New CMMC FAQs Just Dropped: Let's Break it Down

Current update, October 6, 2026: this archived article describes the earlier rollout. The planned November 2026 Phase II expansion is now suspended; Phase I self-assessments and safeguarding duties continue. Confirm actual contract terms and amendments before acting. See the official CMMC notice and updated planning guide.

The latest CMMC FAQs Revision 2.1 landed this month. I spend every day helping federal contractors through this maze, so here is my read on what matters in them, what's changing, and how to position your business for 2026 and beyond.

November 10, 2025 is no longer a distant date. It's a line in the sand.

CMMC Goes Live November 10, 2025: No More "We'll Get to It Next Quarter"

One of the most important confirmations in the new FAQs is the official go-live date for CMMC requirements in solicitations. Phase I began November 10, 2025 for applicable procurements. Do not assume every existing contract changed on that date; review the instrument and required assessment level. The current update above explains the subsequent Phase II suspension.

For the first year, the DoD is softening the blow: Level 1 is a self-assessment, Level 2 is mostly self-assessment, and Level 3 is a DoD-led assessment.

Still, this is the start of enforcement, and of the move from "promise you're secure" to "prove you're secure."

Your Cost Depends on How Clean Your Environment Is

Cost is another common question in the contractor community, and the FAQs are clear on it: the government does not consider CMMC a "new cost."

The government expects you to have already implemented everything in DFARS 252.204-7012, which means your SIEM, logging, MFA, encryption, incident reporting, and SSP should already be in place.

What separates one contractor's cost from another's is how clean its environment is today.

At inDirectIT, we see three basic categories:

1. Mature companies
They've already built secure enclaves, use GCC High properly, and have a healthy SSP.
Estimated cost: Minimal.

2. Mid-maturity companies
They've started but have gaps, especially in logging, segmentation, access control, and documentation.
Estimated cost: Moderate.

3. Legacy environments (most common)
They grew without a plan, and their data sprawls across personal devices, cloud apps, local servers, and shared drives.
Estimated cost: High without a remediation strategy, reasonable with the right phased plan.

NIST SP 800-171 Rev. 3 Is Coming, But You're Still Being Scored on Rev. 2

A big concern in the community has been the jump to NIST 800-171 Revision 3.

The good news is that the DoD confirmed all assessments will still be based on Revision 2 until rulemaking is complete.

You can implement Rev. 3 now, but you must follow DoD's special parameters. Jump too early or configure things incorrectly and you'll fail Rev. 2, even though Rev. 3 controls are technically "stronger." Plan the move before you make it.

Encrypted CUI Is Still CUI

A new FAQ confirms something we've been telling clients for years: encrypted CUI is still CUI, even when it sits in Microsoft's cloud and is unreadable to the human eye. That means it must still:

1. Stay inside FedRAMP Moderate-equivalent systems
2. Follow all NIST 171 requirements
3. Be handled by assessed service providers
4. Have proper access control and monitoring

That rule alone disqualifies 90% of off-the-shelf software from being "CUI-compatible."

SPRS Submission Errors Are Still the #1 Roadblock for Contractors

The FAQs address the common SPRS error: "No CMMC Score" or "No CMMC Status."

The most common cause is marking the System Security Plan as "Not Met," which is an automatic failure.

Every contractor must have a complete, accurate, and current SSP, and you cannot POA&M it.

This is a red flag we see often in our assessments:

Companies treat the SSP like a Word document instead of a living system.

If your SSP doesn't match reality, your compliance program is already off track.

VDI Can Keep Your Endpoints Out of Scope If You Do It Right

One addition I found fascinating is the clarification on Virtual Desktop Infrastructure.

According to the DoD, if your VDI prevents any CUI storage, processing, copying, printing, or local caching, the endpoint is out of scope.

This is huge for companies with:

1. BYOD environments
2. Field workers
3. Overseas teams
4. High turnover
5. Tight budgets for endpoint hardening

But there's a warning:

If your VDI isn't configured perfectly, the endpoint becomes a CUI asset automatically.

That is why our team works with clients to build CMMC-aligned virtual enclaves for GCC High and Azure Gov.

Your External Service Providers Are Part of Your Assessment

The FAQs settle this: your MSP and MSSP will be evaluated as part of your assessment. If they:

1. Touch your systems
2. Manage your security tools
3. Manage your Microsoft tenant
4. Hold admin credentials
5. Provide help desk or security services

then they're in scope.

They don't need their own certification, but they must be able to prove compliance with your controls. That's why inDirectIT built one of the first CMMC-aligned MSP stacks designed for GovCon clients.

So What Should Contractors Do Right Now?

My CEO-level advice, after reading the new FAQs and living in this world every day:

1. Perform a real NIST 800-171 self-assessment
Review every control, one by one, instead of running a checkbox exercise or an automated tool.

2. Build your SSP and POA&M as if an assessor were coming tomorrow
One is coming, though maybe not officially until late 2026 or 2027.

3. Segment CUI into a dedicated, controlled enclave
Secure the flow of CUI instead of trying to secure the entire company.

4. Choose your cloud carefully
If you handle CUI, GCC/GCCH or Azure Gov is no longer optional.

5. Review your MSPs and external vendors
A provider that can't talk CMMC can't support your CMMC program.

6. Start building your culture of cybersecurity maturity
Compliance shows where you stood on assessment day; security has to hold up every day after. The companies that invest in both will win in this new era.

Final Thoughts from inDirectIT

These FAQs are the clearest signal yet that the DoD is done waiting. The government is tightening requirements and auditors are ramping up, and the contractors who adapt now will dominate the defense market for the next decade.

At inDirectIT, we help federal contractors design, implement, and maintain compliant technical environments that also improve how the business runs day to day.

If you want us to evaluate your readiness, build a compliant enclave, or guide your leadership team through the new requirements, we're here for you. Let's tackle it together.