One Enterprise, Two Regimes
The CIO and CISO playbook for achieving CMMC 2.0 compliance without disrupting the commercial business.
| NOV 10, 2025 | JUL 13, 2026 | SEP 2026 |
| DFARS 7021 effective; Phase 1 self-assessment now in DoW solicitations | Phase 2 suspended; CMMC Reform Task Force review begins; Phase 1 remains in force | Reform Task Force report due to the DoW CIO; RFI on CMMC reform closed August 14 |
Executive Summary
Cybersecurity Maturity Model Certification (CMMC) 2.0 enforcement began on November 10, 2025.1 Phase 2, which was to make Level 2 Certified Third-Party Assessment Organization (C3PAO) certification a condition of contract award on November 10, 2026, was suspended by the Department of War (DoW; formerly the Department of Defense) on July 13, 2026, pending a 60-day, top-to-bottom review by a newly established CMMC Reform Task Force; a public request for information on reforming the program closed August 14, 2026.2 Phase 1 obligations, including self-assessments, score postings, and annual affirmations, continue without interruption. In plain English: the audit is paused; the accountability is not. Primes had already moved ahead of the government timeline: L3Harris told its supply chain in April 2026 to obtain a Level 2 certification by July 30, 2026, or come off the program;3 Lockheed Martin, General Dynamics, and Boeing have each signaled CMMC requirements to their supply chains through varying mechanisms described in Section 2 below. Nothing in the suspension directs primes to relax those flow-downs, which remain contractual until modified. Roughly 90 to 100 authorized C3PAOs are serving an estimated 80,000 to 120,000 affected contractors, and waitlists already exceed six to twelve months.4
This paper is written for the organizations for which the program is hardest: global technology companies and manufacturers that run both US government business and large commercial businesses on shared enterprise systems. For these enterprises, the central question is not whether to certify. It is how to draw a defensible boundary that protects the federal business without disrupting the much larger commercial one. And how to operationalize the distinction between Controlled Unclassified Information (CUI) Basic and CUI Specified within customer relationship management (CRM), enterprise resource planning (ERP), secure email, and the day-to-day culture of a global workforce.
This paper is written with the chief information officer (CIO), chief information security officer (CISO), and enterprise systems owner in mind, with a focus on execution. Those execution challenges now include a fast-moving artificial intelligence (AI) dimension: copilots, agents, and shadow AI use are pulling CUI into places no one scoped, and these uses reach well beyond the security team into Legal, HR, Engineering, Sales, and the Chief AI Officer. They also reflect a broader shift in which commercial enterprises are increasingly pulled into Defense Industrial Base (DIB)-grade compliance expectations without the institutional infrastructure that traditional defense contractors built over decades. A parallel Alvarez & Marsal (A&M) National Security, Trade and Technology (NSTT) publication, Welcome to the Defense Industrial Base: How Commercial Companies Are Being Drafted Into the National Security Ecosystem (forthcoming), addresses the strategic and regulatory dimensions of that shift for the board and senior leadership audience. This paper is its execution-layer complement.
A&M NSTT sets out below the regulatory state, the bifurcation problem, the system-by-system playbook, and a call to action for organizations planning through the suspension window.
1. THE BIFURCATION PROBLEM
Global technology companies and manufacturers do not enter CMMC as clean DIB suppliers. Many enter as enterprises with tens or hundreds of thousands of employees and billions in commercial revenue, with a federal book of business that is meaningful but rarely dominant. The systems running the commercial business, including global ERP, CRM, and productivity systems, were designed for that scale and that speed. CMMC arrives asking those systems to honor a regime for which they were never engineered. That is the whole problem in one sentence. Think about what that actually asks of a business built for speed.
The most consequential element of that regime is the distinction between CUI Basic and CUI Specified. Basic follows the uniform safeguarding baseline in 32 CFR Part 2002. Specified carries category-specific safeguarding or dissemination requirements imposed by law, regulation, or government-wide policy. The most common Specified categories in commercial and manufacturing enterprises are Export Controlled (SP-EXPT), which carries International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR) overlays, and Proprietary Manufacturer (SP-PROP). Specified categories drive scope; Basic follows the baseline. Conflating the two is the single most common scoping error A&M NSTT encounters. Not a subtle one. Not a rare one. The most common one.
