The 2026 Federal Readiness Playbook for ISVs — Chapter 4: The DoW Compliance Calendar

One deadline, or a calendar

Chapter 3 closed on a distinction that decides how a federal deal reads: who checked this, and against what standard. But that question does not get asked once. It gets asked against a moving backdrop of rules that are in force, suspended, or merely proposed — and the state of that backdrop changes on its own schedule, independent of your sales cycle.

Most first-time federal sellers arrive fixated on a single date. For the civilian on-ramp this whole book is built around, that date is August 3, 2026, when the FedRAMP 20x Class A window opened (Class B & C opened on August 31). That fixation is understandable, and the date is real. But it is one hand of a clock, not the whole instrument. Alongside the civilian FedRAMP calendar runs a second one — the Department of War (DoW) compliance calendar — and getting the state of that calendar exactly right is itself a trust signal, the same way precise language about verification is.

This chapter walks the DoW calendar for a reader whose first sale is probably civilian. The goal is not to turn you into a CMMC specialist. It is to make you precise about a regime you may not sell into yet — because in federal compliance, sounding current and being current are two different things, and the gap between them is exactly what a knowledgeable buyer listens for.

The three facts that carry the chapter

On the DoW side, the entire framework that governs a defense software supplier is CMMC — the Cybersecurity Maturity Model Certification program — together with the DFARS clause that sits underneath it. As of 2026, three facts define its state, and they are the facts to state precisely and never in the near-miss version:

• CMMC Phase I is in force.
• CMMC Phase II is suspended — not cancelled (memo 26-P-1023, announced 2026-07-13).
• DFARS 252.204-7012 remains in force.

Say each of those the way it reads. “Phase II was cancelled” is wrong. “Phase I is suspended” is wrong. Either slip tells a contracting officer — or a competitor sitting across from the same buyer — that your compliance posture is approximate. And approximate is the one thing a federal seller cannot afford to sound, because the buyer’s entire job is to find the distance between what you say and what is true.

Suspended is not cancelled, and the difference is a plan

A suspension is a pause, not a repeal. The word matters because it changes what a prepared company does next.

Read “Phase II suspended” as “Phase II gone” and you make two costly mistakes at once. You stop building toward a certification a resumption will require — losing the lead time that is the whole advantage of preparing early — and you signal to anyone paying attention that you are not tracking the regime closely. Read it correctly, as deferred, not deleted, and the posture is obvious: keep the program warm, keep evidence current, and be ready to move when it resumes.

Meanwhile, nothing about the Phase II suspension relaxes what is already required today. Phase I and DFARS 252.204-7012 remain in force, unchanged. The suspension is not a holiday from the obligations that already bind a defense supplier — it is a pause on one phase of a rollout, with the rest of the regime running exactly as before. The precise mechanics of what each phase demands — levels, assessment types, control counts — are their own subject, and this book deliberately does not assert them. The three facts above are the ones that carry the chapter, and they are enough to be right.

Two clocks, one company

For an ISV whose path touches both civilian and DoW work — and many that start civilian eventually reach toward the larger, stickier programs on the defense side — 2026 runs two compliance calendars at the same time:

• The civilian FedRAMP 20x calendar. Class A opened 2026-08-03; Class B & C opened 2026-08-31. This is the on-ramp the rest of the book covers.
• The DoW CMMC / DFARS calendar. Governed by the Phase I / Phase II status above and DFARS 252.204-7012, on its own timeline.

The reason to hold both in view even if you only sell civilian this year: the underlying readiness work overlaps even when the standards don’t. A functioning control environment, current evidence, and a legible verified-vs-self-attested posture help you on either side of the line. What does not carry over is the specific standard and the specific clock. FedRAMP authorization is not CMMC certification; a civilian ATO is not a defense one; the calendars advance separately. The seller’s discipline is to treat them as two clocks, not one — to know which one a given claim answers to, and never to let a civilian credential quietly imply a defense one, or vice versa. That is the same verified-vs-self-attested honesty from Chapter 3, applied to which regime rather than who checked.

What a civilian-first ISV actually needs to know

If your first federal sale is civilian, here is the honest scope of your DoW homework for 2026 — no more, no less.

You do not need to complete CMMC certification to pursue a Class A submission. The civilian FedRAMP path stands on its own, and pretending otherwise only burns time you need for your FedRAMP 20x package. What you do need is threefold. First, know that the DoW calendar exists and where it stands — the three facts above, stated precisely — so that when a buyer, partner, or investor raises CMMC you answer like someone who tracks the regime rather than someone reciting a headline. Second, know which clock any compliance claim you make is answering to, so you never let a civilian credential read as a defense one. Third, if defense work is anywhere on your roadmap, treat Phase II as deferred-not-deleted and keep the groundwork warm, because the readiness that serves the civilian window is much of the same readiness that will serve the defense one when it resumes.

Precision here is not pedantry. It is the difference between a seller who has clearly read the room and one who is improvising — and on the federal side that difference is legible in a single sentence.

Keeping the calendar legible without overclaiming

GovExpress renders a company’s compliance posture as a verified-vs-self- attested overlay on every vendor you search in the app, and the Compliance Posture category of the Federal Readiness Score reflects it. That framing spans both calendars — FedRAMP, CMMC, and SOC 2 status read through the same verified-vs-self-attested lens — which is exactly why it helps a company hold two clocks without confusing them.

For anything touching CMMC, one honesty line has to be said out loud. GovExpress has no visibility into government-only scoring systems. It does not read, mirror, or represent a company’s government-side score. The posture it renders is built from its own verified/self-attested overlay and public federal data — not from privileged access to any government scoring system. A vendor that implies it can see inside a buyer’s government records is committing exactly the overclaim this book is built to help you avoid, and a DoW-literate buyer will catch it instantly. Legible beats impressive, on both calendars.

What this chapter hands to the next

The calendar tells you what is in force and when. It does not, by itself, tell you what to do — and a company staring at two clocks and a verified-vs-self-attested sort of its own claims can freeze rather than move. That is the gap Chapter 5 closes. The 90-day plan takes everything named so far — the 12 readiness categories from Chapter 2, the three states of a compliance claim from Chapter 3, and the two calendars from this chapter — and sequences them into a set of moves you can actually run before, and through, your FedRAMP 20x submission.

The takeaway to carry forward is a small habit with an outsized payoff: name the clock before you make the claim. Which calendar does this compliance statement answer to, and is the status stated exactly? Answer that, and you never accidentally sell a suspension as a repeal, or a civilian credential as a defense one — which is precisely the credibility the next ninety days are meant to compound.