CMMC Reform Lands September 13 : and DOJ's New Fraud Division Just Raised the Stakes for Defense Contractors

By Josh Hammer

On July 13, 2026, the Department of War suspended the next phase of Cybersecurity Maturity Model Certification, removing the immediate requirement for many contractors to obtain a third-party Level 2 assessment by November 10. That decision gave the defense industrial base more time: but it did not give contractors permission to stop preparing.

Now the stakes are higher for another reason. On August 24, a new Department of Justice National Fraud Enforcement Division became operational, with authority covering fraud involving money owed to or paid by the United States. DOJ has also identified defective certifications and procurement fraud as enforcement priorities.

For defense contractors, the message is direct: CMMC 2.0 readiness is no longer just an assessment problem. It is a contract integrity, operational resilience, and fraud-risk problem.

The Reform Task Force is expected to deliver its recommendations around September 13, following the 60-day review launched after the suspension. Its decision could change the mechanics of certification. It will not eliminate the need to protect Controlled Unclassified Information (CUI), maintain accurate records, or substantiate what you tell the government.

My position is simple: use the pause to build a defensible compliance process: not to wait for another deadline.

Tier 1: What the CMMC pause actually means

CMMC in plain English

CMMC is the Department of War’s framework for verifying that contractors protect Federal Contract Information (FCI) and CUI.

Under the current three-level structure:

• Level 1 applies primarily to organizations handling FCI.
• Level 2 applies to organizations handling CUI and is based largely on the security requirements in NIST SP 800-171.
• Level 3 applies to organizations handling the most sensitive CUI and facing advanced persistent threats, with additional requirements based on NIST SP 800-172.

The purpose is not to produce another certificate for a wall. CMMC is intended to verify that the systems, people, policies, and processes supporting federal work are actually secure.

That distinction matters because a certification cannot compensate for a weak security program. It can only assess the program that exists.

Why Phase 2 was suspended

Phase 2 was scheduled to begin on November 10, 2026. It would have allowed the Department of War to require Level 2 third-party certification as a condition of contract award for many organizations handling CUI.

The July 13 memo from DoW CIO Kirsten Davies suspended that transition and froze later implementation milestones while a Reform Task Force conducts a top-to-bottom review. The memo cited several concerns:

• High compliance costs, especially for small businesses.
• A shortage of qualified third-party assessors.
• Regulatory and implementation confusion.
• Barriers affecting nontraditional and innovative suppliers.
• The need to align cybersecurity requirements with the Department’s Acquisition Transformation Strategy.

The DoW memorandum is clear on one point: the suspension applies to upcoming CMMC implementation milestones. It does not suspend the underlying contractual cybersecurity requirements.

The Department of War release describes the pause as a strategic review rather than a repeal.

What the Reform Task Force may recommend

The Task Force collected industry comments through August 14. Its recommendations are expected around September 13, although the final policy timeline may move as the Department reviews the findings and develops formal changes.

Four outcomes are most likely:

1. Resume Phase 2 on a delayed schedule.

The Department could preserve the current structure and simply provide more time for contractors and assessors.

2. Narrow the scope of third-party certification.

Some organizations may receive a more limited assessment requirement based on the type of CUI they handle, their role in the supply chain, or the way they access government data.

3. Replace some certifications with enhanced self-assessment and executive attestation.

This could reduce assessment costs, but it would increase the importance of accurate records and executive accountability.

4. Restructure CMMC more deeply.

The Department could create a more scalable model involving certified enclaves, hosted environments, government-led assessments, or differentiated requirements based on actual data flows.

Which outcome is best? I believe the right answer is a risk-based structure that follows the data, distinguishes between access and custody, and does not impose the same architecture on a machine shop and a prime contractor operating a high-value weapons system.

But reform should improve execution: not weaken security.

Tier 2: The obligations that did not pause

DFARS 252.204-7012 remains active

The DFARS 252.204-7012 clause continues to require contractors to safeguard covered defense information and report cyber incidents.

That means contractors must continue to address requirements involving:

• Protection of covered defense information.
• Cyber incident reporting.
• Preservation of relevant images and information.
• Cooperation with government investigations.
• Flow-down obligations to applicable subcontractors.

