CMMC · NIST SP 800-171 · DFARS
CMMC compliance, built in your cloud and kept current
Hyper Vigilance provides managed CMMC compliance. The work happens inside your own cloud tenant. You keep the tenant, its configuration, and the documentation and evidence produced for you; our tools stay ours. We keep it current between assessments.
Your contracts did not change in July
The timeline moved. The rules that decide what your contracts require did not.
-
On July 13, 2026 the Department of War suspended the November 2026 transition to CMMC Phase 2 and opened a 60-day review of the program. That review window has closed; the suspension remains in effect, and as of this page's review date the Department's CMMC library lists no further guidance. What that does NOT change: NIST SP 800-171 Rev 2 and DFARS 252.204-7012 still apply today, and CMMC Level 1 / Level 2 self-assessments still carry their contract designations. Level 2 (C3PAO) and Level 3 (DIBCAC) certification assessments wait; the Department still enforces NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments. The underlying rules were not rescinded — the timeline was.
Source: Department of War Chief Information Officer memorandum, "Removing Barriers to Defense Industrial Base Expansion: Immediate Suspension and Strategic Review …," July 13, 2026, cleared for open publication (26-P-1023); implemented by the Under Secretary of War (Acquisition and Sustainment) memorandum of the same date.
One discipline, many kinds of contractor
Your first question is whether this has been done for someone like you. The ledger answers it without naming anyone.
The contractors this practice has worked with make and repair hardware, run engineering and technical services, and write federal software and integrate federal networks. Different shops, same few moments: a requirement with a date on it, from a prime or a solicitation; a DFARS clause already in the contract; an export-control obligation on the technical data. Every month for five years we have sent the longest-running of them an invoice; the newest started this year. And the practice does not publish client names, client posture, or client stories — the work is done under confidentiality obligations that do not expire when a project does.
That still leaves the thing itself: what is being bought.
What you are buying
Your baseline, implemented and operated rather than advised, and your SPRS entry kept current while it runs.
You are buying the baseline itself, not advice about it. Of the 110 NIST SP 800-171 security requirements, we implement and operate 92 inside your tenant. Another 8 are performed by your own people and managed and tracked by us, and 5 are yours alone. The 5 physical-protection requirements sit with your own facilities, or are inherited from the cloud platform where your engagement carries a written cloud-only applicability statement. Implemented means the controls get built, not handed to you as recommendations. Operated means they keep running after the build — a control that has gone quiet is not meeting the requirement. The running is also what your score rests on: we prepare and maintain your NIST SP 800-171 Basic Assessment, so your SPRS entry stays current as the program runs.
The next question is ownership: what is yours while it runs, and what is still yours after.
What you own while it runs, and what you own after
Ownership is easy to assert and hard to check, so every line here names what you own in terms you can verify from your own side.
While it runs, the estate is yours: your environment, your data, your documentation — we operate within your tenant and never own it. The licences and subscriptions are bought in your name and stay in your name; we advise on what you need and never sit between you and the vendor. When it stops: no rented enclave, no lock-in — everything we build is yours at offboarding. As for the platform itself: we build and operate your program on GuardNet, a platform that stays ours. What it builds does not.
That leaves the other half of the question: what happens to it between assessments.
Your controls keep running between assessments
Compliance decays the moment it stops being operated. The controls keep running between assessments, so the next recertification is a refresh of records that are already current rather than a rebuild from scratch.
A program answers for itself on an assessment date, but it lives in the months no assessor is watching. This practice exists for that stretch. Recertification is a refresh, not a rebuild: your controls and artifacts stay current between assessments, so year 3 never means starting over on the documentation work.
So the fair question is whether anyone has actually run it this way, and for how long.
What the record shows
Ask any provider what they have actually operated, for whom, and for how long. This is the record.
CMMC readiness has been the work since the framework's first public drafts in 2019. The managed base has grown slowly and on purpose — more than twenty contractors have come onto the books since then.
Where to start
Your contracts already decide which of today's rules reach you — the timeline everyone was planning around moved, and they did not. A scoping conversation tells you which ones.
The form takes about a minute. It asks what prompted your search and nothing about your budget, and it tells you what not to put in it before you start typing.