.21 POA&M admissibility worksheet; the 90-day remediation sequence; and the “before you post an SPRS score” checklist. Work email and company only, so the right specialist sees who asked. No newsletter, no cold calls.
Done. Your copy is ready: download the extended edition (PDF). Keep the link; it stays valid. If you want the findings walked through against your own tenant, book a 30 minute readiness review.
What ITSECOPS does with this
We run this exact method for defense subcontractors and for the MSPs that support them: an intake gap assessment, evidence reviews by control family, a mock C3PAO live console walkthrough, then remediation by the hour through our US CMMC consulting team, with evidence filed as we go and tracked in VEDVERA, our GRC platform that lives inside your own Microsoft 365 tenant. Kansas City for US clients, Stavanger for Europe, and a 24/7 delivery center in India so the Friday finding is fixed before Monday. We never assess our own work: the certification assessment is always a C3PAO’s.
BOOK A 30 MINUTE READINESS REVIEW
Frequently asked questions
Is CMMC paused?
Phase 2 is suspended, the programme is not. The Department of War paused the third-party certification requirement for new solicitations on 13 July 2026 pending a task force review. Level 1 and Level 2 self-assessments in SPRS, DFARS 252.204-7012 and NIST SP 800-171 Rev 2 all remain in force, and DCMA DIBCAC assessments and False Claims Act enforcement continued through the pause.
Was the 10 November 2026 CMMC deadline cancelled?
It was suspended with no replacement date. Class Deviation 2026-O0025 Revision 3 (3 September 2026) instructs contracting officers to accept self-assessments and remove third-party assessment requirements at the next option or modification. Nothing has been cancelled; the task force recommendations had not been published when this report went live.
Is 2028 the new CMMC deadline?
No. 10 November 2028 is the original Phase 4 date in 32 CFR 170.3(e). Revision 3 did not set a new date, and treating 2028 as a deadline while posting an unsupported SPRS score is the exposure the Honeywell and LOGZONE cases illustrate.
Can a 5-point practice go on a POA&M?
No. 32 CFR 170.21(a)(2)(ii) limits a CMMC POA&M to requirements valued at 1 point, with a single exception for SC.L2-3.13.11 where encryption is employed but is not FIPS-validated. Six named requirements, including AC.L2-3.1.20, AC.L2-3.1.22 and CA.L2-3.12.4, are barred at any value.
What score do I need for conditional CMMC Level 2 status?
88 of 110 (a ratio of 0.8 or better) with every open item eligible for a POA&M, and the POA&M must close within 180 days. Scoring starts at 110 and subtracts 1, 3 or 5 points per Not Met requirement under 32 CFR 170.24.
Does “partially implemented” count toward my score?
For scoring, a Partial is a Not Met except in the narrow cases the rule allows (for example, multifactor authentication implemented for remote and privileged access but not yet for general access, which scores a reduced deduction). This is why the contractor in this report went from 20 “implemented” at intake to 8 Met at objective level: the practices had not regressed, they had been tested.
What does a C3PAO actually look at in Intune and Entra ID?
The state your SSP says exists, tested on screen: role assignments and PIM, every Conditional Access policy and its exclusions, enrolment restrictions, compliance and configuration profile assignments and their error counts, application control mode and exclusions, USB and app protection policies, update rings, Defender settings, device inventory reconciliation, and the enterprise application estate and its permissions. The extended edition lists all 38 checks.
Can one Microsoft 365 tenant serve CUI and non-CUI users?
Yes. Nothing in DFARS 252.204-7012, 32 CFR Part 170 or the CMMC scoping guide requires a separate tenant. The shared services every user touches (Entra ID, Exchange, SharePoint, Intune, Purview, Sentinel) are in scope because CUI lives on them, so tenant-wide minimums apply to everyone, and the CUI-specific layer (labels, restricted sites, Conditional Access requiring compliant CUI devices, DLP) scopes to the CUI group. Non-CUI endpoints become contractor risk managed assets. What fails assessments is a boundary that the SSP and the tenant describe differently.
What is the False Claims Act risk of an inaccurate SPRS score?
A posted score is a representation to the government that a condition of award is met. The Department of Justice’s Civil Cyber-Fraud Initiative has resolved defense-related cybersecurity cases totalling about $39 million since 2022, including Honeywell Aerospace’s $2.04 million settlement on 1 September 2026. The gap between a self-score and a tested score is the fact pattern those cases turn on.
How long does it take to go from a negative score to 88?
In this engagement the intake fix set (SIEM ingestion, boundary rewrite, backup scope, change control, DIBNet certificate, printing controls, POA&M rebuild) was estimated to move roughly 35 points of SPRS weight within a quarter. The identity, scope and application control findings from the mock stage are the long pole: expect two to three quarters of disciplined work for a contractor of this size, and a mock walkthrough before any C3PAO is booked.
Cite or share this report
Every chart on this page may be reused with attribution: “Source: ITSECOPS Research, The CMMC Readiness Gap Report 2026, itsecops.cloud/research/cmmc-readiness-gap-report-2026/”. Journalists, primes and MSPs who want the underlying anonymised working papers under NDA can write to saleslead@itsecops.cloud.
Sources. ITSECOPS engagement working papers, May to September 2026 (intake gap assessment, three evidence reviews, mock C3PAO live console report of 8 September 2026). 32 CFR Part 170 (as of 27 April 2026). NIST SP 800-171 Rev 2 and SP 800-171A. DoD CMMC Assessment Guide Level 2 v2.13. Holland & Knight, Crowell & Moring and KSG client alerts on the 13 July 2026 suspension and Revision 3. Cyber AB town hall, 29 September 2026. DFARS final rule entity projections (10 September 2025). Department of Justice press releases (LOGZONE, 18 June 2026; Honeywell Aerospace, 1 September 2026). Merrill Research for CyberSheath, 2025. Redspin defense contractor survey, 1 October 2026.