The deeper error is treating CMMC as a control checklist rather than a boundary- and operating-model problem. Most programs get this exactly backwards. For bifurcated enterprises, the question is not whether the controls exist; it is where the boundary sits, how data crosses it, and how the organization proves, continuously, that the boundary holds. Carry that idea through the rest of the paper. Everything below applies to it.
CUI BASIC | CUI SPECIFIED |
Authority: Default category for most CUI; subject to the uniform safeguarding and dissemination controls in 32 CFR Part 2002. Marking: "CONTROLLED" or "CUI" banner sufficient; no category-specific dissemination limits beyond the baseline. Handling: Standard CUI controls; no special marking or category-specific rules required. Typical Sources: For Official Use Only (FOUO)-era records, general technical information not falling under a category-specific authority, broad federal correspondence. | Authority: Carries category-specific safeguarding or dissemination requirements above the CUI Basic baseline, imposed by law, regulation, or government-wide policy. Marking: Must carry the category code (e.g., CUI//SP-EXPT for Export Controlled; CUI//SP-PROP for Proprietary Manufacturer). Handling: Category-specific dissemination, destruction, and access controls overlay the CUI Basic baseline. Typical Sources: ITAR/EAR-controlled technical data, naval nuclear propulsion information, sensitive contract clauses with their own statutory regimes. |
2. WHERE THE CMMC PROGRAM STANDS
The Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7021 final rule took effect on November 10, 2025. Contracting officers may now insert CMMC clauses into solicitations, and contract award is conditioned on current CMMC status and an annual senior-leadership affirmation in the Supplier Performance Risk System (SPRS). Phase 1 (Level 1 and Level 2 self-assessments at award) is live now. Phase 2 was scheduled to begin November 10, 2026, making Level 2 C3PAO certification a condition of award. Phase 3 was to follow in November 2027, extending Level 2 to option exercises and introducing Level 3 Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) requirements; Phase 4, in 2028, was to bring full implementation. On July 13, 2026, the DoW suspended Phase 2 effective immediately and froze the later phases, standing up a CMMC Reform Task Force that reports to the DoW Chief Information Officer within 60 days; the accompanying request for information on reforming the program closed August 14, 2026, and the Task Force report is expected by mid-September.5 During the review, requiring activities may designate only Level 1 (Self) or Level 2 (Self), no waivers are being issued, and C3PAO and DIBCAC requirements are being removed from active solicitations and, at the next option exercise or scheduled administrative modification, from existing contracts. The suspension is a policy pause, not a regulatory change: 32 CFR Part 170 and the DFARS clauses remain on the books, and Phase 1 self-assessments, SPRS postings, annual affirmations, and DFARS 252.204-7012 obligations continue without interruption.
Primes have read the timeline and moved ahead of it. The April 2026 L3Harris notice set a July 30, 2026, supplier deadline for Level 2 certification.6 Lockheed Martin is monitoring SPRS and Exostar, and signaling mitigation actions for suppliers below a green readiness rating. General Dynamics is embedding CMMC requirements directly in contracts. Boeing is conducting supplier cybersecurity assessments tied to award eligibility.7 Nothing in the July 13 memoranda directs a prime to drop requirements it has set for its own supply chain risk; the Cyber AB’s chief executive has described a Level 2 certification as the best insurance against False Claims Act risk, and prime flow-downs remain in force until modified.8 The structural assessor shortage compounds the pressure: roughly 90 to 100 authorized C3PAOs serve an estimated 80,000 to 120,000 affected contractors, and industry waitlists range from six to twelve months and are lengthening.9 The DoW CIO has since cited that assessor shortfall and projected small-business compliance costs above $7 billion annually as among the reasons for the Phase 2 pause.10
3. CRM, ERP, SECURE EMAIL, AND CULTURE
For a bifurcated enterprise, four systems carry the weight of CMMC compliance, and one of them is not a system at all. CRM, ERP, and secure email are where the technical controls live. Culture is where the controls either hold or fail. The use cases below reflect what we see across global technology companies and manufacturers running both federal and commercial businesses on the same enterprise stack.
