A current, assessed CMMC certification is no longer aspirational — it’s table stakes for doing business in the U.S. Defense Industrial Base (DIB). If you’re reading this, that reality likely applies to you, and you don’t need us to translate the acronyms.

The Challenge Is Real — and Getting Worse

Earning a passing score from one of the limited number of certified C3PAO assessors is, by all recent accounts, far from assured. The majority of assessments underway are resulting in failing scores — requiring substantial rework of controls, governance, and documentation. If you care about national security, that’s actually the good news: CMMC is not a “mail it in,” form-over-substance exercise. Contractors who pursued a checklist-driven, surface-level approach to controls design are finding out — right now, in the assessment room — just how short that approach falls.

And it’s only going to get harder. Phase 2 begins November 10, 2026, when Level 2 C3PAO certification becomes the default requirement for new DoD contracts involving CUI (Controlled Unclassified Information). This isn’t a universal hard deadline — it’s the point at which third-party assessment requirements start appearing as standard language in new solicitations. But for practical purposes, if you handle CUI and intend to compete for DoD work, your readiness window is now. Fewer than 100 authorized C3PAOs currently serve an estimated 80,000+ contractors that need Level 2 certification. That’s a scheduling bottleneck — and time lost means contracts lost.

The prime contractors feel it too. Lockheed Martin, Northrop Grumman, Boeing and others are being held accountable for CMMC compliance conformity across their entire subcontractor base. Their patience has limits. So does your window.

The Traditional Path to CMMC Compliance: Long

For contractors who can’t leverage the accelerated enclave approach described below, the traditional path looks like this:

• A CMMC readiness gap assessment — which we perform at SLBI as part of our Cybersecurity practice — identifies where you stand relative to the requirements.

These assessments take weeks to months, driven by the inherent complexity at many DIB contractors: multiple locations, numerous systems and endpoints, and broadly distributed CUI (Controlled Unclassified Information — the heart of most CMMC compliance).

• Once gaps are identified and a Systems Security Plan (SSP) and Plan of Action & Milestones (POA&M) are developed, the real work begins: remediating, designing, documenting, and deploying the internal controls your business needs. That effort alone can consume months.
• Then comes a pre-assessment — an independent readiness check before you engage your chosen C3PAO for the formal assessment.
• Then, if you’re ready – you have the actual CMMC assessment of your environment. (and, again – you’ll fail if you’re like many, today)

Simple math: enterprise-wide Level 2 compliance typically takes 12 to 18 months and can cost $75,000 to $300,000 or more for a small-to-midsize contractor — and at the end of that runway, you still have to schedule and pass the C3PAO assessment itself.

A Faster Path — for Some (not all) Contractors

What if there’s a shorter route — not for everyone, but possibly for you?

If CMMC applies to your organization, ask yourself these questions:

1. Is your CUI footprint contained? Can you identify the specific projects, teams, or workflows that handle CUI — versus it being spread across your entire enterprise?
2. Can you clearly separate CUI users from non-CUI users? Do you know which personnel require access to controlled information and which don’t — and could you limit the CUI group to a defined subset of your workforce?
3. Is your IT environment largely cloud-based — or could it be? Are you open to migrating CUI-related work to a managed cloud environment (e.g., Microsoft 365 GCC High in Azure Government)?
4. Is your CUI handled in standard office and collaboration environments? Is your controlled information processed in typical office workflows — email, file sharing, collaboration tools — rather than embedded in shop-floor manufacturing or operational technology systems that resist segmentation?
5. Can your organization operate in a “two-environment” model? Could your team work in a segregated, CMMC-compliant enclave for defense work while using your general business systems for everything else — without unacceptable friction?
6. Is your current infrastructure adaptable? Are you free of heavily customized, legacy on-premise systems that would resist segmentation — or are you willing to migrate CUI workflows off of them?
7. Is your CUI volume and complexity manageable? Could a standardized, pre-built enclave environment serve your defense work without heavy customization to accommodate unusual data types or workflow requirements?

If you answered yes to most of these, you may be well-suited for an enclave approach — and the favorable timeline and cost implications are significant.

The Enclave Advantage

The concept isn’t new: you create a tightly segregated environment — isolated from the rest of your business systems and controls — that is purpose-built to be CMMC-compliant through formal assessment. What is new is that it’s now possible to subscribe to an enclave environment designed, deployed, and governed, where practicable, by specialized third parties. These are replicable, managed, CMMC-ready environments you plug into — rather than build from scratch.

The Department of Defense itself endorses this model. The 32 CFR Part 170 final rule explicitly acknowledges that different business segments or enclaves can be assessed at different CMMC levels, and recognizes that External Service Providers (ESPs) creating “effective and economically feasible services” will enable businesses to enclave operations more readily.

The result: a timeline measured in weeks or a few months — not a year or more — and at materially lower cost than the traditional, enterprise-wide approach.

Traditional vs. Enclave: A Side-by-Side Comparison

The following table illustrates the key differences between an enterprise-wide CMMC compliance effort and a managed enclave approach for a typical small-to-midsize defense contractor pursuing Level 2 certification.

Note: Ranges are representative and drawn from published industry data (2025–2026). Actual costs and timelines vary by organization size, CUI scope, and current security maturity.

Not a Magic Bullet — but a Real One for Some

A subscription-based enclave model won’t fit every contractor requiring CMMC compliance. Organizations with CUI deeply embedded across manufacturing, operational technology, or highly customized legacy systems will still need the comprehensive, enterprise-wide approach. But for those who answered yes to the questions above, there is a faster, more cost-effective path worth exploring.

Where SingerLewak Fits

At SingerLewak, LLP – and specifically within our teams in SL Business Informatics and SL Cybersecurity, we help defense contractors navigate CMMC from start to finish — but we are not a C3PAO assessor organization. We don’t perform the formal assessment. What we do is make sure you’re ready for it.

Specifically, we offer:

• Enclave Suitability Advising. We evaluate whether your organization’s CUI footprint, IT architecture, and operational model make you a candidate for the enclave approach — or whether the traditional path is a better fit.
• Enclave Selection Guidance. For enclave-suitable contractors, we help you identify and evaluate third-party managed enclave providers, ensuring the solution aligns with your specific compliance requirements, contract obligations, and budget.
• Traditional CMMC Readiness. For contractors who need the full enterprise-wide approach, we conduct thorough gap assessments, develop your SSP and POA&M, and guide the remediation, documentation, and control deployment process through pre-assessment readiness.

Whether you’re enclave-suitable or not — we help you get to certification, one way or another. We’ve done it before, and we understand the nuances that separate a passing assessment from a failing one.

Let’s Talk about your Answers above – and Explore your Questions

If you’d like to explore whether the enclave path could work for your organization — or if you need to start down the traditional readiness road — reach out. A conversation costs nothing, and the clock is ticking.

[email protected]

Bob Green, CPA.CITP
Practice Leader — SL Business Informatics & SL Cybersecurity
SingerLewak, LLP