CMMC Phase 2 Is Suspended: But Your Compliance Obligations Aren't: What Federal Contractors Must Do Now

By Josh Hammer

At the same time, the Department launched a CMMC Reform Task Force with a 60-day, top-to-bottom review of the program. Its final report is expected around mid-September 2026.

That is significant news. It is also easy to misunderstand.

The suspension pauses a verification mechanism. It does not erase your responsibility to protect Controlled Unclassified Information (CUI), comply with applicable contract clauses, maintain accurate self-assessments, or demonstrate that your security program is real.

In practical terms, federal contractors now face a two-track compliance environment:

1. CMMC Phase 1 self-assessment obligations remain in force.
2. The regulatory direction is moving toward broader, more detailed NIST SP 800-171 Rev. 3 requirements.

My recommendation is straightforward: do not stand down. Use this period to make your compliance program more defensible, more automated, and less dependent on a future deadline.

Tier 1: What the CMMC Phase 2 suspension means

What changed on July 13?

The July 13 memorandum suspended CMMC Phase 2 requirements across Department of Defense solicitations and contracts. The suspended phase would have expanded mandatory external verification, including:

• CMMC Level 2 assessments performed by a Certified Third-Party Assessment Organization, or C3PAO.
• CMMC Level 3 assessments conducted through government-led DIBCAC processes.
• Additional implementation milestones associated with later phases of the CMMC rollout.

The Department also directed acquisition organizations to remove suspended Level 2 and Level 3 assessment requirements from active solicitations as soon as practicable.

Read the Federal News Network report on the suspension and reform review, which includes the July 13 memorandum from DoD CIO Kirsten Davies.

DefenseScoop likewise reported that the Department halted the Phase 2 cybersecurity requirements that were set to take effect in November.

The important phrase is “held in abeyance until further notice.” Phase 2 has been suspended, not permanently repealed. The task force may recommend a revised framework, a different assessment model, or a broader restructuring of the program.

Until that happens, contractors should plan for uncertainty rather than assume the CMMC program is finished.

What did not change?

The following obligations remain relevant and enforceable where they apply to your contract, system, or information:

• Protecting CUI and covered defense information.
• Implementing applicable NIST SP 800-171 requirements.
• Complying with DFARS 252.204-7012 and related clauses.
• Performing required CMMC Level 1 or Level 2 self-assessments.
• Maintaining accurate SPRS scores and senior official affirmations.
• Reporting qualifying cyber incidents within required timelines.
• Preserving evidence and records supporting your security representations.
• Flowing down applicable requirements to subcontractors that handle CUI.

As Mayer Brown explains in its July analysis, the suspension affects the timing and structure of third-party certification. It does not eliminate the underlying cybersecurity requirements.

That distinction matters because a self-assessment is still a representation. If your organization says it has implemented a control, you need a reasonable basis for that statement.

A spreadsheet with unchecked boxes is not a security program.

Why you should care about accurate records

CMMC compliance is not only an acquisition issue. It can also become an enforcement issue.

If a contractor knowingly misrepresents its cybersecurity posture, that representation may create contractual, financial, and legal exposure. The Department of Justice has already demonstrated that cybersecurity representations can become the basis for False Claims Act actions.

That means your organization should be able to answer basic questions such as:

• Which systems process, store, or transmit CUI?
• Which users and administrators can access those systems?
• Which NIST SP 800-171 practices are fully implemented?
• Which practices are partially implemented or planned?
• What evidence supports each conclusion?
• Who approved the assessment?
• When was the evidence last reviewed?
• What changed after the assessment?

The suspension gives you more time before a C3PAO assessment may be required. It does not give you permission to make unsupported claims.

The 60-day CMMC Reform Task Force review

The reform review is intended to examine whether the current CMMC structure imposes disproportionate costs on small, medium-sized, and nontraditional defense contractors.

