Your Defense Compliance Partner - Cleared, Evidence-Driven, and Built for the DIB
AeoliTech serves defense primes and subcontractors that must protect CUI, maintain an honest NIST SP 800-171 assessment, and stay ready as CMMC is reformed. We are a founder-led practice built by engineers who delivered federal controls at MITRE and carried systems through full ATO at Los Alamos National Laboratory.
Regulatory update · July 13, 2026
CMMC Phase II is paused. Phase I is not.
The Department suspended the transition to Phase II and pending or future CMMC implementation milestones while it reviews the program. Phase I self-assessments remain in place. During the interim, NIST SP 800-171 Rev. 2 will be enforced through self-assessments and selected government-led assessments, and DFARS 252.204-7012 still requires contractors and subcontractors to safeguard covered defense information.
Who We Serve
Defense Primes with Flowing-Down Requirements
You hold a defense prime contract and need the assessment scores, CUI protections, and flow-downs in your supply chain to match reality. The Phase II timetable changed; your current clauses and responsibility for covered defense information did not.
Defense Subcontractors Receiving CUI
You receive CUI through engineering systems, collaboration platforms, email, or file storage. You need a current SPRS position, an accurate SSP, and evidence that supports what you report, without hiring a full-time compliance team.
DoD and DoE Program Contractors
You operate systems in support of DoD or DoE programs: research, development, test, logistics, or sustainment. You may have existing FISMA or RMF obligations. You need CMMC aligned with your existing compliance posture, not bolted on top of it.
What Makes This Different
Most CMMC consultancies send you a junior GRC analyst with a spreadsheet. AeoliTech sends Leonard.
Active DoD Secret + DoE Q Clearance
AeoliTech leadership can discuss your CUI environment, your system boundary, and your sensitive program context without clearance barriers.
MITRE CMMC Controls Experience
The controls we implement are the same controls built and validated inside the institution that helped develop the CMMC framework.
Full ATO Delivery at LANL
Leonard has already carried a system through the harder version, NIST 800-53 High, at Los Alamos National Laboratory.
PolicyCortex Automation
AeoliTech deploys PolicyCortex to automate evidence collection, control validation, and drift detection. This is how we compress 12-18 months to approximately eight.
What the July 13 Pause Changes
Certification timetable
Phase II and pending or future implementation milestones are suspended while the program is reviewed.
Current assessment work
Phase I self-assessments remain, using NIST SP 800-171 Rev. 2 during the interim.
Contract obligations
DFARS 252.204-7012 and contract-specific CUI protection duties continue to apply.
The sensible move is not to stop. It is to stop buying against a date and use the review period to reconcile your SPRS score, close the control gaps that reduce real risk, and keep evidence current.
Can Your Evidence Reproduce Your SPRS Score?
Request an SPRS Evidence Review(469) 546-5585 | cmmcnow@aeolitech.com