Compliance
The CMMC pause did not pause your cybersecurity obligations. When the Pentagon suspended CMMC Phase 2 on July 13, 2026, it stopped the rollout of third-party certification audits. It did not touch the rules that already require defense contractors to protect sensitive government data, post a score in SPRS, and report cyber incidents. A Federal News Network investigation published October 26 now questions the reasons given for the pause, and the review that was supposed to take 60 days is still open. For small contractors in Maryland, Virginia and DC, our advice is simple: keep working on your NIST SP 800-171 controls as if the deadline never moved.
Here is what happened, what the new reporting says, and what a business owner should do this quarter.
What the CMMC pause actually stopped
CMMC, the Cybersecurity Maturity Model Certification program, is the Defense Department’s system for checking that contractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It rolls out in phases. Phase 1 began on November 10, 2025, and lets contractors self-assess. Phase 2 was set to start on November 10, 2026, and would have required many companies that handle CUI to pass a Level 2 assessment by an outside assessor, called a C3PAO.
On July 13, 2026, DoD Chief Information Officer Kirsten Davies signed a memo that suspended Phase 2 and paused all pending and future CMMC milestones “until further notice,” according to Federal News Network and a client alert from WilmerHale. The memo said the program placed “significant and often prohibitive burdens” on the defense industrial base and called for “tangible cyber hygiene rather than third-party certifications.” It set up a CMMC Reform Task Force to run a 60-day “top-to-bottom” review, with a public request for information (RFI) that closed on August 14.
The memo also told contracting officers to remove Phase 2 requirements from active solicitations and to modify existing contracts over time. That is the part that made headlines. The part that matters more for most small businesses is what the memo left in place.
CMMC Phase 2 suspended: what still applies to you
Law firms that track government contracts agree on the core point. Wiley wrote that the pause “delays only the mandatory requirement for a C3PAO assessment.” McCarter & English noted that the suspension came by memo, so the CMMC rule itself and DFARS 252.204-7021 remain in force as written. Here is what is still on the books today:
- DFARS 252.204-7012. If your contract includes this clause, you must still protect covered defense information using the 110 controls in NIST SP 800-171 Revision 2 and report cyber incidents to the DoD within 72 hours.
- Your SPRS score. DFARS 252.204-7019 still ties contract awards to a current self-assessment score in the Supplier Performance Risk System. Annual affirmations of compliance are still required.
- Phase 1 self-assessments. DoD said “all Phase I self-assessment requirements remain firmly in place,” per WilmerHale. Solicitations can still require CMMC Level 1 or Level 2 self-assessments.
- Government-led checks. DoD said it will keep enforcing NIST SP 800-171 through self-assessments and selected government-led assessments, such as those run by the Defense Contract Management Agency (DCMA).
- Flowdown to subcontractors. Primes must still pass these requirements down. A memo in Washington does not automatically change the terms of your subcontract.
In plain terms, the government removed the outside auditor from the near-term schedule. The security work the auditor would have checked is still required by your contract.
The debate: was the pause justified?
The Pentagon gave three main reasons for the pause: high costs and burdens for the defense industrial base, especially small businesses; a shortage of third-party assessors; and complex rules and timelines.
The October 26 Federal News Network report, by reporter Jason Miller, says DoD’s own RFI data tells a different story. According to that report:
- DoD received 997 usable responses to its RFI, and 509 came from the defense industrial base.
- Respondents mostly blamed the cost of meeting NIST SP 800-171 controls. Their examples included licensing such as Microsoft 365 GCC High, secure enclaves, documentation and outside service providers. Third-party assessors ranked fifth among cost drivers.
- DoD’s own analysis put the average CMMC assessment cost at $47,000 and said prices had come down over the first year.
- As of September, 2,433 companies had earned Level 2 certification, about five times DoD’s first-year estimate, which cuts against the claim of an assessor shortage.
The same report says the review has now run more than 100 days, well past the 60 days announced in July. DoD and the Cyber AB, the body that accredits assessors, declined to comment to Federal News Network. In August, Davies told a defense industry conference that protecting federal data is “table stakes” and a requirement that “never went away,” according to a CMMC industry recap of her remarks. She did not give a date for the task force’s report.
So there are two fair readings. One side says the Pentagon is cutting red tape that hurts small suppliers. The other says the data shows the hard part is the security work itself, and the audit was simply the step that proved it got done. Both sides agree on one thing: the NIST controls are not going away.
