Hosted by Adam Starnes and joined by Jaclyn Jones, MAD Security’s CMMC Compliance Lead, this session looked ahead to 2026 while drawing hard lessons from real assessments completed in 2025. The discussion was intentionally practical, reflecting how CMMC actually unfolds inside organizations rather than how it looks on paper.
With the 48 CFR final rule now in effect and CMMC Phase One underway, the message was clear. Organizations that treat 2026 as a future problem are already behind. Preparation today is what reduces risk, cost, and disruption tomorrow.
|
CMMC Enforcement Is Accelerating Through the Supply ChainWhile not every contract includes CMMC language yet, enforcement is happening faster than many expected. Prime contractors are pushing requirements down to subcontractors through supplier questionnaires, bid eligibility checks, and renewal language. For 2026, CMMC does not suddenly begin. It accelerates. Organizations that wait for formal contract language often find themselves scrambling under prime-driven timelines. |
SPRS Scoring Now Demands Accuracy and EvidenceA major change discussed was the updated SPRS affirmation process. Organizations must now meet a minimum score of 88 to affirm CMMC Level 2 self-assessments, and that score is calculated based on how each control is answered. You can no longer enter a number and fix gaps later. Every response must be backed by real evidence. Submitting an optimistic score without support creates compliance risk and potential False Claims Act exposure. Callout: If it is not documented and supported by evidence, assessors will not accept it. |
|
2025 Audit Findings Were Mostly Fundamental IssuesMany failed expectations in 2025 were not advanced technical failures. They were basic readiness gaps, including undocumented processes, policies that did not match technical configurations, and staff who were unprepared to explain how controls were met. Assessors expect maturity. That means 90 to 180 days of evidence for many controls, not last-minute implementations. |
|
POA&Ms Are Not a Safety NetRelying on Plans of Action and Milestones is a common misunderstanding. Only certain controls can be placed on a POA&M, there are limits to how many, and critical controls are not eligible. The safest approach is simple. Go into the assessment aiming to meet all 110 controls. POA&Ms should be the exception, not the plan. |
|
CMMC Is an Organization-Wide EffortCMMC is not an IT-only exercise. HR, leadership, external service providers, and operations all play a role. Assessors will interview the people responsible for each process, not just the security team. Without leadership buy-in, organizations struggle to align time, budget, and accountability across departments. |
MAD Security helps organizations stay in a continuous state of compliance readiness rather than cramming for audits. Through GRC gap assessments, remediation support, Virtual Compliance Management, and a fully U.S.-based 24/7 SOC, MAD Security supports clients before, during, and after certification.
MAD Security is a CMMC Registered Provider Organization with a perfect SPRS score of 110. The same experts who passed MAD Security’s own audit help clients prepare for theirs. This includes audit prep, staff readiness, mock assessments, evidence management, and post-certification support.
Callout: The same team that passed MAD Security’s CMMC Level 2 audit assessment helps guide clients through theirs.
Organizations that treat CMMC as an operational shift rather than a deadline-driven project consistently perform better during assessments.
MAD Security offers several free resources to help organizations evaluate their readiness:
| Free CMMC Pre-Assessment | |
| CMMC Master Bundle | |
| CMMC Assessment Guide | |
| Free Consultation with MAD Security |
CMMC readiness is not about checking boxes. It is about building sustainable security and compliance practices that support your business long term. The organizations that succeed in 2026 are the ones acting now, building maturity, and preparing deliberately.
You do not have to navigate this alone. MAD Security exists to simplify the process and help you move forward with confidence. If you are unsure where to start, now is the right time to find out!
Original Published Date: January 22, 2026
By: MAD Security