Solutions · Defense Industrial Base
The CMMC deadline moved. Your self-assessment didn't.
In July 2026 the DoD suspended the Phase 2 third-party (C3PAO) certification deadline that was set for November 10. What did NOT move: Phase 1 remains in force — Level 1 and Level 2 self-assessments and a posted SPRS score are still eligibility conditions in DoD solicitations, primes keep flowing requirements down-chain, and a posted score is a federal representation you have to be able to stand behind. An assessment — self or third-party — measures what your controls actually did, not what your SSP says. SAUTERA™ gives you continuous device-trust scoring and evidence automation across the NIST 800-171 practices that live at the device layer.
The clock
A suspended deadline is not a suspended requirement
Phase 1 still binds
Suspension hit the third-party certification phases — not the self-assessment. New DoD solicitations still condition eligibility on a current Level 1/2 self-assessment and a posted SPRS score, and primes are pushing the same demands to their suppliers.
Your score is a representation
An SPRS score is posted to the federal government under the False Claims Act's shadow. A generous number with no evidence behind it is a worse position than an honest one with a remediation plan — the risk attaches to the score you post, not the certificate you don't have yet.
Evidence, not intentions
Level 2 spans 110 NIST 800-171 practices, self-assessed today and third-party-assessed in whatever form Phase 2 returns. Proof the controls operate over time is what counts either way. A folder of screenshots assembled the month before is exactly the fire drill that fails.
The practical consequence: evidence generation has to be running now, continuously, so that when your assessment window opens you export a package instead of starting a project. That is the difference between compliance evidence and a fire drill.
The mapping
Where device-trust scoring meets NIST 800-171
The SAUTERA Witness sensor observes each device directly — Windows and Linux sensors today, plus agentless coverage over SSH, WMI/WinRM, and SNMP — and concludes a continuous 0–100 trust score from what it sees. Here is where that carries evidentiary weight across CMMC Level 2 practice families.
SI — System & Information Integrity
3.14.1–3.14.7
Patch currency, known-CVE exposure, and AV/EDR presence observed directly on each device and re-scored continuously — flaw remediation you can evidence, not attest to from memory.
CM — Configuration Management
3.4.1–3.4.9
Host firewall state, exposed listening surface, and configuration drift read at the source. When a baseline slips, the score moves and the record shows when and why.
SC — System & Communications Protection
3.13.11, 3.13.16
Disk-encryption posture observed per device — evidence that CUI at rest sits on encrypted volumes, refreshed as the fleet changes.
RA — Risk Assessment
3.11.2–3.11.3
Vulnerability scanning findings and lifecycle/EOL status feed the trust score, so remediation is prioritized worst-first on the BEACON triage board.
AU — Audit & Accountability
3.3.1–3.3.2
Every finding, decision, and human-approved fix is written to a tamper-evident Trust Delta Record — the raw material of an assessment-ready audit trail.
CA — Security Assessment
3.12.1–3.12.3
Continuous monitoring of control effectiveness at the device layer, exportable as evidence for your self-assessment, SPRS score, and C3PAO assessment prep.
When a device falls out of line, SAUTERA doesn’t stop at the finding: closed-loop remediation (human-approved) recommends the fix and applies it once a person signs off — patching, service, and configuration changes through the opt-in sensor, each one landing in the same tamper-evident record. Zero Trust tells you who. SAUTERA tells you whether. Read continuous, observed, enforced and what the trust score measures for how the scoring works, or see the full platform.
Straight talk — what SAUTERA is not
SAUTERA is not a CMMC certification, and no software makes you CMMC certified. Only an authorized C3PAO assessment organization can certify you at Level 2, against the full 110-practice scope — which includes policy, personnel, training, and physical practices no monitoring platform can observe. What SAUTERA does is narrower and honest: continuously monitor the device-layer practices above, catch drift before an assessor does, and generate tamper-evident records so the technical-control portion of your assessment is evidence you export rather than a scramble you run. Vendors promising “guaranteed certification” are selling you the scramble. Our own standard for that honesty is on the trust page.
Speaking federal
Comply-to-connect, ISCM, and ATO evidence
If your program office already talks this language, here is where SAUTERA fits.
Comply-to-connect (C2C)
The DoD posture that a device must demonstrate compliance before it participates. SAUTERA's per-device trust verdict is exactly that demonstration: observed posture, concluded continuously, available at the moment of access.
NIST SP 800-137 — continuous monitoring (ISCM)
Information Security Continuous Monitoring asks for ongoing awareness of security state, not annual snapshots. SAUTERA's continuous re-scoring of every device is an ISCM-aligned implementation at the infrastructure layer.
ATO evidence
An Authorization to Operate lives or dies on current, credible evidence. SAUTERA's tamper-evident records give assessors and authorizing officials device-layer proof that controls operate between assessments — not just on assessment day.
Free download
The SPRS Self-Assessment Evidence Checklist
All 14 NIST 800-171 families, and what evidence you must actually be able to produce behind the score you post — not just attest. Includes the scoring trap (why most first honest scores are negative, and why that’s the defensible position) and the continuous-evidence playbook for whenever Phase 2 returns.
Start the evidence trail before the queue starts.
Free on 10 devices. Pro at $5,000/yr with the first 50 devices included — running before your assessment window opens.
Certification is suspended, but the attestation isn’t. What proves the SPRS score you signed is still true today.