PEARSON/CYBER DEFENSEPearson Digital Infrastructure LLC

>_ CMMC 2.0 · facts as of October 2026

CMMC readiness for the Huntsville defense industrial base.

Shrink your CUI scope, close the highest-weight gaps first, and run the evidence program that backs your affirmation. Readiness, not certification, from a firm that knows the difference.

CMMC Phase 2 begins November 10, 2026

Nov 10 2026

Level 2 C3PAO certification in applicable DoD solicitations.

  • 110NIST SP 800-171 Rev 2 requirements behind CMMC Level 2
  • −203 to 110Range of the SPRS score (DoD Assessment Methodology)
  • 72 hoursTo report a cyber incident to DoD under DFARS 252.204-7012
  • 3 yearsLevel 2 assessment cycle (self-assessment or C3PAO), with annual affirmations

>_ 01 Levels

What each level requires

CMMC levels
LevelProtectsRequirementsAssessment
Level 1FCI15 basic safeguarding requirements (FAR 52.204-21)Annual self-assessment and affirmation in SPRS
Level 2CUI110 requirements of NIST SP 800-171 Rev 2Self-assessment or C3PAO certification (per contract) every 3 years, plus annual affirmation
Level 3CUI on critical programsLevel 2 plus selected NIST SP 800-172 requirementsDCMA DIBCAC government assessment, after a final Level 2 C3PAO certification

>_ 02 Phased rollout

Where the program stands

  1. Phase 1 · Nov 10, 2025

    Level 1 and Level 2 self-assessments required in applicable solicitations

  2. Phase 2 · Nov 10, 2026

    Level 2 certification by a C3PAO required in applicable solicitations

  3. Phase 3 · Nov 10, 2027

    Level 3 (DCMA DIBCAC) requirements begin

  4. Phase 4 · Nov 10, 2028

    Full implementation across applicable contracts

DoD may include higher requirements earlier at its discretion. Sources: 32 CFR Part 170 (CMMC Program rule), DFARS 252.204-7012 / -7019 / -7020 / -7021, and DoD CIO CMMC resources. Verify current status before relying on any date.

>_ 03 Method

How a PDI readiness engagement runs

  1. 00 · 1 call

    Qualify

    FCI only, or CUI? Which contracts and flow-downs? When is the next award?

  2. 01 · Weeks 1–4

    Scope & gap

    CUI data-flow diagram, asset inventory by category, 110-requirement gap assessment, preliminary SPRS score

  3. 02 · Weeks 4–16

    Remediate

    Highest-weight gaps first (MFA, encryption, logging, access control, incident response), SSP, POA&M

  4. 03 · Weeks 12–24

    Evidence

    Monthly evidence program running, policies adopted, training records, mock assessment

  5. 04 · As scheduled

    Assessment

    C3PAO readiness review, evidence binder, support during the assessment

  6. 05 · Ongoing

    Sustain

    Evidence program, annual affirmation support, change tracking

>_ 04 Boundaries

What we don’t do

  • PDI does not certify anyone. Level 2 certification comes from an authorized C3PAO; Level 3 assessments are performed by DCMA DIBCAC.
  • PDI is not a C3PAO or a FedRAMP-authorized cloud provider.
  • Your senior official signs SPRS affirmations. PDI prepares the evidence with you.
  • Readiness work does not guarantee an assessment outcome.
  • When PDI manages your security tools, PDI becomes an External Service Provider, and our people and tools are in your assessment scope. We document that shared responsibility up front.

>_ 05 Related services

Built for contractors

GRCCompliance Readiness & EvidenceA clear gap list against all 110 NIST SP 800-171 requirementsSOCSOC Monitoring & Log ManagementFirewall, endpoint and server signals in one placeSECCybersecurityFewer ways in: MFA, least privilege and hardened configurationsBDRBackup & Disaster RecoveryBackups that have actually been restored

Compliance & vCISO work is billed at $275/h. See pricing.

Phase 2 is a calendar problem.

Assessor calendars book months out. Start the gap assessment now, so your evidence is ready before the award.

Get a free assessment (256) 675-9961