The CMMC Report Is Sitting on the CIO's Desk: Four Outcomes, One Decision You Can Make Now

By Josh Hammer

September 21, 2026

The CMMC Reform Task Force has completed its 60-day review. Its recommendations have been delivered to Department of War CIO Kirsten Davies. The report is not public.

That silence is now the dominant fact in the defense contractor market. Industry observers expect the recommendations to emerge in early October, but no contractor can responsibly build a compliance strategy around an unpublished memo.

My position is straightforward: policy silence is not enforcement silence.

The Department’s review may change how CMMC is administered. It does not erase the cybersecurity obligations already attached to federal contracting. While industry waits for the report, contractors still face active contract requirements, annual affirmations, SPRS scoring, cyber incident exposure, False Claims Act risk, and an operating environment that changes faster than most compliance programs.

The decision you can make now is to build a control environment that survives all four plausible outcomes.

What changed, and what did not

The most important recent development is the codification of the CMMC Phase 2 suspension.

On September 3, the Pentagon signed Class Deviation 2026-O0025, Revision 3, moving the Phase 2 pause from an administrative policy position into enforceable acquisition instructions. The deviation removes C3PAO certification requirements from active solicitations and contracts, establishes November 10, 2028 as a new universal mandate trigger date, and introduces additional restrictions involving Huawei-linked semiconductors, restricted drone components, and employee-data transfers. See the reporting from GovConIC and Kiteworks.

But the deviation did not suspend the underlying cybersecurity baseline.

DFARS 252.204-7012, NIST SP 800-171 Rev. 2, SPRS scoring, annual affirmations, and CMMC Level 1 and Level 2 self-assessments remain relevant. H&V’s CMMC FAQ summarizes the current baseline, including the fact that Level 3 may be supported through a custom solution.

The Task Force’s report may recommend a new model. It cannot, by itself, rewrite your contract.

According to Washington Technology, CIO Kirsten Davies will decide when the recommendations become public. DefenseScoop reports that the Department reviewed more than 1,100 industry responses and over 10,000 pages of material.

That is a substantial review. It is also not a compliance exemption.

Four outcomes contractors should be prepared to handle

No one outside the Department knows what the final recommendations will say. However, four broad outcomes are realistic.

Outcome 1: Phase 2 resumes after a delay

The Department could preserve the existing CMMC structure and simply move the schedule. Third-party assessments would return, perhaps with revised transition dates and additional guidance.

What changes for you:

• Assessment burden: High. You would still need an assessment-ready environment and objective evidence.
• Evidence expectations: Detailed policies, technical artifacts, implementation records, and proof that controls operate consistently.
• Cost: Potentially substantial if you have postponed remediation.
• Timeline: Shorter than it appears. Assessment queues, remediation, and internal approvals take months.

This is the most obvious reason to continue preparing. If Phase 2 returns substantially intact, organizations that used the pause as preparation time will have a material advantage.

Outcome 2: Third-party certification returns in a narrower scope

The Department could retain independent assessment for higher-risk contractors while allowing more self-assessment or phased verification for smaller organizations, selected contract types, or certain operational technology environments.

What changes for you:

• Assessment burden: Lower for some contractors, but not eliminated.
• Evidence expectations: Still essential. A narrower assessment scope does not make unsupported claims defensible.
• Cost: More variable. Some organizations may avoid full certification costs, while high-risk CUI environments may face deeper scrutiny.
• Timeline: More dependent on contract language and data flows.

This outcome would reward accurate scoping. Do you know exactly where FCI and CUI are stored, processed, and transmitted? If not, you cannot know which requirements a narrower program would actually narrow.

Outcome 3: Expanded self-assessment with executive attestation

The Department could extend the self-assessment model while increasing the weight of executive accountability, evidence retention, government-led assessments, and enforcement against inaccurate representations.

What changes for you:

• Assessment burden: Less third-party scheduling, more internal responsibility.
• Evidence expectations: Higher, not lower. A self-assessment without supporting evidence is an assertion, not a defensible compliance position.
• Cost: Lower assessment cost, but continuing investment in controls, documentation, monitoring, and leadership oversight.
• Timeline: Immediate. Your score and affirmation must reflect reality now.

This is where False Claims Act exposure becomes especially important. On September 1, Honeywell Aerospace agreed to pay $2,042,518 over alleged NIST SP 800-171 lapses occurring from April 2020 through December 2023, with a whistleblower share of $375,823. The settlement is summarized in this cyber False Claims Act enforcement report.

The DOJ’s National Fraud Enforcement Division also became operational on August 24, with procurement fraud and defective certifications among its named priorities.

A pause in certification is not permission to inflate your SPRS score.

Outcome 4: Deeper restructuring of CMMC

The Department may redesign the program around risk tiers, operational technology, continuous monitoring, clearer CUI marking, and different verification paths for different contractors.

CIO Davies has already questioned point-in-time compliance models and emphasized the need for continuous cybersecurity. The Department has also acknowledged that manufacturing and facility-related operational technology do not fit neatly into a framework designed primarily around information systems.

