An in-kind cybersecurity grant changes your company fast. In ninety days, you go from guessing about CMMC to knowing where you stand.
The timing matters. A July 13, 2026 memo from the Department of War paused the move to CMMC Phase 2. A new analysis from Cherry Bekaert makes the key point plain: the requirements have not gone away.
Does the CMMC pause mean I can wait?
No. The pause is about the timing of Phase 2. It does not erase rules already in your contracts.
If a contract carries DFARS clause 252.204-7012, you already owe the protections in NIST SP 800-171. Clause 252.204-7019 also calls for a current self-assessment score in SPRS. That is the government's Supplier Performance Risk System.
How long the pause will last is not settled. So here is a real question for you: do you know which of your contracts carry those clauses?
What happens in the first month of an in-kind cybersecurity grant?
The first month is about seeing clearly. Big fixes wait until you know what you have.
- Find the data. Where does Federal Contract Information live? Where does Controlled Unclassified Information live? Think email, laptops, shared drives and phones.
- Draw the line. Scoping decides which people, devices and systems are in bounds. A tight scope means less work later.
- Check the gaps. Each requirement is compared to what you do today. Level 1 has 15 requirements. Level 2 has 110.
Month one ends with a gap list in plain words. You should be able to read it and say, "Yes, that is us."
What gets fixed in month two?
Month two is hands-on work. The gap list becomes a short set of fixes, in order.
Early fixes tend to be basic but strong. Think multifactor sign-in, patching, cleaning up old accounts, tested backups and turning on logs.
This is where in-kind support shows. The work and expertise come to you, at no cost to you. Your team works alongside the experts and learns why each change matters, so it sticks.
What do I have at day ninety?
You should have documents that match reality. That is what an assessor, or your prime, will ask to see.
- A System Security Plan that shows how you meet each requirement.
- A Plan of Action and Milestones for any gaps still open, with owners and dates.
- A self-assessment score you can stand behind in SPRS.
- One person inside your company who owns security day to day.
Ninety days will not finish every company. Level 2 can take longer, and that is normal. What is left is written down and owned.
How does this change how my prime sees me?
Primes must pass CMMC requirements down to their subcontractors. When they review their supply chain, they want suppliers who are not a question mark.
A small shop with a real plan, a real score and clear records is easier to keep. It is also easier to bring onto the next bid.
Your customers and community notice too. "We protect your data, and here is how" builds trust that lasts. What would change for you if your prime stopped wondering about you?
Want help with the first steps? Learn how Cyber Grants Alliance in-kind cybersecurity grants work, at no cost to you, or apply for in-kind support.
Frequently asked questions
What is an in-kind cybersecurity grant?
An in-kind cybersecurity grant is support delivered as hands-on work and expertise. Experts do security and compliance work alongside your team, at no cost to you. You keep the plans, the fixes and the know-how when the work is done.
Does the CMMC Phase 2 pause change what I owe today?
No, the pause does not remove duties already in your contracts. If a contract has DFARS 252.204-7012, NIST SP 800-171 still applies. Clause 252.204-7019 still calls for a current SPRS score. How long the Phase 2 pause will last is not settled.
Will ninety days get me fully CMMC ready?
Not always, and that is fine. Ninety days can deliver a clear scope, key fixes, a System Security Plan and a written plan for the rest. Level 1 companies often get much further. Level 2 has 110 requirements, so it can take longer.
What does this mean for my business?
It means you can use the pause to get ready instead of waiting. A strong first ninety days gives you records your prime can trust. It also gives you a team that knows its role. Starting now beats scrambling later.