For years, CMMC felt like a deadline that kept slipping. That era is over. The rules are final, the requirements are appearing in Department of Defense contracts right now, and for any federal contractor that touches Controlled Unclassified Information (CUI), CMMC Level 2 is turning into a hard condition of winning and keeping work. The pressure point is November — and how you choose to architect your compliance now will decide whether you get there on time and on budget.
The instinct for many contractors is to move the entire company into Microsoft 365 GCC High and call it done. It's the "safe" assumption — and it's frequently the slowest, most expensive, and most disruptive path to the same outcome. There's a smarter way: isolate the small slice of your business that actually handles CUI inside a compliant enclave, and keep the rest of your organization where it is. That's exactly what AssuriTrust's ReadyGov 360 is built to do.
What the government is actually requiring
CMMC — the Cybersecurity Maturity Model Certification — is the Department of Defense's program for verifying that contractors protect sensitive government information. It has three levels. The one that matters for most of the defense industrial base is Level 2, which applies to any contractor that stores, processes, or transmits CUI.
Level 2 isn't a vague "be more secure" mandate. It maps one-to-one to NIST SP 800-171 — 110 specific security controls across 14 domains, broken down into 320 assessment objectives you have to satisfy. Depending on the contract, you'll either complete a self-assessment or be required to pass a formal assessment by an accredited third party (a C3PAO), then post your score in the government's SPRS system and re-affirm your compliance every year.
- Who it covers. Prime contractors and subcontractors alike — if CUI flows down to you, the requirement flows down with it.
- What it takes. All 110 NIST 800-171 controls implemented, documented in a System Security Plan, with a POA&M for any remaining gaps.
- How it's enforced. The DFARS clause (252.204-7021) makes a current CMMC certificate a condition of award — and the Department of Justice is actively pursuing false compliance claims under the False Claims Act.
The November deadline you're racing
The CMMC rollout is phased, and the phase that changes everything arrives this November. Phase 1 went live on November 10, 2025, when CMMC requirements began appearing in DoD solicitations. The bigger shift comes with Phase 2, beginning November 10, 2026, as third-party C3PAO Level 2 assessments start being written into a growing share of covered solicitations — not a self-attestation you can complete in a weekend, but an independent audit you have to pass. Full, mandatory inclusion across all applicable contracts then phases in over the following years.
Here's why that timeline is tighter than it looks. A realistic Level 2 program takes 12 to 18 months to stand up, and C3PAO assessment slots are filling fast. The window between a solicitation dropping and the award decision is often only a few weeks — far too short to begin your compliance journey after you see the opportunity. And there is no official grace period: if a contract requires CMMC status at award and you don't have it, you're simply ineligible.
The contractors who win in November aren't the ones who start in November. By then, the work has to be done.
The expensive default: moving your whole company to GCC High
Microsoft 365 GCC High is a government-tailored cloud built to handle CUI and meet DFARS and NIST requirements. It's a legitimate, capable platform — and for some organizations it's the right answer. The mistake is assuming the only way to comply is to migrate your entire organization into it.
When everyone and everything moves to GCC High, your whole environment falls inside the assessment boundary. That means every user, device, and system has to satisfy all 110 controls — even the majority of your people who never touch a single CUI file. The result is predictable:
- Premium licensing for everyone. GCC High seats cost more than commercial Microsoft 365, and you're paying that premium across the whole company, not just the CUI users.
- A long, disruptive migration. Moving every mailbox, file, and app into a government tenant is a major project that can stall productivity for months.
- Feature and integration gaps. GCC High doesn't always have parity with the commercial cloud, so tools your teams rely on may break or disappear.
- A bigger, riskier audit. A larger boundary means more to secure, more to document, and more that can go wrong on assessment day.
The smarter path: a scoped CUI enclave
A CUI enclave flips the problem around. Instead of dragging your whole company into scope, you build a secure, isolated environment — think of it as a locked room inside your larger building — where only the systems and people that handle CUI operate. Everything else stays on your existing commercial Microsoft 365.
That single architectural decision is the biggest lever you have over the cost, speed, and risk of CMMC. Because the 110 controls only have to be satisfied inside the enclave, you shrink the assessment boundary dramatically — which means less to implement, less to document, fewer premium licenses, and a faster path to a passing assessment.
- Pay for compliance where it's needed. Only your CUI users sit in the hardened environment; the rest of the company keeps working as they always have.
- Move faster. A focused enclave can be stood up and assessed in a fraction of the time a full-tenant migration takes.
- Reduce audit risk. A smaller, purpose-built boundary is far easier to secure and prove to a C3PAO.
For the typical contractor — where CUI work is a meaningful but contained part of the business — the enclave is usually the more sensible choice. A full GCC High migration tends to make sense only when CUI is woven through nearly everything your organization does.
How ReadyGov 360 gets you to Level 2
ReadyGov 360 is AssuriTrust's CMMC compliance offering, built around exactly this enclave-first philosophy. Rather than handing you a checklist and wishing you luck, the approach is designed to pair a scoped CUI enclave with hands-on guidance through the program:
- 1
Scope it correctly
It starts by mapping where CUI actually lives in your business and drawing the smallest defensible boundary around it — so you're not paying to secure systems that never needed to be in scope.
- 2
Stand up the enclave
The enclave is meant to give your CUI users an isolated environment aligned to the NIST SP 800-171 controls, so you're not piecing the architecture together from scratch.
- 3
Implement and document the controls
The focus is on putting the 110 controls in place inside the enclave and assembling the evidence an assessor expects — a System Security Plan, policies and procedures, and a POA&M for any open items.
- 4
Get assessment-ready
The goal is to walk in ready for the C3PAO assessment — gaps closed, artifacts organized, and your SPRS posture reflecting reality before an auditor ever arrives.
- 5
Stay compliant
Compliance isn't a one-time event, so the approach also covers the ongoing monitoring and the annual affirmation that keep your certificate valid for the life of your contracts.
Don't wait for the solicitation
The contractors who treat CMMC as a paperwork exercise to start once they win a bid are the ones who will lose eligibility this cycle. The ones who win will have made the architecture decision early — scoping tight, building an enclave, and getting assessment-ready well before November.
If you handle CUI and you're staring down the Level 2 requirement, the most important choice in front of you isn't which vendor — it's how big a boundary you're about to commit to. ReadyGov 360 exists to keep that boundary small, your costs down, and your timeline realistic. Talk to AssuriTrust about a scoping assessment, and find out how much of the expensive, all-in GCC High migration you can avoid entirely.