That concern is legitimate. Many contractors have struggled with:

• Limited availability of qualified assessors.
• High consulting and remediation costs.
• Confusing scoping decisions.
• A shortage of personnel who understand both cybersecurity and federal contracting.
• The difficulty of securing operational technology, building systems, and facility-related control systems.
• A compliance process that can reward documentation volume instead of measurable risk reduction.

The Department’s stated direction is to seek scalable and resilient security measures while reducing unnecessary administrative barriers.

The Crowell & Moring analysis notes that the task force is expected to use industry feedback in developing its recommendations. Crowell’s related solicitation guidance also advises contractors to monitor whether agencies properly amend solicitations that still contain suspended Phase 2 requirements.

The task force’s report should be treated as a decision point, not a reason to pause your program.

Tier 2: The next compliance issue is already visible - NIST SP 800-171 Rev. 3

While the Department reviews CMMC, the FAR Council is moving in a direction that could make NIST SP 800-171 Rev. 3 the government-wide baseline for contractors handling CUI.

On June 23, 2026, the FAR Council proposed a revised CUI rule under FAR Case 2026-001. If finalized, the rule would require covered contractors to implement NIST SP 800-171 Rev. 3 on systems that process, store, or transmit CUI.

The proposal would also establish new mechanisms for identifying covered CUI systems, incident reporting expectations, subcontractor flow-down, cloud security, and enhanced requirements for certain critical programs or high-value assets.

This is a proposed rule, not a final rule. It is not automatically binding merely because it was published. But it is an important signal about the federal government’s direction.

You can review the technical standard directly through NIST’s official SP 800-171 Rev. 3 publication.

NIST states that Rev. 3 supersedes Rev. 2 and reorganizes the requirements into a broader set of control families, including:

• Access Control.
• Awareness and Training.
• Audit and Accountability.
• Configuration Management.
• Incident Response.
• Identification and Authentication.
• Risk Assessment.
• System and Services Acquisition.
• System and Communications Protection.
• Supply Chain Risk Management.

For many defense contractors, this creates a planning challenge. Current DoD contract obligations may still point to NIST SP 800-171 Rev. 2, while future government-wide requirements may move toward Rev. 3.

The answer is not to ignore Rev. 3 until a final rule appears. The answer is to map the requirements and identify where your existing controls can support both versions.

Rev. 2 and Rev. 3 require a transition plan

A contractor preparing for CMMC 2.0 readiness should now maintain a clear distinction between:

• Current contractual obligations.
• Proposed future obligations.
• Internal improvements that reduce risk under both versions.

For example, stronger identity management, centralized logging, asset inventory, incident response testing, and supplier oversight are not wasted investments. They support the current security baseline while improving your readiness for future requirements.

The difficult work is not merely reading the control language. It is determining how each requirement applies to your environment.

That is especially true for construction firms, facility operators, and companies responsible for facility-related control systems. A traditional IT-only boundary may not adequately capture building automation, engineering workstations, remote access pathways, vendor connections, or operational technology that supports a federal facility.

A CMMC readiness assessment that ignores those systems may produce a clean report and an inaccurate picture.

Scoping remains the foundation

Before you automate evidence collection, you need to know what belongs inside the boundary.

Ask:

1. Where does CUI enter the organization?
2. Where is it stored?
3. Which applications process it?
4. Which users, contractors, and vendors can access it?
5. Which endpoints connect to the environment?
6. Which cloud services support the covered system?
7. Which facility or control systems protect that environment?
8. Which systems are out of scope, and what technical controls enforce that separation?

A smaller, defensible CUI environment is often easier to protect than an enterprise-wide environment where the boundary is unclear. But scope reduction must be supported by architecture, access controls, data-flow analysis, and written policy.

It cannot be based on assumption.

What contractors should do before mid-September

The task force is expected to complete its review around mid-September. That creates a short but valuable planning window.

1. Review every active solicitation and contract

Look for language requiring:

• CMMC Level 2 certification by a C3PAO.
• CMMC Level 3 DIBCAC assessment.
• November 10, 2026 implementation milestones.
• Waiver procedures associated with the suspended phase.
• Requirements that conflict with the July 13 implementation memorandum.