The technical control set is well understood. What breaks implementations is the collision between enterprise-wide systems designed for speed and openness and a federal regime that requires restrictive handling, evidence trails, and disciplined user behavior. The four systems below are where that collision shows up first.
| SYSTEM | COMMERCIAL POSTURE | FEDERAL POSTURE (CUI) | BIFURCATION CHALLENGE |
|---|---|---|---|
| CRM | Global commercial CRM tenant; shared opportunity records, regional sales motions, and marketing automation tied to commercial product lines. | CUI-bearing opportunities, capturing data, and contract artifacts require a government-cloud CRM environment, with controls that prevent CUI from crossing into the commercial tenant. | The Hard Part: Pipeline reporting, account hierarchy, and global executive dashboards span both tenants. Sales leadership wants one view; the regulation requires two systems with hardened separation. |
| ERP | Global ERP platform holding bills of materials (BOMs), routings, costing, and program correspondence across every line of business in every geography. | ERP records tied to DoW programs frequently carry CUI Specified content; export-controlled specifications under SP-EXPT pull the records and connected master data into Level 2 scope. | The Hard Part: Three live options compete: full GovCloud migration, targeted obfuscation of CUI Specified content, or a dedicated federal enclave. Cost, audit risk, and operational disruption diverge sharply across the three. |
| Secure Email | Productivity platform commercial tenants serving tens of thousands of employees globally; mature data loss prevention (DLP), retention, and eDiscovery already in place. | Government Community Cloud High (GCC High) or equivalent for CUI-bearing correspondence and shared files, with sensitivity labeling tuned to CUI Basic versus CUI Specified categories, and category-specific dissemination controls. | The Hard Part: Engineers and program managers (PMs) routinely need to email both commercial customers and federal program offices on the same day. Cross-tenant collaboration, attachment handling, and mobile access are where culture meets control. |
| Culture | Global commercial culture rewards speed, transparency, and informal collaboration. Shared drives, collaboration-style channels, and travel-friendly access patterns are the norm. | Federal-side culture requires marking discipline, attestation, recurring training, access certification, and a willingness to slow down at clearly defined handling boundaries. | The Hard Part: The same employee operates under both regimes in the same week. Without a CUI operating model that the business follows, the technical controls will be routed around within a month. |
WHAT THIS LOOKS LIKE IN PRACTICE
Two anonymized examples show how the boundary problem plays out in the field. Both are composites drawn from work with bifurcated enterprises.
The Embedded-Software and Defense-Electronics Manufacturer A global technology company selling embedded operating systems, real-time compute platforms, and development tools to both commercial original equipment manufacturers (OEMs) and US defense programs ran its entire business on a single global ERP instance. Commercial customers were roughly 80 percent of revenue; the federal book was smaller but growing, anchored by DoW programs requiring CMMC Level 2 as a condition of continued performance. The bifurcation problem was embedded in the bill of materials. Product specifications for defense-program components carried Export Controlled CUI (SP-EXPT) designations, and those specifications lived in the same ERP master-data records as the commercial product catalog. A full GovCloud migration of the ERP instance was untenable; commercial engineering relied on the same BOMs and routings daily. Migrating only the CUI-bearing records to a federal enclave required a data-architecture decision the company had not anticipated and a change program spanning Engineering, Operations, and Program Management at once. Until that boundary was established, the company could not advance to a defensible System Security Plan (SSP) or engage a C3PAO, putting certification timelines and contract continuity at risk. The Lesson: For bifurcated manufacturers, the ERP scoping decision is the program. SSP authorship, assessor scheduling, cost projection, and evidence development all depend on it. Making that decision late, or without a complete map of commercial system dependencies, is the most common cause of program failure. |
The Global Professional and Technology Services Firm A large professional and technology services firm with a global commercial practice and a growing US federal IT and advisory book ran both businesses on a single Microsoft 365 commercial tenant and a single Salesforce org. The consultants working on federal programs were the same people, on the same email platform, Salesforce instance, and Teams environment as those serving commercial Fortune 500 clients. Same badge, same laptop, two different worlds of rules. That is the trap. Standing up GCC High for the federal practice was straightforward. The harder problem was the CRM. Federal pipeline, engagement data, and client correspondence were embedded in the same global object model as commercial opportunities. Dual-tenant architecture met the immediate compliance requirement but created a new operational fault line: federal account teams could no longer operate in the same reporting environment as the commercial business, and firm-wide executive dashboards required a reconciliation layer that had not been scoped or budgeted. Identity governance compounded the problem, as personnel moving between federal and commercial engagements required dual provisioning, differentiated access, and auditable privilege transitions that the HR systems were never designed to support. The Lesson: For services and technology firms, CRM architecture and identity governance are as determinative as secure-email migration. A dual-tenant build without a reconciliation layer is not a complete solution; it creates a new class of operational and audit risk that has to be designed for and documented. |
4. THE AI COMPLICATION
CMMC 2.0 was finalized without a single direct reference to artificial intelligence, yet AI is now the fastest-moving CUI risk in the bifurcated enterprise. Read that again: the rule that governs your data never mentions the technology now moving it. The control families do not exempt machine-operated systems; any AI component that stores, processes, or transmits CUI must run inside the compliant boundary, and assessors are already evaluating AI workflows as in-scope. Three patterns are creating exposure faster than programs can adapt.
