The cyber desk · CMMC 2.0
Cybersecurity for companies that cannot fail one. DoD contractors, their suppliers, and any US business that has watched a peer get breached. CMMC 2.0 stopped being a warning: since November 2025 it is a clause in live DoD contracts.
What this means, plainly: if your shop touches controlled unclassified information, the sensitive technical data that moves through defense work, you need Level 2. The assessment queue is growing and it only gets longer. Starting now is cheaper than starting late.
DEC 2024
The final program rule takes effect. The maturity model stops being a draft.
NOV 2025
The acquisition rule begins phasing CMMC clauses into new DoD solicitations. Self-assessments become a condition of award.
JUL 2026
The Pentagon suspended third-party certification on July 13, 2026, pending a program review. Self-assessments, SPRS scores, and DFARS 7012 still bind every contract that carries them. Brief 004 has the detail.
NEXT
The review sets the new schedule for third-party certification. Primes are still asking suppliers for status in the meantime.
THE FLOW-DOWN
You do not need a DoD contract to feel this. If your customer holds one, their compliance becomes your requirement.
One desk covers the whole job: finding the gaps, closing them, staffing them, and rehearsing the worst day. You can buy each piece separately. They work better together.
Independent gap assessments and audits against CMMC 2.0, NIST 800-171, DFARS, and FedRAMP, plus commercial frameworks like PCI for payment data and CPRA for California privacy. After the audit, we stay in the advisory seat until every finding is closed.
See pricingSelection and rollout of the controls that close the gaps: the tools, configurations, and policies your assessment says are missing. We work with your IT team, not around it.
Start your cyber readFrom a fractional CISO to full-time security administrators: hourly, per project, or placed on your payroll. Baran is the only mid-market firm where the assessment and the people who fix it come from the same desk. Employee security training and certification courses included.
Start your cyber readResponse planning, attack simulation, penetration testing, cyber insurance review, and 24/7 access to a response team. Prepared today beats improvised at 6am.
Start your cyber readThe Baran cyber desk is veteran-led, with operators whose backgrounds run through US Cyber Command and who hold the certifications behind every framework we audit.
We have defended networks that get attacked on purpose, daily. That experience is the product: the same habits and the same standards, pointed at your company before an adversary points anything at it.
You can stop at any step and keep everything produced so far.
Ten minutes, scored on the spot, free. The queue only gets longer.