The CMMC Review Window Has Closed: The Pause Is Codified, Enforcement Is Live, and Continuous Monitoring Is the Future

By Josh Hammer

As of September 14, 2026, the CMMC Reform Task Force’s 60-day review window has reached its deadline. The public report has not.

That distinction matters.

DoD CIO Kirsten Davies has indicated that the department expects to release the task force’s recommendations roughly 15 days after submission, placing the public release toward the end of September. Until then, contractors should not treat speculation, headlines, or informal interpretations as a substitute for an official rule, class deviation, or contract modification.

What is official is more consequential: the Department of Defense has now codified the CMMC Phase 2 pause through Class Deviation 2026-O0025, Revision 3, issued September 3, 2026, by John Tenaglia. Contracting officers must remove third-party assessment requirements from active solicitations and existing contracts. At the same time, the deviation preserves baseline cybersecurity obligations and defers the universal CMMC mandate to November 10, 2028.

The practical conclusion is straightforward:

The pause is not a pass. It is a buying window for readiness.

Federal contractors should use this period to audit their environment, validate their representations, close control gaps, and establish continuous evidence practices. The organizations that wait for the final report before acting may discover that the report changes less than they assume: and that enforcement has continued while the policy debate unfolded.

Breaking News: What the Codified Pause Actually Changes

The DoD’s September 3 class deviation memo, as reported by MeriTalk, does not erase cybersecurity requirements. It changes the timing and mechanism of third-party verification.

Contracting officers must remove requirements for third-party assessments from active solicitations and existing contracts. In practical terms, the CMMC Phase 2 requirement for a C3PAO assessment is no longer being applied in the manner originally scheduled for the 2026 rollout.

The deviation also defers the universal CMMC mandate until November 10, 2028.

That is a meaningful change for contractors preparing for Level 2 certification. It may delay the cost and scheduling pressure associated with an external assessment. It may also give the government time to redesign the program around continuous verification, operational technology, and more practical treatment of small and midsized businesses.

But the pause does not mean that contractors can stop managing cybersecurity.

The following obligations remain central:

• DFARS 252.204-7012 continues to require adequate security for covered contractor information systems, including the implementation of applicable NIST SP 800-171 safeguards.
• NIST SP 800-171 Rev. 2 requirements remain relevant where incorporated into contracts or otherwise applicable.
• Self-assessments remain required for applicable Level 1 and Level 2 environments.
• SPRS scores must remain current, accurate, and supportable.
• Annual affirmations remain part of the current compliance process.
• Covered cyber incidents must still be reported to the DoD within 72 hours under DFARS 252.204-7012.
• There is no blanket waiver of existing contractual cybersecurity duties.

The difference is between certification and compliance. A paused third-party assessment does not convert an unimplemented control into an implemented one. Nor does a plan of action and milestones automatically satisfy a requirement simply because it identifies the gap.

A contractor’s system security plan, SPRS score, policies, technical safeguards, incident-reporting procedures, and actual operating practices still need to tell the same story.

The Review Report Is Not Public: But the Signals Are Clear

The task force reviewed more than 1,100 RFI responses totaling more than 10,000 pages. It also received input from more than 3,000 participants through listening sessions and met with small businesses, third-party assessors, industry groups, and other stakeholders.

At the Billington CyberSecurity Summit on September 9, Davies said more than half of respondents favored pausing CMMC and pursuing reform.

We should not confuse those signals with the contents of the final report. The report has not been released. However, Davies identified several themes that are likely to influence what comes next.

1. Point-in-time assessments are not enough

Davies summarized one central finding this way:

“Compliance equals compliance. Compliance doesn’t equal security. Compliance equals a point-in-time check of where are you right now.”

That statement is not an argument against compliance. It is an argument against treating a single assessment event as a complete representation of security.

A point-in-time assessment can answer an important question: Was the organization able to demonstrate implementation on the assessment date?

It cannot, by itself, answer other equally important questions:

• Did the control remain effective three months later?
• Did a system change create a new vulnerability?
• Did a terminated employee retain access?
• Did a subcontractor change how CUI was handled?
• Did a manufacturing workstation or building management system become connected to a previously isolated network?
• Can the contractor produce evidence showing when a control changed and who approved the change?

Modern cybersecurity is dynamic. The threat environment changes. Systems change. Personnel change. Vendors change. A compliance program that depends primarily on periodic inspection will always contain blind spots between inspections.

That is why automated compliance monitoring is becoming more important. The future model will likely combine formal assessments with recurring evidence collection, control testing, change detection, risk-based reviews, and human oversight.

