Compliance

201 CMR 17.00 Compliance: An IT Checklist for Massachusetts Businesses If your company holds personal information about Massachusetts residents, 201 CMR 17.00 compliance is not optional, and it is not just a legal exercise. This checklist is written for owners and office managers at Massachusetts and New Hampshire businesses with 5 to 300 employees. It […]

Short version: On July 13, 2026, the Department of Defense suspended CMMC 2.0 Phase 2 — the stage that would have required third-party C3PAO audits before contract award. The suspension was locked in by binding regulation in September 2026. Level 1 and Level 2 self-assessments under NIST SP 800-171 are still required, and the underlying