The Phase II Pause Moved the CMMC Calendar. Your Contract Clauses Did Not Move.

In brief

The DoW has put Phase 2 on hold while it reviews the CMMC program. Everything underneath it is still standing: Phase I, NIST SP 800-171, DFARS 252.204-7012, 7019, and 7020, and the obligation to protect federal data. Keep closing the gaps you know about, be sure you can defend your score, and never claim compliance you cannot back with evidence.

What the announcement paused, and what it left alone

The Department of War suspended CMMC Phase II on July 13, 2026. Phase II had been due to take effect on November 10.

The announcement stops the move into Phase II, and with it the wider use of third-party assessments that was to start after November 10, 2026. Pending and future CMMC implementation milestones are paused as well. A newly formed CMMC Reform Task Force is reviewing the program and has 60 days to send recommendations to the DoW CIO. For that stretch, the DoW says NIST SP 800-171 Revision 2 will be enforced through self-assessments and selected government-led (DIBCAC) assessments.

Phase I is untouched. Depending on your contract and the information you handle, that can still mean a Level 1 or Level 2 self-assessment, a SPRS or eMass submission, an affirmation, and possibly closing eligible POA&M items on schedule.

The Department’s current CMMC guidance leaves little room for interpretation: “This action does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012.”

What you have, then, is a review of how the certification program was designed and rolled out. Nobody has been handed 60 days off from cybersecurity.

The rumor traveled faster than the facts

Within days, contractors were being told that CMMC was dead and third-party assessments were over. The anti-CMMC crowd on LinkedIn was loud about it: any further dollar spent on compliance was a dollar wasted.

Do not take that advice.

CMMC L2 is not suspended. Phase II is, for the length of a 60-day program review. The duty to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) continues. Phase I self-assessments continue. NIST SP 800-171 Revision 2 remains the security baseline for any contractor that handles CUI. And DFARS 252.204-7012, 7019, and 7020 are still sitting in the contracts they were in last month.

Put plainly, the government is rethinking how it checks compliance. The requirement to comply is the same as it was.

The duty to protect CUI is older than CMMC

Every time CMMC gets delayed or revised, this point goes missing. CMMC was built to verify security requirements that were already on the books. It never created the obligation to protect CUI.

Where DFARS 252.204-7012, 7019, and/or 7020 applies to your contract, you still owe adequate security for covered contractor information systems. You still protect covered defense information, and you still follow the incident reporting and preservation requirements. Where the contract calls for NIST SP 800-171, all 110 controls still have to be properly implemented and documented.

Everything you have already told the government is still on file too: SPRS scores, self-assessments, annual affirmations, System Security Plans, and any Plan of Action and Milestones.

Those records have to describe the environment you really run. Writing a policy does not show that a control works. Owning a security product is different from configuring it and watching it. If the score turns out to be wrong, “our consultant took care of that” will not get you far.

Here is a fair test. Suppose a prime or the government asked for your evidence tomorrow morning. Could you hand it over?

False Claims Act exposure runs on its own clock

Telling contractors to drop compliance work is worse than sloppy. It can leave a company in a weaker legal position than before.

The Department of Justice has been bringing False Claims Act cases where a contractor allegedly attested to one level of cybersecurity and delivered a lower one. Recent settlements have turned on missing System Security Plans, incomplete implementation of NIST SP 800-171, inaccurate assessment scores, and failures to follow contract security requirements.

In 2025, DOJ announced cybersecurity-related settlements involving MORSECORP, Raytheon companies and Nightwing, Aero Turbine, Georgia Tech Research Corporation, Swiss Automation, and others. In June 2026, LOGZONE, a defense contractor in Alabama, agreed to pay $507,144 to resolve allegations that it failed to comply with Navy cybersecurity requirements.

All of these settled allegations. None was a trial verdict, and that difference is worth keeping in mind. So is the direction enforcement is heading.

Through its Civil Cyber-Fraud Initiative, DOJ has already established that cybersecurity promises can carry False Claims Act exposure. Moving the CMMC assessment schedule changes nothing about what your company entered in SPRS, certified to a contracting officer, wrote into a proposal, or billed the government to provide.

