CMMC Phase II is under a 60-day Department of War review - Now is the time to get a competitive edge
CMMC Phase II is under a 60-day Department of War review - Now is the time to get a competitive edge
Forgewise helps defense subcontractors achieve CMMC level 2. We help build audit-ready IT infrastructure without the big price tag. Position your business with a competitive advantage.
Most subcontractors are closer to compliant than they think they just need a clear map. Here’s what usually comes up
A self-assessment is a solid start. Full CMMC Level 2 builds on it with independent verification. Third-party assessments are paused under the current DoW review. You're still required to safeguard the information you handle. We help you close the gap on your timeline
Your MSP is great at renewals, patches, and keeping the helpdesk moving. Writing a System Security Plan, scoping a CUI enclave, and preparing for an assessment is a different discipline. It's what we are great at and do all the time.
Many shops assume "we just make the parts, that's not CUI." The technical drawings, SOWs, and spec sheets in your inbox often qualify. Knowing where that information lives is step one. And it's more straightforward than you'd expect.
Every service scoped specifically for small-to-mid-size DoD subcontractors. No bloated retainers. No generalist consultants. Real outcomes on your timeline.
Know what you're protecting and where it lives. We map every place controlled information touches your business: email, file shares, engineering drawings, SOWs, vendor portals. Most subcontractors are surprised by what qualifies. Better to see it now, on your terms.
A full evaluation of your environment against all 110 NIST 800-171 controls and 320 objectives. You get a straight answer on where you stand, a prioritized list of what to change, and a realistic timeline and before you commit to a remediation budget. No fluff. No upsell. Just a clear picture of where you stand and what to prioritize.
Already have a gap assessment? We execute the remediation. We've taken organizations from a failing posture to audit-ready in under 18 months, zero operational disruption.
CMMC Level 2 certification expires. Controls drift. Personnel changes. New systems get added outside your compliant environment. We stay engaged after the audit, annual affirmation support, control monitoring, policy updates, and assessor-readiness checks so you don't lose what you worked to earn.
Forgewise was founded by Nathan Kaufman and is built on a simple conviction: small DoD subcontractors deserve enterprise-grade IT leadership and compliance expertise, not a watered-down version of it.
With 25+ years of experience spanning defense contractors, healthcare systems, and enterprise infrastructure, I’ve built IT departments from zero, survived audits, navigated M&A integrations, and hardened organizations against every threat vector CMMC is designed to address.
Most recently, I built and led the IT department at a DoD subcontractor from the ground up, achieving CMMC Level 2 audit readiness and delivering an M&A integration three months ahead of schedule.
A 260-person defense electronics subcontractor had no formal IT department, no documented security policies, and was 18 months from a required CMMC Level 2 assessment. We built everything from scratch, the infrastructure, policies, controls, and training plus delivered a passing assessment on time.
M&A integration executed simultaneously. Zero downtime. All completed ahead of schedule.
Common questions defense subcontractors ask before their first call.
Most organizations take 12–24 months from initial assessment to certification. Organizations with some existing controls can move faster. We’ll give you an honest timeline after the initial gap assessment.
It depends on your current posture. A gap assessment starts at a flat fee. Full remediation is priced per engagement based on scope. We’ll never quote you until we understand what you’re actually dealing with.
For the majority of CMMC Level 2 contracts involving CUI, a certified C3PAO assessment is required. Primes are already requiring a CMMC certificate. Nov 10th 2026, it will be required to have a C3PAO assessment and certificate completed.
Controlled Unclassified Information is federal information that requires safeguarding but is not classified. Examples include technical specs, export-controlled files, contract data, and engineering drawings. If you receive any of this from your prime contractor, you’re likely handling CUI.
Requirements are set by each solicitation and flow down from your prime. The current DoW review has paused third-party assessments, but the obligation to protect CUI under DFARS 252.204-7012 remains. Being ready with your scoping, controls, and evidence in place keeps you eligible when assessments resume and competitive on every bid in the meantime.
We’ve actually done this inside a DoD subcontractor. The founder built the department, implemented the controls, and passed the audit.
Find out in 30 minutes — free. No pressure.
Just a real conversation with an IT leader who’s been through exactly what you’re facing.
Based in Rockford, IL · Serving DoD Subcontractors Nationwide · Response within 1 business day.
