CMMC compliance consulting for Canadian suppliers
A paid CMMC readiness engagement helps Canadian suppliers scope the FCI or CUI boundary and prepare for the path named in a U.S. defence solicitation.
The readiness call is free. Written findings, SSP work, and implementation begin only after you approve a paid scope.
Current CMMC status
On July 13, 2026, the Department suspended Phase II. Phase II was originally scheduled to start on November 10, 2026. CMMC remains paused in Phase I. Phase I self-assessment requirements remain active for Level 1 and Level 2 where a contract requires them.
The solicitation names a level. What now?
During the current Phase I pause, the clause or flowdown may require Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) remain later assessment paths in the program design, not active Phase I requirements.
Then trace FCI or CUI through the people, facilities, systems, cloud services, external providers, and subcontractors that handle it. That scope comes before the control review.
Nelson leads the readiness call and stays involved through scoping and handoff. Pilotcore supports readiness and implementation but is not a C3PAO.
Nelson is a real pro who helped us through a difficult time of transition. He helped us identify many gaps in our systems, processes and structure.Client feedback from an AWS infrastructure review, shared here as adjacent technical work.
The solicitation states the required CMMC level. The systems that process, store, or transmit FCI or CUI determine the assessment scope. During Phase I, the active paths are Level 1 (Self) and Level 2 (Self). The C3PAO path remains useful planning background if the Department changes the current status.
Level 1 covers the 15 safeguards in FAR 52.204-21. The organization completes the assessment and annual affirmation in SPRS. POA&Ms are not permitted.
Level 2 covers the 110 requirements in NIST SP 800-171 Revision 2. When the solicitation names the self path, results go into SPRS, annual affirmation continues, and limited POA&M work must close within 180 days.
Planning background: if the Department restores an independent Level 2 path and a future solicitation names C3PAO, an authorized C3PAO would assess the 110 requirements every three years. Annual affirmation would continue in SPRS. Pilotcore can prepare the handoff but is not the assessor.
CMMC remains paused in Phase I, and Level 1 and Level 2 self-assessment requirements remain active. On July 13, 2026, the Department suspended Phase II, including the originally scheduled November 10, 2026 expansion of the independent assessment path. Use the C3PAO and later-phase explanations as a reference for the originally scheduled phase-in. They become current only if the Department changes the program status.
The paid readiness engagement
The required level and assessment type set the path. The boundary sets the review. Remediation and documentation follow what is actually in place. Each step gives the next one a clear input.
Review the solicitation, clause, or flowdown. Confirm the required level and assessment type, award timing, and information the contract will place with your team. The team knows what must be in place before award.
Trace FCI or CUI through people, facilities, systems, cloud services, external providers, and subcontractors before reviewing requirements. The control review starts with the right assets and owners.
Compare what exists with FAR 52.204-21 or NIST SP 800-171, order remediation by dependency, and support SSP or limited POA&M work where the path permits it. Work follows the contract need and the real environment.
Organize policies, diagrams, records, SPRS inputs, affirmation responsibilities, and assessment notes around what is actually in place. Owners know what to present and what to maintain.
After the free call
The proposal names the exact scope. Depending on what we agree, the work may include:
Timelines depend on the required level and assessment type, the FCI or CUI boundary, current controls and records, provider dependencies, and the amount of remediation in scope. The proposal sets the work, timing, and fees before paid work starts.
The first conversation
We use the free call to understand the contract trigger, required level, assessment type, timing, and where you are stuck. Bring the clause or flowdown if you have it. The call does not include a control-by-control assessment, written gap report, SSP, or evidence package.
If paid work makes sense, the proposal defines the scope, outputs, timing, and fees before work begins.
The short answers are here. The solicitation and information path still decide the requirement.
Phase II is suspended. On July 13, 2026, the Department suspended the requirements that were originally scheduled for November 10, 2026. CMMC remains paused in Phase I. Phase I self-assessment requirements remain active for Level 1 and Level 2 where the contract requires them.
Start with the solicitation, contract clause, or prime-contractor flowdown. During the current Phase I pause, it may identify Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) remain part of the program design but are not active Phase I assessment paths. The FCI or CUI your team will handle determines the information boundary.
Generally, yes. DFARS 252.204-7021 requires the clause to flow down when a subcontract or other contractual instrument requires processing, storing, or transmitting FCI or CUI, except for commercially available off-the-shelf items. The required level depends on the information being flowed down.
Level 1 does not permit POA&Ms. Level 2 permits limited conditional status under 32 CFR 170.21, excludes specified requirements, and requires a closeout assessment within 180 days. A POA&M is not a general substitute for completing the requirements.
No. Pilotcore supports readiness and implementation. If the Department restores an independent Level 2 assessment path and a future solicitation requires Level 2 (C3PAO), an authorized C3PAO conducts that assessment. Pilotcore does not determine the result.
Timing and fees depend on the required level and assessment type, the FCI or CUI boundary, existing controls and records, provider dependencies, and the amount of remediation in scope. If there is a fit, the proposal sets the work, timing, and fees before paid work begins.
Choose the next useful step
The readiness call is the primary path when a solicitation, flowdown, CUI boundary, or Level 2 assessment is in play. The guide is a quieter starting point for Level 1 research.
Talk it through
Clarify the required level, assessment type, likely scope, timing, and whether a paid readiness engagement is the right next step.
Level 1 self-directed path
Use it to work through FCI scope, FAR 52.204-21, evidence, and the annual self-assessment. If the solicitation names Level 2, book the call instead.