First, embedded copilots and agents. AI assistants and the agentic workflows now spreading through proposal writing, program documentation, and supply-chain management reach across the same data the user can see. Point one at a tenant that holds CUI, and the assistant inherits that reach; prompts, retrieval context, and outputs all become CUI that must stay inside the boundary and inside the audit trail. There is no machine exemption; an AI agent acting on CUI triggers authorized-access and audit-logging obligations like any user. Treat the machine as you would treat the person. Same access rules. Same logs.
Second, shadow AI. Engineers, proposal teams, and analysts paste specifications, contract language, and program detail into Generative AI tools or a personal account to move faster. Public models may retain or train on those inputs, which turns a productivity shortcut into CUI spillage, a reportable incident, not a policy footnote. Ask an assessor what they notice first. Usually, it is the distance between what the business actually does with AI and what its acceptable-use policy claims.
Third, the compliant-tooling and policy-debt problem. AI that touches CUI must be Federal Risk and Authorization Management Program (FedRAMP) Moderate (or equivalent) authorized, with telemetry and logs treated as CUI and routed inside the boundary; a capable commercial tool that is not authorized is not a close call. Most enterprises deploy AI well before they update acceptable-use, data-classification, vendor-management, and incident-response policies to account for it. It is a finding waiting to happen. That policy debt compounds. It could surface at the worst possible moment: during assessment.
The Collateral Leaders
The bifurcation problem is filed under the CIO and CISO, but it does not stay there. AI accelerates that spread because the people adopting copilots and agents are rarely the people who own the CUI boundary. A defensible program names the owners early and gives each of them a defined role in the operating model. The person clicking is almost never the person accountable. That is the gap.
| LEADER | WHAT THE BIFURCATION PROBLEM PUTS ON THEIR DESK |
|---|---|
| CIO/CISO | Owns the boundary, the enclave architecture, and the evidence trail. Accountable for the SSP, the assessment, and the AI tooling that touches CUI; carries the day-to-day collision between commercial velocity and federal control. |
| General Counsel (GC) | A CUI spillage into a public AI tool is a reportable incident with contractual and potential False Claims Act (FCA) exposure. GC owns the affirmation risk behind the senior-official attestation and the disclosure posture if the boundary fails. |
| Chief AI/Data Officer | Owns the AI adoption agenda that is now the fastest-moving CUI risk in the enterprise: copilots, agents, and model pipelines that can ingest CUI without anyone deciding they should. |
| Chief Human Resources Officer (CHRO) | Owns the identity feed (joiner-mover-leaver), the acceptable-use policy, and the training that makes culture change real. Dual provisioning for staff who move between federal and commercial work runs through HR systems that were never built for it. |
| Heads of Sales, Engineering, and Product | Live the boundary daily: CRM tenancy and pipeline reporting for Sales; BOM, product lifecycle management (PLM), and specification handling for Engineering and Product. They route around controls that slow the commercial business unless the operating model is designed with them. |
| Chief Financial Officer (CFO)/Chief Procurement Officer | Owns the cost of the scoping decision and the vendor-vetting that keeps a non-compliant AI or software-as-a-service (SaaS) tool out of the boundary. Procurement is now a CUI control surface, not just a sourcing function. |
5. THE COMPLEXITIES THAT DERAIL BIFURCATED ENTERPRISES
CMMC is not technically novel; the 110 National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 controls have been documented for years. What sinks programs in bifurcated enterprises is the friction among regulatory interpretation, enterprise architecture designed for commercial speed, and the way a global business actually runs day-to-day, including how it uses AI. The recurring complexities below account for most failed first-pass assessments. Each one calls for a specific move now.