What changes for you:

• Assessment burden: Uncertain in form, but likely more continuous.
• Evidence expectations: More operational, automated, and time-stamped.
• Cost: Greater emphasis on lifecycle cost rather than one-time assessment spending.
• Timeline: Longer transition, but no pause in the need to improve your environment.

For contractors operating factories, laboratories, facilities, or facility-related control systems, this is the outcome that most clearly demonstrates why a generic compliance checklist is inadequate.

The common denominator is an evidence-backed control environment

These four outcomes differ in process. They do not differ much in foundation.

The common denominator is a defensible implementation of NIST SP 800-171, accurate SPRS reporting, documented scope, and evidence that controls operate over time.

You should also maintain a deliberate Rev. 2-to-Rev. 3 crosswalk. The government-wide direction is moving toward NIST SP 800-171 Rev. 3 through the proposed FAR CUI rule and related modernization efforts. You do not need to discard Rev. 2 work. You do need to understand where Rev. 3 changes the control intent, assessment expectations, or evidence you should collect.

This is where “map once, satisfy many” becomes more than a marketing phrase.

A well-designed control environment can support:

• CMMC and NIST SP 800-171
• NIST SP 800-53 and RMF
• SOC 2
• FedRAMP and the 2026 Consolidated Rules
• DoD IL5 environments
• Privacy, healthcare, AI governance, and other regulatory obligations

FedRAMP’s Consolidated Rules for 2026 make the same direction clear: more reusable evidence, clearer rules, and stronger ongoing maintenance. The FedRAMP timeline identifies December 7, 2026 milestones for new Vulnerability Detection and Response and Vulnerability Evaluation and Reporting rulesets, January 1, 2027 as the mandatory CR26 date for all stakeholders, June 11, 2027 as the final date for new Rev. 5 applications, and December 31, 2028 as the sunset for remaining Rev. 5 authorizations.

The operational tempo is not slowing. On September 18, CISA added three actively exploited Linux kernel vulnerabilities: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964-to the KEV catalog. Federal civilian agencies received a three-day patch deadline under BOD 26-04, whose broader mandatory adoption date is December 7, 2026. The reporting from TechTimes and Cryptika illustrates the point: cyber risk continues to move while policy documents are being reviewed.

Compliance tools do not create a compliance process

This distinction matters.

A compliance platform can automate control mapping, collect evidence, monitor changes, and produce dashboards. It cannot decide whether your CUI boundary is accurate. It cannot make a policy operational. It cannot turn an unimplemented control into an implemented one.

Tools support the compliance process. They do not replace it.

Before selecting software, conduct an audit of your current state. Establish your scope. Validate your SPRS score. Identify control gaps. Assign owners. Build a remediation plan with dates, dependencies, evidence requirements, and executive accountability.

Only then should you choose technology.

What to do this week

1. Inventory every DoD contract, solicitation, and subcontract flow-down.
2. Confirm where FCI and CUI are stored, processed, or transmitted.
3. Recalculate your SPRS score using evidence, not intent.
4. Review all 110 NIST SP 800-171 Rev. 2 requirements.
5. Create a Rev. 2-to-Rev. 3 crosswalk.
6. Identify controls that affect facility-related and operational technology systems.
7. Document the top ten remediation actions, owners, and deadlines.
8. Brief your CIO, CFO, or executive sponsor on enforcement exposure.
9. Do not wait for the Task Force report before beginning the readiness process.

H&V Complynt supports this work through automated control mapping, evidence collection and monitoring, pre-built framework content packs, policy-as-code, and a continuous compliance dashboard. Our hybrid model combines automation with expert guidance for complex facility and control system environments, supported by FedRAMP High and DoD IL5 authorized infrastructure.

But the right first step is not buying a tool. It is a readiness and gap assessment.

Use the H&V Complynt readiness check to establish a baseline, identify priority gaps, and build a plan that remains useful regardless of what the CIO releases in October.

Frequently asked questions

Is CMMC suspended completely?

No. Phase 2 third-party certification requirements have been suspended and codified through Class Deviation 2026-O0025 Revision 3. Underlying requirements involving DFARS 252.204-7012, NIST SP 800-171 Rev. 2, SPRS scoring, annual affirmations, and applicable self-assessments remain relevant.

When will the CMMC Reform Task Force report become public?

As of September 21, 2026, no recommendations have been publicly released. The report has been delivered to CIO Kirsten Davies, who controls the release decision. Industry observers expect public recommendations in early October.

What should a contractor do while waiting?

Audit your current environment, validate your scope and SPRS score, close NIST SP 800-171 gaps, collect evidence, and maintain an executive-approved remediation plan. Waiting without doing this is itself a compliance decision.

Will a compliance automation platform make us CMMC compliant?

No. A platform can support evidence collection, control mapping, monitoring, and reporting. Compliance remains a management process requiring implemented controls, accountable owners, accurate scope, documented procedures, and reliable evidence.

What is the best first step before choosing a compliance solution?

Conduct a readiness or gap assessment. Understand your current state and build a prioritized plan before selecting technology, consultants, or managed services.