NeoSystems CMMC Review: 2026 Status, Service Continuity, and What to Verify

By The Defense Compliance Report Editorial Team — an independent trade publication on CMMC 2.0 and DIB compliance · Last verified September 2026

NeoSystems LLC told employees in May 2026 that it was winding down, the Washington Business Journal reported through Reston Patch. BlueStreet Solutions acquired its Enterprise Solutions Group. FIT Solutions was named to assume service continuity for Information Services Group customers. NeoSystems LLC's 2025 Final Level 2 announcement does not establish that today's operator or service is covered.

If you came here for a NeoSystems CMMC review, the table below shows who is who today. The sections after it show what each old claim still proves, and what to get in writing before you sign, renew, or move data.

Program status, checked September 23, 2026: CMMC remains paused in Phase 1. The Department's current CIO site uses Department of War (DoW), while the codified rule and DFARS clauses still use Department of Defense (DoD). DoW suspended Phase II on July 13, 2026. Level 1 and Level 2 self-assessments, NIST SP 800-171 Revision 2 for Level 2, applicable SPRS entries, annual affirmations, and DFARS 252.204-7012 duties remain. The 60-day review period has passed, but no public task-force report or replacement Phase II date appeared on the official pages we checked. Where the program stands now →

This page is for you if:

• You were a NeoSystems IT, hosting, NeoEnclave, or CMMC customer. Start with Former NeoSystems clients: stay or switch?
• You're weighing a NeoSystems ISG proposal. Start with the 2025 status test, then the checklist.
• You used NeoSystems only for accounting, payroll, HR, or Deltek Costpoint work. See the ESG row in the stay-or-switch table.

This page is not for you if:

• You mean NeoSystems Inc. of Calgary, a separate risk-management software company.
• A different CMMC managed service provider (MSP) just shut down on you. Use our 72-hour plan for a failed CMMC MSP.
• You only need a formal certification assessment. Go to our list of authorized CMMC Third-Party Assessment Organizations (C3PAOs).

NeoSystems at a glance (checked September 23, 2026)

"NeoSystems" now points to at least three different things. There's legacy NeoSystems LLC, which was reported as winding down and preparing to dissolve in May 2026. There's its back-office unit, now owned by BlueStreet. And there's the IT and CMMC customer base known as NeoSystems ISG, for which FIT Solutions was named to assume service continuity. Which one you're dealing with decides every answer below.

Whether you should stay with NeoSystems ISG, move your Controlled Unclassified Information (CUI) into a Microsoft tenant your company owns, pick a different CUI enclave, or just bring in readiness help depends on your required CMMC level, whether you handle Federal Contract Information (FCI) or CUI, your assessment type, your cloud setup, and your contract timeline. The contract clause sets your level, not a checklist. A company profile can't settle those facts for you, so use The Defense Compliance Report's Find My CMMC Path tool to map your situation to the right kind of help before you request or renew a quote — and do not submit CUI, drawings, or sensitive contract details.

What happened to NeoSystems? A dated timeline

NeoSystems didn't fade out slowly. In roughly two weeks in May 2026, ESG was sold to BlueStreet, termination notices were reported at legacy NeoSystems LLC, and FIT Solutions was named to assume service continuity for ISG customers. Here's each step, where it comes from, and what it does not prove.

You'll also find forum threads and blog commentary about NeoSystems' final months that go beyond these records. We couldn't verify those accounts, so we don't repeat them. Nothing on this page relies on them.

What we checked, and what we couldn't

Checked on September 23, 2026: the company notices and releases above; both NeoSystems websites; FIT Solutions' website; the Cyber AB member page; 32 CFR Part 170, including sections 170.4, 170.8, 170.9, 170.19, 170.21, and 170.22; DFARS 252.204-7012 and 252.204-7021; NIST's Revision 2 and Revision 3 publication records; FedRAMP's 2026 Ready transition and terminology; the official DARS class-deviation index; and the Department of War's current CMMC page.