The CMMC pause does not erase those duties. If the clause is in your contract, your responsibilities remain.

NIST SP 800-171 Rev. 2 remains the practical baseline

For current CMMC and DFARS obligations, NIST SP 800-171 Rev. 2 remains the operative baseline for protecting CUI in nonfederal systems.

The NIST publication organizes the requirements into control families including access control, audit and accountability, configuration management, identification and authentication, media protection, physical and environmental protection, and system and communications protection.

The transition to Rev. 3 remains an important horizon, but the timetable and contractual impact are uncertain while the CMMC program is under review. Contractors should monitor official guidance rather than prematurely rebuilding their entire compliance program around an assumed transition date.

The prudent approach is to maintain a control structure that can accommodate both versions.

SPRS scores are not casual estimates

Many contractors still treat their Supplier Performance Risk System score as an internal planning number. That is a mistake.

Your SPRS score and related annual affirmations are representations connected to federal contracting. If the score is based on unsupported claims, incomplete evidence, or an inaccurate assessment of implemented controls, the risk is not merely that an assessor will disagree with you.

The government may view a materially false representation as evidence of contract noncompliance or a potential False Claims Act issue, particularly if the representation helped your organization obtain or retain federal work.

You should be able to answer four questions for every material score:

1. What evidence supports the score?
2. Which system boundary was assessed?
3. Which controls are fully implemented, partially implemented, or not implemented?
4. Who reviewed and approved the submission?

If those answers are not documented, your score is vulnerable.

The DOJ Fraud Division changes the enforcement environment

On August 18, DOJ published the final rule establishing the National Fraud Enforcement Division. The rule became effective August 24.

The Federal Register notice, 91 FR 53357, gives the new division authority over criminal proceedings involving, among other areas, fraud involving money owed to or paid by the United States. That jurisdiction reaches procurement fraud and other misconduct affecting federal programs.

The Gibson Dunn analysis describes the division as a significant new DOJ component with data-driven investigative capabilities and broad authority to investigate and prosecute fraud against taxpayer-funded programs.

Why should a cybersecurity leader care?

Because cybersecurity representations are increasingly tied to contract eligibility, payment, renewal, and supply-chain access. If a contractor claims to have implemented NIST 800-171 controls when it has not, submits an SPRS score that cannot be supported, or signs an affirmation without a reasonable basis, that statement may become part of a broader procurement-fraud inquiry.

The new enforcement environment also makes poor documentation more dangerous. A missing policy is a compliance gap. A knowingly unsupported representation can become evidence of intent.

CUI scoping remains the central cost problem

The industry comments submitted to the Reform Task Force identify a problem that should have been addressed much earlier: many contractors still do not know precisely what information is CUI, where it enters their environment, who can access it, or whether they create it during contract performance.

The Federal News Network report describes inconsistent CUI marking as one of the most frequently cited concerns among small businesses. The SBA Office of Advocacy said uncertainty about CUI was the “most frequently cited concern” in its comments.

The consequences are predictable. When a contractor cannot confidently identify its CUI boundary, it often includes everything:

• Every corporate laptop.
• Every user.
• Every shared drive.
• Every facility system.
• Every subcontractor.
• Every email account.

That approach increases cost and complexity without necessarily improving security.

CMMC follows the data. If the data is over-scoped, CMMC is over-scoped. If the data is under-scoped, the organization may leave sensitive information exposed.

Before investing in a major compliance architecture, ask the prime contractor or contracting officer:

• What CUI categories are involved?
• What data will we receive?
• In what format and through which systems?
• Are we expected to store, process, transmit, or merely view it?
• Will we create CUI during performance?
• Can access occur through a certified hosted enclave?

This is not an administrative exercise. It is the foundation of a defensible cybersecurity program.

NIST 800-53, RMF, and higher-security environments

CMMC is not the only framework relevant to federal contractors.

Organizations supporting federal systems may also encounter:

• NIST SP 800-53 controls.
• The Risk Management Framework (RMF).
• FedRAMP compliance requirements.
• DoD IL5 compliance requirements.
• Facility-related control systems and operational technology requirements.

