The 3 Hidden Corporate Tech Deadlines Lurking in Your Next 18 Months
Three major industry shifts — VMware licensing, Microsoft pricing, and CMMC compliance — converge in the next 18 months. Here's what's coming and how to get ahead of each one.
Jul 1 2026 | Microsoft
Microsoft licensing increases by 18%
Across core Microsoft 365 and enterprise products, pricing rises by up to 18%. Organizations that haven't audited their license spread will absorb the full increase — including licenses they don't actually need.
Nov 10 2026 | CMMC Phase 2
CMMC Level 2 third-party assessments begin
C3PAO (Certified Third Party Assessment Organization) assessments become mandatory for contractors on prioritized contracts. Self-attestation alone is no longer sufficient for Level 2. This affects thousands of DoD supply chain companies.
Oct 11 2027 | VMware
VMware Cloud Foundation 8 reaches end of life
VCF 8 exits general support. Organizations still running VCF 8 will lose security patches, bug fixes, and vendor support — leaving their infrastructure exposed. VCF 9 is a significant architectural departure from what most teams are currently running.
Nov 10 2027 | CMMC Phase 3
CMMC Level 3 requirements expand to broader contracts
Requirements widen further. Level 3 certification — involving government-led assessments — becomes required for relevant contracts. The lead time to achieve Level 3 is substantial; organizations need to begin planning now.
The VMware situation deserves special attention
When VCF 8 reaches end of life on October 11, 2027, it's not just a support ticket problem — it's a security exposure. Systems running unsupported software no longer receive patches for newly discovered vulnerabilities. For any organization subject to compliance frameworks (HIPAA, CMMC, SOC 2, PCI), running end-of-life infrastructure is a direct audit finding and a liability.
What end-of-life actually means
No more security patches. No bug fixes. No vendor support for outages. If a critical CVE is discovered for VCF 8 after October 11, 2027 — your environment is exposed with no remediation path from Broadcom. Compliance frameworks treat unsupported infrastructure as a control failure.
VCF 9 is not a simple upgrade — it represents a meaningful architectural shift from the environment most IT teams have built their operations around. The transition requires significant planning, testing, and staff retraining. Many organizations evaluating the path forward are finding that the new 70-node minimum requirement under Broadcom's current licensing model translates to roughly $10,000/year — a cost threshold that is pushing mid-market companies to seriously evaluate alternatives for the first time.
If your organization is running fewer than 70 nodes, or if the economics of VCF 9 don't pencil out, there are proven alternatives — and the time to evaluate them is now, not in Q3 2027.
The Microsoft pricing increase is an optimization opportunity
An 18% increase sounds like an unavoidable cost — but for most organizations, it's actually a forcing function to do something that should have been done years ago: a proper license audit. The typical Microsoft 365 environment has a meaningful percentage of licenses assigned to users who don't need them, have left the company, or are paying for capabilities that a lower-tier license would cover.
Free audit for qualifying organizations
If your organization has 250 or more Microsoft licenses, we can connect you with a licensing expert for a complimentary audit before July 1st. The goal: ensure you're entering the increase with the most cost-effective spread of licenses for your actual usage — not your historical spend.
CMMC: the path forward depends on where you're starting
CMMC compliance is not one-size-fits-all, and the right approach depends entirely on your organization's size, internal capabilities, and how much of the work you want to own versus outsource. We work with a broad supplier ecosystem, and we match organizations to the right fit based on what they actually need.
Fully managed compliance: Hand it off to a managed security provider who owns the entire CMMC compliance process end-to-end.
Tools to self-certify: For teams with internal security bandwidth — the right toolset and documentation framework to achieve compliance independently.
Assessment readiness: Gap analysis and pre-assessment preparation before your C3PAO formal review — know exactly where you stand.
If any of these deadlines apply to your organization, let's talk before the window closes.
Comments