Fortinetics Book a call →
Menu
Compliance Architects · 2026

Compliance,
architected.

A boutique compliance architecture firm for organizations operating at the hardest certification bars in cybersecurity. SCIF accreditation to SOC 2 Type II, delivered by a team whose members include a contributor to the CMMC standard.

110 / 110
Perfect CMMC L2 scores
Multiple clients. Repeatable because we design around evidence-as-byproduct.
2019
Team member contributed to CMMC
A member of our team contributed to the CMMC standard at the U.S. Department of Defense in 2019.
3 ×
Classified enclaves in parallel
Three classified network enclaves inside one SAPF envelope.
Status · July 13, 2026
Phase 2
suspended

CMMC Phase 2 is suspended. Your DFARS obligations are not.

The Department of War CIO suspended the November 2026 Phase 2 transition and held every pending CMMC milestone in abeyance pending a 60-day review. Program managers may no longer designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments, and solicitations carrying them are being amended.

What did not change is the part with teeth: DFARS 252.204-7012 safeguarding and 72-hour reporting are still in effect, NIST SP 800-171 Rev 2 is still enforced through self-assessment, and False Claims Act liability still attaches to the SPRS score you affirmed: no breach required, no assessor needed. The certification event paused. The obligations did not.

CMMC 2.0 phased rollout timeline Horizontal timeline of the DoD's four-phase CMMC 2.0 rollout as published in the DFARS 7021 final rule. Phase 1, self-assessment, is in effect and the program is currently paused there: on July 13 2026 the Department of War CIO suspended the Phase 2 transition that had been set for November 10 2026, and held all pending CMMC implementation milestones in abeyance pending a 60-day review. Phases 2 through 4 as shown (third-party C3PAO assessment at contract award, then Level 3 DIBCAC assessment, then full application) are the originally published schedule and are not currently being enforced. PLATE HP-01 · CMMC 2.0 PHASED ROLLOUT 48 CFR · DFARS 7021 · DEC 2024 DoD CONTRACTOR IMPACT Time flows left → right NOV 2025 MAY 2026 NOV 2026 MAY 2027 NOV 2027 MAY 2028 NOV 2028 PHASE 01 SEP 2025 Self-assessment
L1 and L2 self-attestations required in new DoD solicitations. DFARS 7021 in force.
PHASE 02 NOV 2026 C3PAO required
CMMC Level 2 third-party assessment at contract award. Suspended Jul 13 2026.
PHASE 03 NOV 2027 L3 assessment
Level 3 (DIBCAC-led) assessment required for contracts with L3 CUI.
PHASE 04 NOV 2028 Full rollout
All applicable DoD solicitations subject to the CMMC level that matches the program CUI.
TODAY 82,085 DEFENSE CONTRACTORS HANDLING CUI Each was to hold a CMMC L2 certificate at award after Nov 2026. Now suspended. 6–9 MONTHS TYPICAL L2 PREP WINDOW, FIRST-TIME Architecture, implementation, evidence, dry-run, C3PAO scheduling. FINITE C3PAO CAPACITY AT CURRENT RATE Assessor throughput is the shortfall the July 2026 suspension memo cites.

CMMC 2.0 phased rollout timeline

Fig. 01 Four-phase rollout per the 32 CFR Part 170 program rule (effective Dec 2024); the DFARS 252.204-7021 clause followed in the Sept 2025 acquisition rule. The Phase 1→2 transition shown here was suspended on July 13, 2026; the program is paused in Phase 1.
C3PAO assessor capacity versus demand, 2026–2027 Chart contrasting projected cumulative CMMC Level 2 assessment demand from DoD contractors with authorized C3PAO assessor capacity, as modelled against the originally published Phase 2 date of November 10 2026. Assessor capacity grows slowly because C3PAO authorization itself takes about eighteen months. This shortfall is the stated reason the Department of War CIO suspended the Phase 2 transition on July 13 2026, citing severe shortages in third-party assessment capacity; C3PAO assessments cannot currently be designated on new work. PLATE HP-02 · C3PAO CAPACITY vs. DEMAND CYBER AB AUG 2026 · GAO 26-107955 CUMULATIVE VOLUME → APR 2026 JUL OCT NOV PHASE 02 JAN 2027 APR JUL OCT DEC 2027 NOV 10 2026 HEADROOM IN THIS MODEL DEMAND CURVE L2 CONTRACTS AT AWARD SUPPLY CEILING AUTHORIZED C3PAO CAPACITY 111 C3PAOs AUTHORIZED AUG 2026 · 92 IN DEC 2025 (GAO) ~18 MO. TO CERTIFY A C3PAO SUPPLY CANNOT CATCH UP DURING PHASE 02 PHASE 2 SUSPENDED JUL 2026 THIS SHORTFALL IS THE STATED REASON

C3PAO assessor capacity versus demand, 2026–2027

Fig. 02 Authorized-assessor capacity vs. expected L2 demand, modelled against the originally published Phase 2 date. Curves are directional. Counts: 111 authorized C3PAOs (Cyber AB marketplace, August 2026); 92 as of December 2025 (GAO-26-107955). This shortfall is the stated reason for the July 2026 suspension — the CIO memo cites “severe shortages in third-party assessment capacity.”
Six pillars

The hardest certification bars in the industry.
All of them.