If the language remains in a solicitation, use the question-and-answer process to seek clarification. As Crowell & Moring notes, contractors should consider their procurement rights if an agency fails to update an affected solicitation.

2. Complete or refresh your self-assessment

Do not treat an old assessment as permanent evidence.

Refresh your assessment when:

• Your network architecture changes.
• You migrate systems to a new cloud environment.
• A new subcontractor receives CUI.
• Your incident response process changes.
• You deploy new remote access tools.
• You modify facility or operational technology systems.
• A key security control moves from manual to automated operation.

Your assessment should reflect your environment as it exists today.

3. Build a Rev. 2-to-Rev. 3 crosswalk

NIST provides change-analysis materials for comparing Rev. 2 and Rev. 3. Use them to identify:

• Controls that remain substantially aligned.
• Requirements that have changed.
• New organization-defined parameters.
• Documentation that will need to be revised.
• Evidence sources that can support multiple frameworks.

This is where CMMC compliance automation can create measurable value. Instead of repeating the same analysis for every framework, you can map common controls once and reuse evidence where the requirements overlap.

4. Test your incident response process

A policy stating that incidents will be reported is not the same as an organization that can report one.

Run a tabletop exercise. Test whether your team can:

• Identify a suspected incident.
• Determine whether CUI may be involved.
• Preserve relevant evidence.
• Escalate the event to the right decision-makers.
• Meet the applicable reporting timeline.
• Notify affected subcontractors or customers.
• Record the final determination.

The goal is not to produce a perfect exercise. The goal is to find the gaps before a real incident exposes them.

5. Review subcontractor flow-down

A contractor can have a mature internal environment and still face risk through a subcontractor.

Create an inventory of every external party that:

• Receives CUI.
• Stores project data.
• Provides managed IT or security services.
• Supports engineering or facility systems.
• Maintains remote access.
• Hosts applications or backups.

Then verify that contractual terms, technical controls, and evidence requirements align.

Tier 3: Why compliance automation matters more during a pause

Some organizations view the suspension as a reason to delay investment. I see the opposite.

When deadlines are changing, manual compliance becomes even harder to manage. You need continuous visibility into what is required, what has changed, and what evidence supports your position.

That is the role of a compliance automation platform.

Complynt combines automated control mapping, evidence collection, monitoring, policy content, and expert guidance. It is designed to help organizations manage complex frameworks without rebuilding their compliance program for every new rule.

For federal contractors, the value is practical:

• Map CMMC and NIST controls to common evidence.
• Identify missing or stale documentation.
• Track remediation work.
• Monitor changes in the environment.
• Maintain audit-ready records.
• Give leadership a current view of compliance posture.
• Prepare for a future assessment without waiting for a deadline.

Automation should not replace judgment. It should remove repetitive work so your team can focus on scope, risk, architecture, and decisions that require expertise.

That is why H&V Complynt uses a hybrid model: technology handles control mapping, evidence collection, monitoring, and documentation; experienced advisors help interpret requirements and address complex environments.

You can learn more about H&V’s CMMC Level 2 compliance services or request a free gap assessment.

The right conclusion: pause the deadline anxiety, not the security work

CMMC Phase 2 is suspended. The November 10 third-party assessment requirement is no longer the immediate deadline many contractors expected.

But your obligations remain.

You still need to protect CUI. You still need accurate self-assessments. You still need defensible evidence. You still need to comply with applicable DFARS requirements. And you should prepare for a regulatory environment that may increasingly reference NIST SP 800-171 Rev. 3.

The best strategy is not to chase whichever deadline appears next. It is to build a durable compliance capability that can adapt when the task force publishes its recommendations.

In my view, the contractors that benefit most from this pause will be the ones that use it to replace manual, fragmented compliance with continuous visibility and disciplined execution.

The question is not, “Do I still need a C3PAO this year?”

The better question is, “If the government asks me tomorrow to demonstrate how I protect CUI, can I prove it?”

That is the standard your organization should be preparing to meet.

---