BRITECITY Report EmailReport a Suspicious Email

BRITECITY

The CMMC Workflow

The timeline to CMMC readiness, and why the November 10, 2026 deadline means starting the clock now.

Make IT Easy

The Deadline

Why November 10, 2026 matters

Phase 2 begins

November 10, 2026 starts CMMC Phase 2, when DoD begins requiring Level 2 C3PAO certification assessments in solicitations for contracts involving CUI.

Certification, not self-attestation

Phase 1 allowed self-assessment. Phase 2 requires an independent, accredited third-party assessor to verify you, a higher bar that takes longer to reach.

Readiness takes months

Foundation, assessment, proposal, and remediation are a multi-month workflow, not a form you fill out the week a contract drops.

Work backward from the date

Count the workflow back from November 10, 2026 and the start point lands in the present. Waiting for the clause to hit your solicitation is too late.

Phase 2 is the moment third-party Level 2 certification starts appearing in solicitations. The workflow that gets you there has to start well before then.

The Math

Count backward, and the start line is now

Nov 10

2026

Phase 2, Level 2 third-party certification required in solicitations

6–7

months

Typical end-to-end workflow, foundation through remediation

Now

start

Subtract the workflow from the deadline and the start line lands here

The full path, foundation, the 12-week assessment, the proposal, and remediation, runs roughly six to seven months of focused work.
That is before you schedule a C3PAO or absorb any longer remediation on the harder gaps.
Subtract that from November 10, 2026 and the start line is now. There is no slack left to wait.
You cannot be awarded a Phase 2 contract without the required certification. Starting when the clause lands in your solicitation is starting too late.

The Timeline

From day one to remediation

Day 1
Engage your IT services company
Sign the managed IT services agreement.
Day 30
Begin onboarding
Discovery, documentation, and tooling rollout get underway.
Day 60
Foundation in place
Onboarding complete. The managed IT services foundation is established.
Day 61
Engage the assessment
The third-party Security Maturity Level Assessment and CMMC assessment begins.
12 weeks
Gap analysis delivered
The assessment ends with the checklist of gaps.
+2 weeks
Proposal
Your managed IT services organization delivers the remediation proposal.
Sign
Approve the proposal
You review and sign off on the scope.
+4–8 weeks
Execution
Technical remediation runs, sometimes longer, while your team works its own gaps in parallel.

Roughly six to seven months of focused work, before you account for scheduling a C3PAO or any longer remediation. That is why aligning around November 10, 2026 means engaging now.

The Big Picture

Three phases behind the timeline

Build the foundation

Your managed IT services company

A provider that understands your network establishes the security services running your infrastructure, documents where data lives and how it moves, and resolves general security concerns. This is the foundation everything else is measured against.

Assess the gaps

3rd-party CMMC consultant

Once the foundation is in place, an accredited consultant runs a 12-week Security Maturity Level Assessment with a CMMC add-on. Your leadership team and your IT company answer questions and the assessment produces a checklist of gaps.

Close the gaps

Shared, you, your IT company, your processes

BRITECITY delivers a proposal to address the gaps. After sign-off, technical remediation runs in parallel with the process and HR work your organization owns.

Phase 1, Day 1 to 60

It starts with your IT service provider

01
A provider who actually understands your network, not a stranger learning it during an audit
02
Establish and document the security services running across your infrastructure
03
Identify where your data lives, every system, app, and cloud tenant that holds it
04
Map how data moves through the organization, between people, systems, and vendors
05
Surface general security concerns, and make sure they are solved, not just noted

This is the foundation. Without it, a CMMC assessment has nothing solid to measure.

Phase 1, Why First

Why the IT foundation has to come first

You cannot assess what you do not understand

A third-party assessment measures your environment against the standard. If the environment is undocumented or unstable, the assessment stalls before it starts.

The consultant relies on your IT company

During the assessment the consultant asks technical questions and depends on your IT provider to answer them and to own the remediation work that follows.

A managed foundation is a known baseline

Onboarding with a managed IT partner gives you a documented, monitored, and stable environment, the only thing worth measuring against a compliance standard.

Phase 2, Day 61 onward

A 12-week Security Maturity Level Assessment, with a CMMC add-on

Once the foundation is in place, a third-party CMMC consultant engages under a 12-week consulting agreement. Typically your leadership team and your managed IT services company are in the room together, leadership knows the business, IT knows the environment.

Engagement

12-week third-party consulting agreement

In the room

Your leadership team + your managed IT company

What it is

Security Maturity Level Assessment + CMMC add-on

Phase 2, Scope

What the 12 weeks identify

What is critical to the business, and what is not
Where CMMC-relevant content resides, specifically CUI (Controlled Unclassified Information)
How that content flows through people, systems, and outside vendors
Current state, measured against the controls the standard requires

CUI, Controlled Unclassified Information, is the heart of the scope. Knowing exactly where it lives and how it flows is what the assessment exists to establish.

The Output

The output: a checklist of gaps

The 12-week assessment ends with a gap analysis, a checklist of everything standing between your current state and the standard. Ownership of that checklist splits three ways.

Your organization

Process and policy gaps, often HR-related. Written policies, security awareness, personnel and offboarding procedures, business decisions about scope.

Your managed IT company

Technical gaps, MFA, encryption, monitoring, segmentation, account lifecycle, configuration, and the tooling that enforces the controls.

Shared

Items that need both, leadership decisions paired with technical implementation, documented together in the plan.

Phase 3, The Proposal

What you can expect from BRITECITY

After the assessment, we deliver a proposal to address the gaps identified during the Security Maturity Level Assessment and CMMC assessment. It scopes the technical remediation BRITECITY owns, with effort and timeline attached.

The proposal addresses the gaps identified during the Security Maturity Level Assessment and CMMC assessment, scoped, not guessed.

Ownership

Who owns what

You (leadership)

Business-critical vs. non-critical decisions
Process and policy gaps
HR and personnel procedures
Scope decisions and budget sign-off

BRITECITY (managed IT)

The IT foundation and onboarding
Technical remediation of the gaps
Answering the assessor’s technical questions
The proposal and its execution

3rd-party consultant

The Security Maturity Level Assessment
The CMMC add-on assessment
The gap analysis / checklist
CMMC interpretation and artifacts

Next Steps

Start the clock now

01
CMMC Workflow Call
Free 30-minute call. We map where you are in the workflow today, confirm the level your contracts require, and lay out the realistic timeline to November 10, 2026.
02
Engage Managed IT
Sign the managed IT services agreement and begin onboarding, the foundation step every later step depends on.
03
Security Maturity & CMMC Assessment
Once the foundation is in place, the third-party consultant runs the 12-week assessment that produces your gap checklist.
04
Proposal & Remediation
We propose the work to close the technical gaps; your team closes the process and HR gaps in parallel.

Book a CMMC workflow call

britecity.com/book-a-call , 30 minutes, free, no commitment. We map where you are in the workflow and the path to November 10, 2026.

Make IT Easy

BRITECITY · CMMC Compliance Workflow · 2026

1 / 14