2. CMMC did not sufficiently address manufacturing OT

Davies also identified a gap involving operational technology and manufacturing-line resilience.

CMMC focused heavily on information systems and the protection of data. That focus is necessary, but it does not fully address the security of the systems that produce defense articles and operate critical facilities.

A manufacturing environment may include:

• Programmable logic controllers
• Industrial control systems
• Building automation systems
• Robotics and machine tooling
• Engineering workstations
• Safety systems
• Physical access systems
• Remote maintenance connections
• Legacy devices that cannot be patched like ordinary IT assets

A production line can be secure from a file-sharing perspective while remaining vulnerable to disruption through an unmanaged engineering workstation or a remote vendor connection.

This is where facility related control systems cybersecurity must become part of the conversation. Federal contractors, construction firms, and facility operators need a compliance approach that recognizes the relationship between cyber controls, physical operations, safety, availability, and mission continuity.

For organizations operating complex facilities, a network diagram alone is not enough. You need to understand how systems support the facility, where sensitive information moves, which assets cannot tolerate downtime, and how a cyber incident would affect operations.

3. CUI marking remains an operational problem

DefenseScoop also reported that inconsistent government marking of Controlled Unclassified Information has created significant friction across the defense supply chain.

This is not a minor documentation issue. CUI marking determines scope.

If a contractor cannot consistently determine which files, drawings, specifications, emails, work orders, or engineering records contain CUI, it may not be able to determine which systems, users, applications, and subcontractors must be protected.

The result is often one of two failures:

1. The organization over-scopes its environment, increasing cost and operational burden.
2. The organization under-scopes its environment, leaving sensitive information outside the controls it actually needs.

Clear government-side marking and disciplined internal data governance are both necessary. Contractors should maintain a defensible data-flow analysis and document how CUI enters, moves through, and leaves the environment.

The NIST SP 800-171 Rev. 2 and Rev. 3 Transition Risk

Another issue deserves close attention: the transition from NIST SP 800-171 Revision 2 to Revision 3.

Revision 3 changes the structure and emphasis of the publication. It introduces updated control organization, stronger emphasis on organizational governance, supply chain risk, planning, assessment, and system integrity, and a more modern treatment of cybersecurity outcomes.

That does not mean every contractor can immediately replace Rev. 2 obligations with Rev. 3 practices. Contract language controls. If your contract requires NIST SP 800-171 Rev. 2, you need to understand and satisfy that obligation unless the government changes it.

At the same time, planning only for the current version may create avoidable transition risk.

A better approach is to map controls across applicable frameworks:

• CMMC 2.0 readiness requirements
• NIST SP 800-171 Rev. 2
• NIST SP 800-171 Rev. 3
• NIST SP 800-53 controls where relevant
• DFARS requirements
• SOC 2 or other commercial obligations
• Facility and operational technology safeguards

This is the logic behind “map once and satisfy many.” A mature compliance automation platform should help you identify relationships between controls without pretending that every framework is identical.

The objective is not to create one enormous checklist. The objective is to understand which technical, administrative, and physical practices support multiple obligations: and where a framework-specific requirement still demands separate treatment.

Honeywell Shows Why the Pause Does Not Stop Enforcement

On September 1, 2026, Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations involving failures to comply with NIST SP 800-171 on one network from April 2020 through December 2023.

The allegations arose from a 2022 qui tam complaint by a former employee. The settlement does not constitute a determination of liability, but the case illustrates the legal exposure created when cybersecurity representations do not match operational reality.

The Nixon Peabody analysis explains the core issue: DFARS cybersecurity obligations exist independently of the CMMC Phase 2 certification schedule.

The enforcement math is serious:

• False Claims Act damages can reach three times the government’s losses.
• Civil penalties may apply to individual false claims.
• Qui tam whistleblowers can bring actions on behalf of the government.
• Employees often have visibility into whether policies are followed in practice.
• A deficiency on one network can create significant exposure if that network handles covered information.
• A POA&M identifies a remediation plan; it does not necessarily prove that the control is already satisfied.

This is the difference between a compliance tool and a compliance process.

A tool may tell you that a control is missing. The process determines whether leadership understands the gap, whether the gap is accurately represented to the government, whether remediation is funded, whether risk is accepted by an authorized party, and whether evidence supports every claim being made.

The most dangerous posture is not always a low score. It is an unsupported score or an inaccurate affirmation.

What Contractors Should Do During the Pause

The pause creates time. Use it deliberately.