6. A PRACTICAL 90-DAY PLAN
For enterprises whose award eligibility is at risk in 2026, the next ninety days are the highest-leverage window. The plan below is the baseline that A&M NSTT recommends; specific sequencing depends on the size of the federal book, the global ERP and CRM footprint, the AI footprint, and existing readiness.
Treat assessment readiness as an evidence problem as much as a control problem. Controls you cannot demonstrate through repeatable artifacts, logs, and operating routines will not survive assessment, however mature they are. Build the evidence trail in parallel with implementation, not after it. Evidence you cannot show is evidence you do not have.
PRACTICAL 90-DAY ACTION PLAN Days 1-30: Inventory CUI Basic and CUI Specified separately. Identify every DoW contract that flows down DFARS 252.204-7012 or 7021. Pull the current SPRS score; validate the CMMC unique identifier. Identify which prime customers have already flowed a 2026 deadline. Confirm in writing whether each prime's Level 2 expectations stand despite the suspension. Brief the board on the bifurcation problem and the scoping decision required. Days 31-60: Make the scope-reduction decision; GovCloud, enclave, or obfuscation. Preserve C3PAO optionality rather than cancelling; re-baseline the assessment date against the Task Force report expected in September 2026. Begin CRM tenant split and GCC High deployment for the federal side. Begin SSP authorship against the 110 NIST SP 800-171 controls. Days 61-90: Close the highest-scoring control gaps. Publish the CUI operating model and run tabletop rehearsals with Sales, Engineering, Operations, and Finance. Run a mock assessment against the Level 2 Assessment Guide. Finalize the Plan of Action and Milestones (POA&M), revisit the C3PAO decision against the Task Force outcome, and brief the board on residual risk by prime customer. |
7. HOW A&M NSTT CAN HELP
A&M NSTT operates at the intersection of regulation, enterprise systems, and operations. The NSTT team comprises security and compliance experts, former regulators and in-house compliance professionals, and trusted leaders and advisors in high-impact, high-sensitivity organizations and transactions. Our engagement approach partners with internal legal, compliance, IT, and security teams; we do not replace them. The workstreams below reflect what the bifurcation problem requires: regulatory positioning, enterprise systems execution, and assessment assurance, run in parallel by the same team.
DIAGNOSTIC AND STRATEGY | EXECUTION AND REMEDIATION | ASSURANCE AND ADJACENT REGIMES |
|
|
|
8. CALL TO ACTION
Decisions determining 2026 and 2027 award eligibility are being made now. Here is the part nobody is saying out loud: the pause did not pause your obligations. The regulatory direction is under review, prime pressure remains operational, and self-attestation now carries the compliance weight. Enterprises that treat the suspension as a reprieve will be the least prepared for whatever the Task Force recommends.