A score you know is wrong, or a required control you know is missing, will still be wrong or missing when the reform is finished.

Small contractors are right about the cost

We understand why so many small defense contractors are angry. The money problem is not imaginary.

The Small Business Administration says total compliance costs could approach $593,800 for some small firms that need third-party certification, and $388,600 for firms allowed to self-assess. Whether those estimates fit a given company is not really the issue. For the record, we strongly disagree with the figures and see almost no data behind them. We do accept that, the way the program runs today, a small manufacturer can spend a painful sum getting ready before it is even eligible to win the work that would pay for the preparation.

The government’s usual reply is that contractors can recover compliance costs through contract pricing or indirect rates. On paper, perhaps. It does nothing for cash flow today. The contractor pays first, and the recovery may arrive over years of performance.

That pressure can keep capable companies out of the Defense Industrial Base, and it can drive others out of defense work altogether. The DoW is right to ask whether the present approach protects federal data without making it needlessly hard for small and non-traditional suppliers to compete.

We hope a more practical program comes out of the review. It ought to be possible to make proving compliance cheaper while leaving the security bar where it is. A fair criticism of CMMC is still no reason to ignore requirements already written into your contracts.

There are also accredited CMMC enclave options available now that are low in cost and easy to get into. One example: a 5-person company could be assessment ready in as little as two weeks, for under 20k, using ATX Defense’s CMMC Space, which is built on Google Workspace and Google Cloud. If that sounds too good, ask them how many C3PAOs use the platform to meet the CMMC L2 requirements for themselves. As a Google partner, that would be, and has been, our first recommendation to a small business that needs quick, streamlined CMMC L2 compliance.

How to spend the review period

Start with the contracts. Read the clauses in your current contracts and subcontracts, the flow-down language, the data you receive, and the statements your company has already made. Work from the written requirement. A LinkedIn post is not a requirement.

Get the CUI scope right. Know where CUI enters, where it travels, who can reach it, and which systems are in scope. Scope too wide and the environment costs more than it should. Scope too narrow and data sits unprotected.

Test the SPRS score. Go back through the scores and check the controls behind them. Confirm the math and confirm the evidence. If a score cannot be supported, deal with it now.

Keep doing the basic work. That means the SSP, open POA&M items, multi-factor authentication, properly managed devices, privileged access management, audit logging, backups, training, and incident reporting. None of it goes to waste if the assessment model changes. These are the bare-minimum practices that protect the data and the mission.

Collect evidence as you go. Save configuration records, tickets, screenshots, logs, access reviews, and training records while the work is happening. Reconstructing two years of evidence in the week before someone asks is a bad plan.

Watch what the company says about itself. Do not use “compliant,” “certified,” or “fully implemented” unless the facts support the word. That holds for marketing materials, proposals, security questionnaires, SPRS submissions, and executive affirmations alike.

Tell the DoW what is broken. The current Request for Information asks about cost drivers, administrative burden, controls that reduce actual risk, and ways commercial security services could fit into the program. Comments are due August 14, 2026. If your company has lived these problems, send the task force specific examples. General complaints will not help them.

Betting on CMMC going away is a poor bet

This is not the first time CMMC has been paused, re-examined, or rewritten. Each time, the same people announce that it is finally finished. They have been wrong every time so far.

This review could shrink the role of C3PAOs. It could change which contracts need a third-party assessment. More self-assessments, more government-led assessments, or better recognition of commercial security platforms are all possible. Cost, timing, documentation, and enforcement could each shift.

Nobody knows yet. Anyone who says they know exactly what the task force will recommend is guessing.

Two things are certain. Foreign adversaries still want the information the Defense Industrial Base holds, and current contracts still require that information to be protected.

So close the gaps you already know about. Keep the scope tight. Make the score honest. Build a security and compliance program that holds up in the weeks when no assessor is looking.

Washington is deciding who checks the work. The work itself is still yours.