Since November 10, 2026, DoD solicitations can require a Level 2 certification from a C3PAO, not a self-assessment. For engineering, design and manufacturing firms that handle CUI as subcontractors, that is the line between bidding and not. The levels, the phase dates through 2028, the contract clauses behind them, and the enclave approach that keeps the scope small.
The CMMC acquisition rule was published on September 10, 2025 and took effect on November 10, 2025, adding clause 252.204-7021 to DFARS. Phase 1 put self-assessments into contracts. Phase 2, which began on November 10, 2026, adds third-party certification for Level 2.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
252.204-7021: hold the required CMMC status for the life of the contract, affirm continuous compliance annually in SPRS, and flow the requirement down to subcontractors that handle the same information.
252.204-7012: if a cloud provider stores, processes or transmits covered defense information, it must meet security requirements equivalent to the FedRAMP Moderate baseline. Report cyber incidents to DoD within 72 hours of discovery and keep affected images for at least 90 days.
Most engineering firms handle CUI on a minority of projects. Certifying the whole company means every laptop, file share and SaaS tool is in scope. An enclave puts CUI work in a separate, controlled environment (cloud workstations, file storage, email and collaboration for CUI projects only) and certifies that. Everything else stays outside the assessment boundary.
Find where CUI actually arrives and lives: contract documents, drawings, specifications, email.
Decide the enclave: an AWS account structure in GovCloud or commercial US Regions, cloud workstations (Amazon DCV or WorkSpaces), and a CUI-capable email and file platform.
Implement and document the 110 requirements for that boundary, with a system security plan.
Run a mock assessment, close gaps, then book a C3PAO. Only some requirements may be on a plan of action and milestones at assessment, and those must be closed within 180 days.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
CAD and BIM Workstations on AWS: Amazon DCV, GPU Instances, and When a Desk Workstation Is Cheaper
Cloud workstations put large models next to the compute, let contractors work without shipping hardware, and keep project data off laptops. They are not always cheaper than a workstation under a desk. How Amazon DCV and GPU instances work for Revit, Civil 3D, SolidWorks-class tools, the licensing questions to ask first, and where the cost crosses over.
Read
Engineering Simulation on AWS: Parallel Computing Service, ParallelCluster, and the Licence Problem
CFD, FEA and other solvers scale across many cores, which suits the cloud, but solver licences often cost more than the compute and decide the architecture. AWS Parallel Computing Service (managed Slurm), ParallelCluster and AWS Batch compared, what HPC instances and EFA add, and how to burst without paying for idle licences.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.