Could not confirm: the legal company operating neosystemsisg.com; whether FIT Solutions or the current NeoSystems ISG operator holds a current CMMC status or Cyber AB listing; NeoSystems.Cloud's current FedRAMP Marketplace record; the actual 2025 Certificate of CMMC Status or current annual affirmation; any court, bankruptcy, or state dissolution record; any public Reform Task Force report; or the status of any single customer's data. The official DARS index showed Class Deviation 2026-O0025, Revision 3, dated September 3, 2026, but its attachment was not fully readable through our audit tools, so this page does not claim more from it than the current DoW CIO page supports.

NeoSystems CMMC review: does the 2025 status cover today's service?

Not automatically, and not by itself. Under the CMMC rule, a status belongs to a specific organization's information system, and a certificate identifies the organization, the industry CAGE codes associated with the systems in scope, an assessment identifier, a date, and a level. A 2025 status announced by NeoSystems LLC proves that announcement concerned NeoSystems LLC's assessed system in 2025. You need current documents to connect it to the operator, system, and service in front of you now.

No web page — including this one — can tell you whether today's NeoSystems ISG service sits inside a current CMMC certificate. The certificate, current status record, scope, and contract can. Here's how to read them.

The rule defines CMMC Status as the status of an Organization Seeking Assessment's information system, stored in SPRS and shown on a certificate when a C3PAO or DIBCAC performed the assessment (32 CFR 170.4). Each certificate must list, at a minimum, every industry CAGE code associated with the systems in scope, the C3PAO's name, the assessment's unique ID, the Organization Seeking Certification's name, and the status date and level (32 CFR 170.9(b)(18)).

Think of it less like a badge attached to a brand and more like an inspection record for a named organization and a defined system boundary. A new operator, legal entity, or boundary needs a documented match. Continuity cannot be assumed from the logo.

The five-match test

Ask for the certificate, current affirmation, and scope record, then line them up against the proposal or contract. Mark each row Matched, Not matched, or Unknown. Unknown is not a no. It's a document or explanation you haven't received yet.

Even a perfect match doesn't make you compliant

A provider's own status may reduce the provider's assessment effort during your assessment. It doesn't replace your assessment, your evidence, or your responsibilities. When a provider that is not a cloud service provider processes, stores, or transmits your CUI, its services are in your assessment scope and are assessed as part of your assessment (32 CFR 170.19(c)(2)(i), Table 4). For your assessment, your company is the Organization Seeking Assessment (OSA).

The rule calls a provider's own certification voluntary and says it may reduce the ESP's effort required during the OSA's assessment. It also requires the OSA to document the provider relationship and services in its System Security Plan (SSP), the provider's service description, and the Customer Responsibility Matrix (CRM), the chart showing which requirements the provider handles and which remain with you (32 CFR 170.19(c)(2)(ii)).

NeoSystems' 2025 announcement said clients could rely on it to “greatly simplify and accelerate” their own certification. “Simplify” was the honest word. It never meant done for you. For more on how this works with any provider, see what the CMMC rule requires of MSPs and our guide to the shared responsibility matrix.

RPO, C3PAO, “certified MSP”: what each label proves

C3PAOs must follow Cyber AB conflict-of-interest policies. More specifically, a CMMC ecosystem member that served as a consultant preparing an organization for any CMMC assessment during the preceding three years may not participate in that organization's Level 2 certification assessment (32 CFR 170.8(b)(17)(ii)(G)). Use a separate assessment firm.

Can NeoSystems ISG host your CUI?

Maybe, but a website phrase won't tell you. If an outside cloud stores, processes, or transmits covered defense information, DFARS 252.204-7012 requires security equivalent to the FedRAMP Moderate baseline, plus the clause's incident-reporting and forensic-support terms. NeoSystems' own records described NeoSystems.Cloud as “FedRAMP Ready” in 2024. FedRAMP retired Ready in July 2026 and transitioned remaining records to Legacy FedRAMP Ready; Ready was never FedRAMP Certification.

Here's the rule text in plain terms. If you use an outside cloud service provider (CSP) to store, process, or transmit covered defense information, you must require the CSP to meet security requirements equivalent to the FedRAMP Moderate baseline. The CSP must also comply with paragraphs (c) through (g) of the clause: cyber-incident reporting, malicious-software submission, preserving images of affected systems for at least 90 days, forensic access, and damage assessment (DFARS 252.204-7012(b)(2)(ii)(D)).

