July 13, 2026: the Department of War suspended CMMC Phase II pending a 60-day review — but NIST SP 800-171 obligations still stand. What it means for you
For DoD Subcontractors — 2 to 50 people

Keep your
DoD contracts.

Get CMMC Level 2 ready without building your own compliance department. You run an engineering firm, a machine shop, a manufacturer, a software team — not a cybersecurity company. Lionfish works by, with, and through your people so it stays that way.

CMMC Phase II is suspended — your NIST SP 800-171 and DFARS obligations are not, and primes are ranking their suppliers by readiness today.

Service-Disabled Veteran-Owned Cyber AB Accredited Training Provider We train the assessors

Sound familiar?

The flow-down letter wasn't a suggestion.

  • !Your prime is asking for your SPRS score — and comparing it against every other supplier who does what you do.
  • !DFARS 252.204-7012 is in your contract — 110 security requirements you're already attesting to, whether anyone explained them or not.
  • !You have no one to give this to. IT is one person or an outside shop, and everyone who could own "compliance" already has a full-time job.

The stakes

  • Ready subs win. When primes trim supplier lists, readiness is the tiebreaker — the work of the unready gets inherited by the ready.
  • Honest scores protect you. DOJ settlements over false self-attestations hit $8.4M in 2025. Guessing is the expensive option.
  • The pause is your window. With Phase II suspended, this is the calmest, cheapest time to get ready there has ever been.

How it works

Know. Fix. Prove.

One team runs the whole journey with you — no consultant hand-offs, no homework dumped on your desk.

Know

Know exactly where you stand. Your level, your CUI boundary, your honest SPRS score — in plain English, in 30 minutes.

Fix

Fix what puts contracts at risk. Policies, technology, and training closed out with your people, at a pace a small company can actually sustain.

Prove

Prove you're secure. SSP, evidence, and artifacts organized the way assessors are trained to read them — because we train the assessors.

The CMMC Readiness Briefing — free

Thirty minutes. Straight answers.

Bring your contract information. You leave knowing your likely level, your CUI boundary, your SPRS position, and your next move — even if you never hire Lionfish.

Get in touch

Find out where your company stands

Tell us about your contracts and your timeline. We reply within one business day — and you leave the briefing with answers either way.

  • 1We reply within one business day — usually faster.
  • 2A 30-minute call with someone who can actually answer your questions.
  • 3A straight recommendation — even if it's that you don't need us yet.

Prefer to skip the form? Book a time directly or call 1-877-732-6772. Information you submit is handled per our Privacy Policy.

Find Out Where I Stand