Defense contractors heading into November 2026 will not face the third-party CMMC assessments they had planned around, and they have not been told when those assessments will return. The Department of War suspended CMMC Phase 2 on July 13, along with every other pending and future CMMC milestone. As of Federal News Network's Oct. 26 report, the most recent reporting available, there was no restart date and the CMMC Reform Task Force's recommendations were past due. The pause took away the Level 2 certification deadline. It did not remove the cybersecurity controls underneath it, and it did not remove the legal risk of misstating compliance.

Phase 2 was due to start Nov. 10, 2026. It would have written Level 2 assessments by certified third-party assessment organizations (C3PAOs) into contracts that involve controlled unclassified information (CUI). The suspension, set out in a memo from DoD Chief Information Officer Kirsten Davies and an implementing memo from Under Secretary Michael Duffey, also bars program offices from designating Level 3 assessments by the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), which were slated for Phase 3.

Why the Task Force Deadline Has Slipped Past 100 Days

The task force's 60-day review, counted from the July 13 suspension, ended in mid-September. DoD then planned 15 more days to deliver recommendations to Davies and Duffey. According to Federal News Network, "That 75-day timeline is now pushing over 100 days." The recommendations had not been made public at the time of that report, and DoD declined to comment on 15 questions the outlet sent.

Davies justified the pause in her July memo by citing the cost of the program: "The current iteration of the Cybersecurity Maturity Model Certification (CMMC) program, while intended to enhance security, imposes significant and often prohibitive burdens on the Defense Industrial Base (DIB), particularly the small and non-traditional businesses that are the engine of American innovation," she wrote, as quoted by Federal News Network.

Officials have hinted at where the program could go next. According to a Vigilant Cybersecurity briefing, Davies has pointed toward moving away from point-in-time assessments toward continuous evaluation and fixing inconsistent CUI marking. Cyber AB CEO Matthew Travis has said the department will need a transition plan that preserves the value of existing Level 2 certifications. One Federal News Network source expects DoD could push Level 2 certification out to around 2029.

What Can a Contract Require During the CMMC Pause?

Under the implementing memo, "[p]rogram Managers and requiring activities must only include the need for CMMC Level 1 (Self) or Level 2 (Self) assessments in procurement request and requirement documents," according to Latham & Watkins. Program offices also cannot designate DIBCAC assessments. Latham notes that because Level 2 (C3PAO) and Level 3 (DIBCAC) assessments can no longer be designated, the case-by-case waiver process that once excused them has stopped too.

Advertisement

Contracts already signed are handled one at a time. WilmerHale says the guidance tells officers that "For existing contracts and agreements already containing these requirements, contracting and agreements officers will remove them by modification before the next option period or in the next scheduled administrative modification." Until that modification is issued, the existing contract language presumably still applies. Vigilant Cybersecurity's briefing says DFARS Class Deviation 2026-O0025, Revision 3, signed Sept. 3, directs contracting officers accordingly.

Phase 1 has not changed. The Level 1 and Level 2 self-assessment requirements that took effect in November 2025 are still in force. So are DFARS 252.204-7012, NIST SP 800-171 Rev. 2, the posting of scores in the Supplier Performance Risk System (SPRS) and annual affirmations. WilmerHale reports that DoD will enforce 800-171 compliance "through self-assessments and select government-led assessments."

Do the Assessor Capacity and Cost Numbers Hold Up?

The Small Business Administration backed the pause with its own figures. "If implemented on its planned launch date, CMMC Phase II would have required more than 120,000 DIB small businesses to seek compliance through a cost-prohibitive system supported by only about 100 approved assessors," the SBA said in its July 13 release. The SBA estimated total compliance costs at about $593,800 per certification for small firms that need a third-party assessment and about $388,600 for firms eligible for self-assessment.

Responses to DoD's request for information (RFI) tell a different story. DoD reviewed 997 RFI responses, 509 of them (51%) from the defense industrial base. DoD's own summary cited an average assessment cost of $47,000 reported by a subset of respondents. As of September, Federal News Network learned, 2,433 companies had received Level 2 third-party certifications. Cyber AB CEO Matthew Travis put the number at nearly 2,000 in a Sept. 14 interview, so the two reported counts differ depending on the source and the date. On capacity, one source told Federal News Network that during Phase 1 the assessor ecosystem never used more than half of the assessment capacity available.

Much of the cost complaint comes from the controls themselves: system security plans, FIPS-validated encryption, licensing such as Microsoft GCC High, and inconsistent CUI marking. "The cost of program is blamed on certification instead of underlying certification controls, which are not part of the CMMC program," Eric Crusius, a partner at Hunton, told Federal News Network.

What It Means for Contractors

The pause changes when a third-party assessment can be required. It does not change what a contractor has to do. Latham points out that self-assessment scores, SPRS submissions and annual affirmations are statements to the government. They "remain an area of potential exposure for contractors," especially as the Justice Department keeps using the False Claims Act through its Civil Cyber-Fraud Initiative.

  • Keep closing NIST 800-171 Rev. 2 gaps. Those controls are still required under DFARS 252.204-7012.
  • Check that SPRS scores and affirmations are accurate and current. An inflated score is a False Claims Act risk with or without CMMC.
  • Read every contract modification. Look for removed C3PAO or Level 3 language and for any new clauses. Until a modification arrives, the old terms likely still apply.
  • Don't drop Level 2 certification work already under way. Primes may still ask for it, and the Cyber AB is pushing to keep existing certifications valuable.
  • Watch for the task force report, any new CIO memo and any change to 32 CFR Part 170 or the DFARS CMMC clauses.

Sources