Start a scoping conversation

You need to know what your contracts actually require before you commit to anything. Something landed — a prime pushed a flowdown, a score got questioned, or an assessment appeared on the calendar — and that is a shorter conversation than most people expect.

Take me to the form

Why this comes up now

Your obligations did not move when the timeline did. That is what brings the question up now.

On July 13, 2026 the Department of War suspended the November 2026 transition to CMMC Phase 2 and opened a 60-day review of the program. That review window has closed; the suspension remains in effect, and as of this page's review date the Department's CMMC library lists no further guidance. What that does NOT change: NIST SP 800-171 Rev 2 and DFARS 252.204-7012 still apply today, and CMMC Level 1 / Level 2 self-assessments still carry their contract designations. Level 2 (C3PAO) and Level 3 (DIBCAC) certification assessments wait; the Department still enforces NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments. The underlying rules were not rescinded — the timeline was.

Source: Department of War Chief Information Officer memorandum, "Removing Barriers to Defense Industrial Base Expansion: Immediate Suspension and Strategic Review …," July 13, 2026, cleared for open publication (26-P-1023); implemented by the Under Secretary of War (Acquisition and Sustainment) memorandum of the same date.

Nothing on this page is counting down at you. The memorandum above is the current status as of this page's review date, and it is cited.

Take me to the form Where what you send lives

What a first conversation covers

You get an answer, and a clear account of what it will refuse to pretend. These are the stances held before any engagement exists, so you can check them against whoever else you are talking to.

What no one can promise

No one can guarantee your certification — and the fact that assessors decide is why we won't pretend otherwise; here is what we can prove instead.
Said before you sign

Full operating maturity is not day one — we tell you what the baselining window looks like before you sign.
In writing

Every answer, in writing.

What a first conversation asks

These are the questions the conversation runs on — published so you can see the scope of the ask before you commit to it. They are asked live, not in the form; the notice under the form still governs what you send in writing.

A first conversation is a diagnosis, not a pitch. It establishes where you stand - current state, assessment timeline, environment, compliance gaps - and whether the engagement fits what you need. Nothing is proposed until that is established.
When is your CMMC assessment scheduled? Are you currently in a GCC High environment? How many users handle CUI, and how many do not? Who manages your compliance documentation today? Do you have an existing System Security Plan (SSP)? What's your current evidence collection process? Have you had a gap assessment, and what were the key findings? Are you working with any other compliance vendors?

Where what you send lives

You should ask any compliance provider this before you tell them anything. The answer for an engagement is below; the answer for this form is in the notice beneath it.

Stays in your environment

Your tenant and your data are yours from day one, and everything we build runs on Microsoft 365's own tools inside it. The design keeps your CUI in your own tenant, not on our systems. Under the CMMC rule, a provider whose systems hold your CUI either meets FedRAMP requirements as a cloud provider or has its services examined as part of your assessment. Certifying the provider itself is voluntary (32 CFR 170.19(c)(2)). Our services and people sit inside your assessment scope — your SSP, your Shared Responsibility Matrix, and your assessor interviews.

Tell us what changed

You answer five short questions, add an optional note, and — if a call would help — three optional answers about when you are reachable. Read the notice before you reach the note field; it is the part of this page doing the most work.

Before you type: what not to send us

Do not put CUI, FCI, ITAR or export-controlled technical data, contract or program identifiers, or distribution-marked material into this form. This is a commercial, unclassified intake channel and it is not an authorized boundary for controlled information. Tell us the shape of the situation instead — we will stand up an appropriate channel before you send us anything sensitive.

This is checked on our side, not just yours. If any field looks like controlled content, that field is not kept, and the note is not kept with it. Whatever came through clean is kept: the contact fields that did not trip, your work email among them, and your answers to the menu questions. The page tells you exactly which fields were not kept. The check finds markings and identifiers, not plain prose, so do not type controlled detail at all.

Your name

Work email

We reply from a team mailbox, not an individual.

Company

What prompted the search

Pick the closest one. This is what routes the conversation.

How you found us

Anything else worth knowing (optional)

One or two sentences on what triggered the search. The check finds markings and identifiers, not plain prose — do not type controlled detail at all. 300 characters.

If you want a call, say roughly when

This part is optional — the form is complete without it. Tell us when you are generally reachable and we will come back from the team mailbox with two or three specific times. Nothing is held or confirmed until you pick one.

When you are usually reachable (optional)

Your time zone (optional)

How soon this matters (optional)

An honest answer here is more useful than an urgent one.

There is no third-party scheduling page here and this site loads no calendar widget, so nothing you enter is handed to a scheduling vendor. The trade is honest: a person answers, which takes hours rather than seconds.

A bot check may load here from an outside service. If your network blocks it, submit anyway — the form still works and your message still reaches us.

If this form does not work for you, for any reason, write to the team mailbox instead and say what you would have typed here — minus anything the notice above rules out. engage@hypervigilance.com

What happens to what you send

Collected: your name, work email, company, what prompted the search, how you found us, anything you write in the note field, and — only if you fill them in — the three optional answers about when a call would suit you. No phone number is asked for and none is required.
Where it goes: a queue on our own hosting, then our own records. It is not handed to an outside marketing or sales platform, and it is not used for advertising.
How long it stays: the note field is purged after 90 days whatever the outcome. Contact details are purged after 24 months if the conversation does not become an engagement.
On this page: no outside analytics, no advertising pixels, no session recording. The only outside thing this form can load is a bot check, and if your network blocks it your submission still goes through.