Step 1: Audit before buying a solution

Do not begin with a software demo. Begin with an audit.

Document:

• Which contracts and clauses apply
• Where CUI and FCI are handled
• Which systems are in scope
• How CUI flows between internal teams and subcontractors
• Current NIST SP 800-171 implementation status
• Current SPRS score and supporting evidence
• Open POA&M items
• Incident-reporting readiness
• Facility and OT dependencies
• Cloud and managed service provider responsibilities
• Gaps between policy and actual practice

The audit should identify not only missing controls, but also controls that are inconsistently performed or poorly evidenced.

Step 2: Build a risk-ranked plan

A compliance plan should assign owners, dates, dependencies, and decision authority.

Prioritize weaknesses that affect:

• Privileged access
• Multifactor authentication
• Asset and configuration management
• Vulnerability management
• Logging and monitoring
• Incident response
• CUI boundary definition
• Remote access
• Third-party connections
• OT and facility-related systems
• Evidence needed to support SPRS scoring

Treat the plan as an operating document. Review it with executives, security personnel, IT, facilities, legal, contracts, and program leadership.

Step 3: Establish continuous evidence collection

Evidence should be generated as work occurs, not reconstructed shortly before an assessment.

That may include:

• Configuration snapshots
• Access reviews
• Vulnerability scans
• Incident-response exercises
• Training records
• Change tickets
• Policy acknowledgments
• Backup tests
• Vendor reviews
• Log-retention evidence
• Control-owner attestations
• Remediation milestones

The goal is not to create paperwork for its own sake. The goal is to create a reliable record of how security operates over time.

Step 4: Select tools after defining the process

Automation can reduce manual effort, improve consistency, and reveal changes faster. It can map controls, collect evidence, monitor implementation, and provide leadership with a current view of risk.

But automation does not decide whether your scope is correct. It does not interpret every contract. It does not replace system owners, facility engineers, legal review, executive accountability, or independent judgment.

Tools support the compliance process. They are not the process.

Where Continuous Compliance Platforms Fit

H&V Complynt Cybersecurity Solutions takes a hybrid approach: automation supported by expert guidance.

The Complynt platform is designed to support automated control mapping, evidence collection, continuous monitoring, pre-built content packs, policy-as-code, and real-time compliance visibility. For organizations operating in federal contracting and complex facility environments, the value is not simply having another dashboard.

The value is connecting evidence to obligations and obligations to operational reality.

That includes supporting environments that require:

• CMMC 2.0 readiness
• Cybersecurity for federal contractors
• NIST 800-53 compliance automation
• DoD IL5 compliance platform capabilities
• FedRAMP compliance automation
• Facility related control systems cybersecurity
• Multi-framework mapping across CMMC, NIST, SOC 2, RMF, and other standards

Complynt is built on infrastructure authorized for high-security use cases, including FedRAMP High and DoD IL5 environments, while H&V’s subject-matter expertise addresses the complex relationship between facilities, control systems, federal requirements, and operational risk.

That does not eliminate the need for an internal audit and plan. It reinforces it. The right platform should be selected based on a defined scope, documented requirements, and an understanding of the organization’s actual operating environment.

The Pause Is a Readiness Window, Not a Safe Harbor

The CMMC review report may recommend significant changes. It may reduce assessment burden, introduce more continuous verification, address manufacturing OT, clarify CUI marking, or modify how different contractor populations demonstrate compliance.

We do not know the report’s final contents yet.

We do know three things:

1. The Phase 2 pause is now codified.
2. Baseline cybersecurity obligations remain.
3. Federal cyber enforcement is active.

The strategic question is not, “Can we delay our CMMC work?”

It is, “What would we need to know about our environment if the government asked us to prove our security posture tomorrow?”

Contractors that can answer that question with current evidence, accurate scores, documented ownership, and a tested remediation plan will be better positioned under almost any reform model.

The future of CMMC readiness will not be defined by a certificate hanging on the wall. It will be defined by whether an organization can demonstrate that its controls are operating continuously, across information systems, facilities, suppliers, and operational technology.

That is the direction of travel. The pause gives you time to prepare for it.

H&V offers a free compliance readiness check and a CMMC Level 2 compliance service for organizations that need structured support. You can also learn more about Complynt cyber compliance as a service or our specialized RMF Division 25 and FRCS hardening services.

This article is provided for general informational purposes and is not legal advice. Contractors should evaluate their obligations against applicable contracts, clauses, agency guidance, and professional counsel.