The frameworks overlap, but they are not interchangeable. NIST 800-171 is not NIST 800-53. CMMC certification is not the same as an Authority to Operate. FedRAMP authorization is not achieved simply by buying a compliance tool.

The opportunity is to map overlapping controls while preserving each framework’s distinct scope and evidence requirements.

Tier 3: What contractors should do now

Do not choose software before conducting an audit

This is the most important advice I can offer.

A compliance tool is not the compliance process.

Software can organize evidence, map controls, identify gaps, and monitor changes. It cannot decide whether your engineering drawings qualify as CUI. It cannot determine whether your facility’s building automation system belongs inside the assessment boundary. It cannot make an executive attestation truthful.

Before selecting a compliance automation platform, conduct an audit and build a plan:

1. Define the contract obligations.

Review DFARS clauses, flow-down requirements, CUI categories, and applicable framework provisions.

2. Map the data and system boundary.

Identify where CUI enters, moves, resides, and leaves your environment.

3. Assess actual implementation.

Do not score intentions. Test policies, technical controls, access permissions, logging, incident response, and physical safeguards.

4. Build a remediation roadmap.

Prioritize high-risk gaps, assign owners, set dates, and document accepted risks.

5. Select technology that supports the plan.

The platform should reduce repetitive work without replacing professional judgment.

6. Create an evidence lifecycle.

Evidence should be collected continuously, reviewed periodically, and tied directly to the control and system that produced it.

Where Complynt fits

At H&V Complynt Cybersecurity Solutions, we built Complynt around this distinction.

Complynt is an enterprise-grade compliance automation platform designed to support federal contractors, construction firms, and facility operators with complex IT, OT, and control-system environments.

The platform helps organizations:

• Automate control mapping across CMMC, NIST 800-171, NIST 800-53, RMF, SOC 2, and other frameworks.
• Collect evidence from existing systems.
• Monitor control status continuously.
• Maintain audit-ready documentation.
• Track remediation and accountability.
• View compliance posture through a centralized dashboard.
• Reuse overlapping evidence across frameworks.

That is the “map once, satisfy many” principle. A well-designed access-control process may support CMMC, NIST, SOC 2, and portions of an RMF package. A logging control may support multiple frameworks at once. The work still must be performed correctly, but you should not have to reproduce the same evidence manually for every standard.

Complynt also supports environments that traditional cloud-focused tools often overlook, including physical automation and operational technology. That matters for construction firms, facility operators, and federal organizations working with facility-related control systems.

Our model combines automation with expert guidance. The platform handles repetitive tasks. Compliance specialists help interpret requirements, scope complex environments, develop remediation plans, and prepare teams for assessment.

The infrastructure matters, too. Complynt is hosted on government-grade infrastructure authorized for FedRAMP High and DoD IL5 environments. That does not make an organization compliant by itself, but it provides a stronger foundation for organizations managing sensitive federal workloads and compliance evidence.

The decision in front of you

The question is not whether CMMC will return in its current form. It may not.

The question is whether your organization can prove, today, that it understands its obligations and has a credible process for meeting them.

If Phase 2 returns on a delayed schedule, prepared contractors will be ahead. If third-party certification is narrowed, prepared contractors will still benefit from accurate self-assessments and executive attestations. If CMMC is restructured, prepared contractors will have the data, evidence, and system boundaries needed to adapt.

Unprepared contractors will be starting over.

I recommend that every defense contractor use this period to complete three actions:

1. Conduct a documented CMMC and NIST 800-171 gap assessment.
2. Confirm the CUI boundary with primes and contracting officers.
3. Build a prioritized remediation plan before purchasing technology.

Then choose tools that support the process rather than pretending to replace it.

H&V offers a free compliance readiness check and a CMMC Level 2 compliance service for organizations that need structured support. You can also learn more about Complynt cyber compliance as a service or our specialized RMF Division 25 and FRCS hardening services.

The September 13 Task Force milestone may change the rules of the road. It will not change the direction of travel.

Protect the data. Document the controls. Validate every representation. Build a compliance process that can withstand both an assessment and an investigation.