In 2024, FedRAMP Ready meant a third-party assessment organization had prepared a Readiness Assessment Report and FedRAMP had accepted the service as ready to pursue authorization. In July 2026, FedRAMP retired that path, renamed surviving records Legacy FedRAMP Ready, and introduced Class A as the entry path toward Certification. A legacy Ready record can still be useful diligence evidence. It is not FedRAMP Certification. (FedRAMP's July 2026 transition notice)

Which rule applies depends on whose cloud it is

DoD's Level 2 scoping guidance draws a useful line. A provider that manages a third-party cloud on your behalf, such as your own Microsoft 365 GCC High (Government Community Cloud High) tenant, is an external service provider rather than the CSP for that cloud. A provider that operates the cloud platform holding your CUI is the CSP for that service. NeoSystems' past marketing described both environments built on NeoSystems.Cloud and CUI work in Microsoft 365. Find out which one holds your data today.

A note on terms: FedRAMP now calls an authorization a “FedRAMP Certification,” and it is replacing the old Low, Moderate, and High labels with Classes A through D. The Marketplace is scheduled to show the old labels in parentheses through December 31, 2026. Class C replaces the former Moderate path, while the DFARS clause still says “FedRAMP Moderate baseline.” Read the current class, any parenthetical legacy label, lifecycle state, package owner, and exact offering. For how equivalency works when a cloud isn't listed, see our guide to FedRAMP equivalency for CMMC cloud providers.

If export-controlled data under the International Traffic in Arms Regulations (ITAR) or the Export Administration Regulations (EAR) is involved, see our CMMC guide for ITAR companies.

Former NeoSystems clients: stay or switch?

It depends on where your CUI lives and whether your company holds the keys. If your data sits in a Microsoft tenant your company owns, this is mostly an MSP change. If it sat in NeoSystems' own cloud, it's a data-custody and cloud-compliance question first.

Three quick checks before you read the table:

1. Does your DoD contract include DFARS 252.204-7012? If yes, the clause governs covered contractor information systems and covered defense information when they are present. Then confirm whether NeoSystems stored, processed, or transmitted covered defense information, or provided security protection for systems that did.
2. Where does your CUI live today: in a tenant your company owns, or in an environment NeoSystems ran?
3. Does someone authorized by your company hold a working Global Administrator or equivalent top-level administrative account and a tested break-glass account right now?

Does your own CMMC status survive the change?

Your CMMC Status is tied to your assessed information system, not to the provider's separate status. A provider change does not automatically erase it. But a significant architectural or boundary change requires a new assessment, while operational changes within the existing boundary that follow the SSP may be addressed through the annual affirmation. Document what changed before choosing the path.

Say your drawings moved from NeoEnclave into a new GCC High tenant in June. That's a boundary change, not merely a staffing change, and your SSP, diagram, CRM, evidence, and assessment plan should say so.

What didn't pause when NeoSystems did

• Incident reporting. DFARS 252.204-7012 requires a cyber incident to be rapidly reported within 72 hours of discovery. A vendor winding down is not an incident by itself. Unknown admin accounts, missing logs, unexplained access, or CUI in an unknown place may require immediate incident-response and legal review. More in our DFARS 252.204-7012 guide.
• Your assessment record and affirmation. Your Affirming Official affirms continuing compliance, and a Level 2 (Self) status lapses if the required annual affirmation is not maintained. Do not affirm requirements you cannot show are satisfied. See our guides to the annual affirmation and your SPRS score.
• The first-week basics. For administrative access, backups, logs, and evidence export, use our 72-hour plan for a failed CMMC MSP. For a planned move, see switching CMMC providers mid-engagement.

If your row points toward a move, or you still can't tell whether you need a new MSP, a CUI enclave, or readiness help, sort that out before you call anyone. It takes a few questions about your contract, data, environment, timeline, and budget, and it points you to a category of help, not a company.