THE CALL TO ACTION Phase 2 is suspended, not the obligation. For bifurcated enterprises, the review window is the time to move on four fronts in parallel. 1. Separate CUI Basic from CUI Specified at the record level. Specified categories drive scope; Basic follows the baseline. 2. Pick the scope strategy at the board level. Choose GovCloud, an enclave, or obfuscation across ERP and CRM. Cost, schedule, and audit risk follow from this single decision. 3. Stand up the federal enclave for email and identity. Use GCC High or equivalent for secure email; implement HR-driven IGA on the federal side, designing both for assessor evidence. 4. Govern AI and run the culture change in parallel. Bring copilots, agents, and shadow-AI usage inside the boundary before assessment; the control set is only as strong as the operating discipline behind it. Controls do not enforce themselves. People do, or they do not. |
Authoritative References
| 32 CFR Part 2002: NARA CUI program rule; the source for Basic vs Specified definitions, marking, and handling. | DFARS 252.204-7021/7025: CMMC contract clause (effective Nov 10, 2025) and solicitation provision for CMMC level. |
| 32 CFR Part 170: CMMC Program Rule (effective Dec 16, 2024); maturity levels, assessments, and program mechanics. | NIST SP 800-171 Rev. 2: The 110 control set used for Level 2 assessments. Rev. 3 finalized but does not yet displace Rev. 2 for CMMC. |
| DFARS 252.204-7012: Safeguarding Covered Defense Information and Cyber Incident Reporting; 72-hour incident reporting. | CUI Registry: Authoritative source for Specified category codes (SP-EXPT, SP-PROP, and others). |
| DoW CMMC Phase 2 Suspension (Jul 13, 2026): DoW CIO memorandum and USD(A&S) Memorandum 26-P-1023; Phase 2 and later phases suspended pending review; Phase 1 obligations unchanged. | CMMC Reform Task Force / RFI: Top-to-bottom program review reporting to the DoW CIO within 60 days; RFI responses due August 14, 2026. |
About A&M NSTT
A&M NSTT was built to solve compliance problems that span three disciplines at once: regulatory, operational, and technical. Our bench includes former federal prosecutors, DoW acquisition and security officials, intelligence-community veterans, former in-house compliance and ethics leaders, and senior practitioners drawn from enterprise ERP, CRM, and government cloud implementation programs. We work the same problem from four directions on a single engagement: what an assessor will accept, what a contracting officer requires, what the operating business can absorb, and what the enterprise systems can actually do. That is how we close compliance demands without breaking the commercial operations that fund the federal book. To engage, contact our team of professionals.
These three authors are joined by the broader NSTT bench on most CMMC engagements: former DOJ prosecutors, defense and intelligence community officials, former in-house compliance and ethics leaders, and senior practitioners in enterprise ERP, CRM, and government cloud platforms. The team works the same problem from the regulatory, operational, and technical directions in parallel; the integration is the differentiator.
References
[1] “Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements (DFARS Case 2019-D041).” “Cybersecurity Maturity Model Certification (CMMC) Program.” Federal Register, vol. 89, 15 Oct. 2024, codified at 32 C.F.R. Part 170; Federal Register, vol. 90, 10 Sept. 2025, (verified 11 Aug. 2026).
[2] “Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements.” Department of War, Office of Industrial Base Growth, 13 July 2026; “DoW Suspends CMMC Phase II Requirements.” Holland & Knight, July 2026.
[3] “Cybersecurity Maturity Model Certification (CMMC): Action Needed.” Supply chain notice to suppliers, L3Harris Missile Solutions, 6 Apr. 2026. See also “L3Harris Gives Subcontractors About 80 Working Days to Comply with CMMC.” Summit 7, 20 Apr. 2026, verified 11 Aug. 2026.
[4] “CMMC Marketplace.” Cyber AB, Accessed 6 July 2026. See also “January 2026 Cyber AB Town Hall Recap.” CMMC.com, 2026.
[5] “Pentagon Suspends CMMC Phase Two Requirements, Launches Review of Program.” Federal News Network, Under Secretary of War for Acquisition and Sustainment Memorandum 26-P-1023, 13 July 2026;
[6] “L3Harris Gives Subcontractors About 80 Working Days to Comply with CMMC” L3Harris Missile Solutions, supply chain notice, Summit7, 6 Apr. 2026.
[7] “Your CMMC Deadline Isn’t November 2026, It’s Whenever Your Prime Says It Is.” Radicl, Apr. 2026. (verified 11 Aug. 2026).
[8] “CMMC Phase 2 Paused: Which Requirements Still Apply After the Latest DoW Announcement and Prime Notices?” Secureframe, July 2026.
[9] “Marketplace,” The Cyber AB, accessed August 13, 2026 and “January 2026 Cyber AB Town Hall Recap,” CMMC.com, January 27, 2026.
[10] “DoD Suspends CMMC Phase 2: What Happened and What It Means.” Government Contracts Law, July 2026.
[11] “Marketplace,” The Cyber AB, accessed August 13, 2026 and “January 2026 Cyber AB Town Hall Recap,” CMMC.com, January 27, 2026.