All services →
01 · Greenfield IT & Security

Turnkey compliant infrastructure

For startups winning their first defense contract and firms opening new CUI-handling facilities. We design, build, and deploy the full stack (network, identity, endpoints, cloud, SIEM, enclave), compliance-ready on day one.

Learn more →
02 · CMMC 2.0

Level 1, 2, and 3 Certification

End-to-end support for defense contractors handling FCI or CUI. 110 NIST 800-171 Rev 2 controls across 14 families, by a team that includes a contributor to the standard. Phase 2 is suspended. The obligations underneath it are not.

Learn more →
03 · FedRAMP & DoD CC SRG

Cloud Authorization

FedRAMP Certification under the Consolidated Rules for 2026, where Classes A through D measure assurance rather than replace the Low/Moderate/High impact levels, plus DoD CSP SRG Impact Levels 2 through 6 for CSPs hosting DoD workloads.

Learn more →
04 · SOC 2

Type I and Type II Attestation

SOC 2 Type I and Type II for commercial SaaS proving security posture to enterprise buyers. Control design and implementation, not a dashboard that watches you fail.

Learn more →
05 · ISO 27001

Global ISMS Certification

ISO 27001:2022 certification for global and enterprise requirements. ISMS design, Annex A selection, Statement of Applicability, and Stage 1/Stage 2 audit management.

Learn more →
06 · Classified Networks

SCIF & SAPF Accreditation

Secure network architecture and facility accreditation support for defense primes. JWICS, SIPRNet, and Space Force enclaves. Designed to ICD 705, CNSSI 1253, NISPOM, and RMF.

Learn more →
Engagement shape

Six phases, first week to certificate.

Read the full approach →
Fortinetics six-phase engagement timeline Horizontal timeline of the standard Fortinetics engagement, calibrated to a typical six-to-nine month CMMC Level 2 path. Six phases: Discovery, Gap Assessment, Architecture, Implementation, Evidence and Documentation, and Assessment. Phase widths are weighted by effort. Deliverables listed beneath each phase. PLATE HP-03 · ENGAGEMENT SHAPE 6 PHASES · TYPICAL 6–9 MO. TO CERTIFICATE ENGAGEMENT SHAPE Width ∝ typical effort 01 2–3 WKS Discovery
We sit with you. Scope CUI flow, boundary, and target state against the chosen framework.
DELIVERABLES
▪ Scoping memo
▪ Boundary draft
▪ Target-state brief
02 2–3 WKS Gap Assessment
Control-by-control read against the baseline. Findings categorized by lift and risk.
DELIVERABLES
▪ Gap matrix
▪ Initial POA&M
▪ Budget estimate
03 3–5 WKS Architecture
Target-state architecture and the evidence-as-byproduct plan that feeds the assessment.
DELIVERABLES
▪ Enclave design
▪ Control selection
▪ Evidence plan
04 8–14 WKS Implementation
Technical stack + policy library + procedural controls, implemented alongside your team.
DELIVERABLES
▪ Technical controls
▪ Policies
▪ Procedures
05 4–6 WKS Evidence & Docs
System Security Plan, artifact library, dry-run audit against the real assessor checklist.
DELIVERABLES
▪ SSP
▪ Artifact library
▪ Dry-run audit
06 2–4 WKS Assessment
Third-party assessment. We stay present through every session. Then the ongoing cadence.
DELIVERABLES
▪ C3PAO report
▪ Certificate
▪ Ongoing cadence
FIRST WEEK FOUR TO SIX MONTHS CERTIFICATE Scoping begins. Implementation + evidence assembly. Third-party assessment + issuance.

Fortinetics six-phase engagement timeline

Fig. 03 Standard engagement, calibrated to a typical 6–9 month CMMC Level 2 path. The six phases are constant across frameworks; durations flex with scope.
Track record
110/110

Every CMMC Level 2 engagement to date has closed with an affirmed SPRS score of 110 and no open POA&M items.

2019

The year a member of our team contributed to the CMMC standard at the U.S. Department of Defense.

Three classified network enclaves in a single SAPF envelope — separation architecture we designed and documented through AO closeout.

Next step

See where you stand before the assessors do.

Start the readiness quiz for your target framework. Get a live score, a gap summary, and a detailed PDF report. No commitment, just an honest look at where your posture actually is.