The NeoSystems verification checklist

Don't ask “Are you CMMC compliant?” and accept a yes. Ask for these twelve items in writing from whoever will sign your contract: the current NeoSystems ISG operator, FIT Solutions, or BlueStreet for ESG work. A missing item isn't proof of a problem. It's an open question you shouldn't sign around.

This worksheet is for procurement notes. Do not enter CUI, drawings, passwords, export-controlled information, vulnerability details, or sensitive contract information.

Give each item one of these statuses: Not requested, Requested, Received, Verified, Gap, or Not applicable (with a written reason). “Received” isn't “Verified” until you've checked it against the five-match test. Don't total the list into a score.

A worked example (hypothetical). Say you run a 40-person machine shop. Your prime's drawings, which are CUI, sat in NeoEnclave, and last year you posted a Level 2 self-assessment result in SPRS. In September a NeoSystems ISG renewal lands on your desk. You send the twelve asks. One of three things happens:

• Everything lines up. The legal company is named, any CMMC claim maps to the current entity and service, the cloud has a current Marketplace record or current equivalency evidence as applicable, and the exit terms are in writing. You move on to price and references.
• Key items stay unknown. Say the current operator relies on the legacy CMMC announcement but provides no current certificate-to-service match, and there is no current cloud evidence for the environment holding your drawings. You mark those items as gaps, hold the renewal and any data move, and ask for a written answer by a set date. That's not an accusation. It's how you avoid signing around a gap.
• You learn your real need is different. Your contract calls for Level 2 (Self), and your drawings could live in a GCC High tenant your company owns, run by a capable MSP. The question shifts from “NeoSystems or not” to “which kind of help.”

In all three cases, reassess the affected NIST SP 800-171 Revision 2 requirements against what is running today. Update your assessment result, SSP, POA&M, evidence, and SPRS record when the facts or applicable requirements call for it before your next affirmation.

Who NeoSystems ISG may fit, and who should look elsewhere

We haven't tested NeoSystems ISG's service, so this is about fit and proof, not quality. Legacy NeoSystems LLC's 2025 announcement does not prove post-May 2026 delivery, current scope, or current customer outcomes. Ask for references from customers served under the current operating arrangement since May 2026, at your size and with a comparable environment.

If the paperwork checks out but you're still unsure whether your real need is an enclave, managed security, readiness help, software, or a formal assessment, choose the category before you compare company names.

NeoSystems alternatives, by category

Pick the category first, then the company. Each of these does a different job, and swapping one for another can leave the original problem unsolved.

To compare roles and check listings in one place, use our CMMC provider directory. To test any provider's claims, see how to verify your MSP's CMMC status.

Frequently asked questions

How do I get my data back from NeoSystems?

Start with the contacts in BlueStreet's May 14, 2026 notice: BlueStreet for NeoSystems ESG services, and FIT Solutions for NeoSystems ISG service continuity. Put every request in writing, ask for the legal counterparty and a dated export plan, and keep CUI out of ordinary email. If access is delayed, disputed, or tied to conditions, bring in counsel.

Are there real NeoSystems CMMC reviews from customers?

Our September 23, 2026 review found no independent, verifiable customer review specifically evaluating the current post-May 2026 CMMC service arrangement. Glassdoor ratings come from employees, and the G2 listing under “NeoSystems” covers a different Calgary software company. Forum posts are anecdotes. Ask the current operator for recent references using a comparable service, scope, and company size.

Was NeoSystems a C3PAO?

We found no source establishing that legacy NeoSystems LLC was a C3PAO. Its own announcements described an RPO role and its own Final Level 2 status as an external service provider. “Final Level 2 (C3PAO)” describes the assessment type performed on NeoSystems' system; it does not say NeoSystems was the C3PAO that performed assessments for customers. Verify any current role in the live Cyber AB Marketplace.

What about Microsoft GCC High licenses we bought through NeoSystems?

Legacy NeoSystems' website offered Microsoft 365 Government licensing. If you bought licenses through it, identify your Microsoft partner of record, tenant owner, subscription IDs, renewal dates, billing contact, and administrative roles now. An unclear reseller relationship is an avoidable outage, but do not send credentials or CUI in the request.