Our stance: treat the pause as extra time
We think business owners should read the CMMC pause as a gift of time. The certification step moved. The cost of the underlying security work did not, and the risk of claiming compliance you do not have went up, since self-assessments are now the main thing standing between you and a contract.
That risk is concrete. The Justice Department’s Civil Cyber-Fraud Initiative uses the False Claims Act against contractors who allegedly misstate their cybersecurity. On June 18, 2026, the DOJ announced that LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve allegations that it did not meet NIST SP 800-171 requirements on two Navy contracts. A DCMA assessment gave the company a score of -170 on a scale of -203 to 110, according to the DOJ release and Mayer Brown. The DOJ noted that the claims are allegations only and that there has been no determination of liability.
Cases like this do not need CMMC Phase 2 to exist. They rest on the DFARS clauses and the scores contractors already post. If your SPRS score says 110 and your network says otherwise, the pause does nothing to protect you.
There is also a business reason to keep going. Primes are still choosing subcontractors, and many will favor suppliers who can show a clean, honest score and solid documentation. When a reformed CMMC program arrives, the companies that kept working will be ready on day one.
What small defense contractors should do now
You do not need to spend more than you planned. You need to keep the work steady and make sure your paperwork matches reality. Here is the order we suggest:
1. Re-check your SPRS score
Pull your current score and compare it to your System Security Plan (SSP). If controls have slipped, or your score was optimistic when you posted it, correct it. An accurate low score with a real plan is far safer than an inflated one.
2. Finish your System Security Plan and POA&M
Your SSP describes how you meet each control. Your Plan of Action and Milestones (POA&M) lists what is still open and when you will fix it. Respondents in the DoD RFI named the SSP as one of the biggest overhead items, so it is worth getting help if it has stalled. Our NIST 800-171 compliance guide walks through the control families in plain language.
3. Close the high-value technical gaps first
Some controls carry more points and more real-world risk. Multi-factor authentication, FIPS-validated encryption for CUI, logging and monitoring, and incident response are good places to start. If you run Microsoft 365, review the settings in our Microsoft 365 security settings checklist, and confirm whether your CUI belongs in a GCC High tenant or a separate enclave.
4. Rehearse your 72-hour incident report
DFARS 252.204-7012 still requires you to report a cyber incident within 72 hours. Know who makes the call, where the logs live, and who has the DIBNet access needed to file the report.
5. Get any contract change in writing
If a prime or contracting officer tells you a CMMC requirement is dropped, ask for the contract modification in writing before you change your plans. Review any agreements you already signed with an assessor for deferral or refund terms.
6. Watch for the task force report
The reform task force has not published its recommendations. When it does, the details will matter: which levels change, whether outside assessments return, and on what timeline. The broader federal rule on CUI, now part of the FAR overhaul, could also bring similar requirements to civilian agency contracts.
If you are not sure whether you even handle CUI, our article on how to choose an IT provider covers the questions to ask any partner who will help you scope it.
FAQ: the CMMC pause and your contracts
Is CMMC canceled?
CMMC has not been canceled. DoD suspended Phase 2 and paused future milestones while a reform task force reviews the program. The CMMC rule and DFARS 252.204-7021 remain in force, and Phase 1 self-assessment requirements still apply.
Do I still need to meet NIST SP 800-171?
You do if your contract includes DFARS 252.204-7012. The 110 controls in NIST SP 800-171 Revision 2, the SPRS score and the 72-hour incident reporting rule all still apply.
Can I still get a Level 2 certification from a C3PAO?
Level 2 assessments are still available. The pause removed the requirement from upcoming contracts. Under DFARS 252.204-7021, a higher CMMC status satisfies a lower stated level, so a Level 2 certification still counts.
What is the biggest risk during the pause?
Posting a self-assessment score you cannot back up. The Justice Department continues to pursue False Claims Act cases over cybersecurity, and those cases rely on the clauses and scores already in your contracts.
Get a straight answer on your CMMC readiness
SADOS supports defense contractors and other regulated businesses across Maryland, Virginia and Washington, DC. Our engineers can review your SPRS score, SSP and Microsoft 365 setup and give you a clear list of what to fix first, at a pace your budget can handle. Talk to a SADOS engineer about your CMMC plan.
This article is general information and is not legal advice. Check your specific contract obligations with your contracting officer or counsel.
Compliance
Compliance
Compliance