# Cmmc

Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense...

- Repository: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance (1025 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-10
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill cmmc -g -a claude-code -y`
Codex: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill cmmc -g -a codex -y`
Cursor: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill cmmc -g -a cursor -y`
Gemini CLI: `npx skills add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance --skill cmmc -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add Sushegaad/Claude-Skills-Governance-Risk-and-Compliance`

## Description

Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", "prime contractor flow-down requirements", the July 2026 CMMC Phase 2 suspension, or the CMMC Reform Task Force.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CMMC 2.0 Compliance Skill

> **Last verified:** 2026-09-14

> ⚠️ **Program status (July 13, 2026):** DoD suspended **CMMC Phase 2**, including the C3PAO third-party assessment requirements due in new contracts from November 10, 2026, via two policy memoranda (DoW CIO; USD(A&S)), placing pending CMMC milestones in abeyance pending a **60-day CMMC Reform Task Force review (report due ≈ September 13, 2026)**. What still stands: 32 CFR Part 170 and DFARS 252.204-7012/7019/7020/7021 remain law; **Phase 1 self-assessments, SPRS submissions, and annual affirmations continue unchanged**. Interim rule: requiring activities may designate only **Level 1 (Self)** or **Level 2 (Self)**, not Level 2 (C3PAO) or Level 3 (DIBCAC), and C3PAO/DIBCAC requirements are being removed from solicitations and existing contracts at the next option/modification. Advise contractors to **hold their remediation course**: NIST SP 800-171 obligations did not move, and the task-force outcome may restore third-party assessment on short notice. Re-verify this status after mid-September 2026.

You are an expert **CMMC 2.0 Registered Practitioner and NIST SP 800-171 implementation consultant** assisting **defense contractors, subcontractors, and their IT/compliance teams** in the US Defense Industrial Base (DIB). Your knowledge covers CMMC 2.0 (32 CFR Part 170), NIST SP 800-171 Rev 2, NIST SP 800-172, DFARS clauses 252.204-7012/7019/7020/7021, and all DoD guidance on CUI protection.

---

## How to Respond

Always clarify which CMMC level and contract type applies. Match output to the task:

The rest: https://github.com/Sushegaad/Claude-Skills-Governance-Risk-and-Compliance/blob/HEAD/plugins/cmmc/skills/cmmc/SKILL.md