Do I need to tell my prime contractor about the NeoSystems change?

Possibly, if it changes a contractual representation, flow-down obligation, deliverable, CUI location, external service provider, cloud, assessed boundary, CMMC UID, SPRS record, or ability to meet an incident-reporting deadline. Have your contracts lead or counsel read the actual prime/subcontract terms, then share verified facts through the required channel. See how to prove CMMC compliance to a prime.

Does the Phase II suspension mean I can ignore this?

No. Phase II's third-party rollout was suspended, but Phase I self-assessments remain, Level 2 still uses the 110 NIST SP 800-171 Revision 2 requirements, annual affirmations remain where required, and DFARS 252.204-7012 still applies when included and applicable. A provider change can make the implementation or evidence behind an assessment and affirmation inaccurate even when a C3PAO assessment is not currently required.

Still not sure which CMMC path fits your company? Use The Defense Compliance Report's Find My CMMC Path tool to see which path and kind of help fit your contract, CUI, environment, and timeline — before you hire anyone.

Sources

All checked September 23, 2026.

Rules and official program sources

• 32 CFR Part 170: current CMMC program rule and incorporated standards
• 32 CFR 170.4: CMMC Status, OSA, Affirming Official, ESP, Security Protection Data, and C3PAO definitions
• 32 CFR 170.8: CMMC ecosystem conflict-of-interest rule, including paragraph (b)(17)(ii)(G)
• 32 CFR 170.9: certificate minimum fields, paragraph (b)(18), and C3PAO requirements
• 32 CFR 170.19: Level 2 scoping and external service provider/cloud service provider rules
• 32 CFR 170.21: POA&M conditions and 180-day closeout
• 32 CFR 170.22: affirmation timing and SPRS entry
• FAR 52.204-21: 15 basic safeguards for FCI systems
• DFARS 252.204-7012: NIST SP 800-171, external-cloud, 72-hour incident-reporting, malware, preservation, forensic-access, and flow-down requirements
• DFARS 252.204-7021: CMMC status, annual affirmation, SPRS, and contract-flow-down requirements
• DoW CIO, About CMMC: current Phase II suspension, Phase 1 requirements, Revision 2 baseline, assessment cadence, POA&M, and affirmation summary
• DPCAP/DARS, DFARS Revolutionary FAR Overhaul Class Deviations: official listing for Class Deviation 2026-O0025, Revision 3, dated September 3, 2026
• NIST, SP 800-171 Revision 2 publication record, SP 800-171A June 2018, and Protecting CUI publications: confirms newer NIST revisions exist while 32 CFR Part 170 still incorporates the older CMMC baselines
• DPCAP, NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, and SPRS NIST SP 800-171 information
• FedRAMP, July 2026 certification-path transition and Marketplace: retirement of Ready, Legacy FedRAMP Ready, Certification terminology, and Classes A–D
• 22 CFR 120.62: ITAR definition of U.S. person

Company records (company-stated)

• BlueStreet Solutions, acquisition of NeoSystems ESG (dated May 1, 2026)
• BlueStreet and NeoSystems, Important Message (May 14, 2026)
• High Street Capital, sale of NeoSystems ESG (May 2026)
• NeoSystems, RPO announcement (Jan. 11, 2021)
• NeoSystems, FedRAMP Ready renewal (Jan. 9, 2024)
• NeoSystems, Final Level 2 announcement (Mar. 26, 2025)
• NeoSystems ISG website and FIT Solutions website
• Cyber AB member page, “NeoSystems, LLC”

News and identity disambiguation

• Reston Patch, summary of Washington Business Journal reporting (May 6, 2026)
• G2, NeoSystems seller profile for ITRAK 365, a separate Calgary software vendor

About The Defense Compliance Report

The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor's level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

We are not affiliated with the Cyber AB, the Department of Defense (Department of War), DCMA DIBCAC, NIST, or any U.S. government agency. This page is educational research, not legal, contractual, or compliance advice. Confirm scope and applicability with a CMMC Registered Practitioner (RP) or a qualified federal-contracts attorney. How we handle commercial relationships is explained in our Editorial & Advertising Policy.