CMMC Phase II Suspension Q&A Reference Guide

CMMC PHASE II SUSPENSION Q&A Reference Guide Source events: DoW announcement, July 13–14, 2026

Opening Questions Q1. What exactly did the DoD suspend, and what did they not suspend?

DoW suspended the transition to CMMC Phase II (third-party C3PAO assessment requirements), which was set for Nov. 10, 2026 — plus Phase 3 and Phase 4 milestones. They did not suspend Phase I self-assessment requirements, DFARS 252.204-7012 safeguarding obligations, or the underlying NIST SP 800-171 control requirements. Contracts already containing Level 2 C3PAO or Level 3 clauses must be amended to remove them.

Q2. What's the biggest misconception you've seen since the announcement?

The “CMMC is dead” narrative. Equally wrong is the opposite extreme — “nothing changed.” Neither is accurate: implementation timing changed, the underlying cybersecurity expectations and legal exposure did not.

Q3. Why do you think the DoD made this decision now?

DoW cited SBA data suggesting future phases could cost the DIB $7B+ annually, with per-company compliance approaching $600K — against only ~100 approved C3PAOs to assess 100,000+ companies. That's paired with Secretary Hegseth's Acquisition Transformation System push to reduce barriers for small/mid-size businesses and speed capability delivery to warfighters.

Q4. Should defense contractors view this as a delay, a reset, or something else?

Most accurately a pause-and-redesign. It's not a simple delay (the framework itself is under review, not just the date), and it's not a full reset (Phase I and DFARS obligations continue uninterrupted).

1

What It Means for Contractors Q5. If I'm a defense contractor, should I stop my CMMC efforts? Why or why not?

No. Stop spending specifically on C3PAO assessment scheduling if that was your near-term plan. Keep implementing NIST 800-171 controls — that work carries forward under any outcome and is still legally required today.

Q6. Does this affect current DoD contracts today?

Yes, in one specific way: contracts already carrying Level 2 C3PAO or Level 3 clauses must be amended to remove them. It does not touch DFARS 7012 or Phase I self-assessment clauses.

Q7. What requirements still exist even though CMMC Phase 2 has been suspended?

Phase I self-assessment (Level 1 for FCI, Level 2 self-assessment for CUI), SPRS scoring, DFARS 252.204-7012 safeguarding, and by extension full NIST SP 800-171 Rev. 2 implementation.

Q8. What should subcontractors be thinking about right now?

Flow-down clauses from primes may still demand cybersecurity evidence contractually, independent of the federal CMMC mandate. Keep your SSP/POA&M current — primes are increasingly doing their own vendor vetting regardless of what DoW requires.

2

What It Means for Contractors Cont.

Q9. How does this impact prime contractors versus subcontractors?

Primes retain discretion to require security evidence in subcontracts even without a CMMC mandate — supply-chain risk doesn't disappear because a federal certification requirement paused. Subs should expect continued (possibly increased) prime-level scrutiny to fill the gap.

Q10. Will prime contractors continue asking suppliers to demonstrate cybersecurity maturity?

Likely yes. Analysts note the underlying supply-chain risk drivers haven't changed, and primes carry their own contractual and reputational exposure — they have incentive to keep vetting suppliers even absent a federal mandate.

3

Compliance & Cybersecurity Q11. Is NIST SP 800-171 still the foundation contractors should be following?

Yes — explicitly confirmed by DoW and by industry counsel. It remains the security standard for protecting CUI regardless of CMMC's certification mechanism.

Q12. Does the suspension change DFARS cybersecurity requirements?

No. DFARS 252.204-7012 (and related clauses like 7019/7020/7021) are unaffected.

Q13. What happens if a contractor experiences a cyber incident during this suspension?

DFARS 7012 incident reporting obligations (including the 72-hour DIBNet reporting requirement) are untouched by this suspension — they apply regardless of where CMMC assessment stands.

Q14. Could organizations still face False Claims Act exposure if they misrepresent their cybersecurity posture?

Yes — arguably more so. DOJ's Civil Cyber-Fraud Initiative continues actively pursuing misrepresented cybersecurity postures (a settlement occurred as recently as June 2026), and with third-party verification paused, self-assessment accuracy is now the primary line of defense against FCA risk.

Q15. Should companies continue documenting compliance and maintaining their SSP and POA&M? Yes, unambiguously. These are your evidence of good-faith compliance and accurate self-assessment — arguably more important now that they're the primary compliance mechanism instead of a supplementary artifact ahead of a C3PAO audit.

4

Business Impact Q16. What mistakes are companies making after hearing the news?

Treating the pause as blanket permission to halt cybersecurity spend; letting POA&Ms go stale; assuming primes will drop their own requirements; and overindexing on the 2021-repeat skeptical narrative to justify doing nothing.

Q17. Could pausing cybersecurity investments hurt a company's ability to win future contracts?

Yes. Cyber readiness is a competitive differentiator with primes and in RFPs regardless of federal certification status, and if/when CMMC returns, companies that paused will face compressed catch-up timelines against competitors who kept building.

Q18. What are you telling your own clients to do today?

Continue NIST 800-171 implementation and DFARS obligations as planned; pull back specifically on discretionary C3PAO assessment scheduling/spend; keep SSP/POA&M current; watch the RFI (due Aug. 14) and Task Force outcome; and get any contract-specific case-by-case C3PAO language reviewed rather than assuming blanket relief.

Q19. How should business owners explain this announcement to their leadership team or board?

Frame it as a regulatory implementation pause, not a reduction in legal or contractual risk. The controls, DFARS obligations, and DOJ enforcement exposure are unchanged — this is a governance continuity story, not a “stand down” story.

Q20. What does this mean for cyber insurance and third-party risk?

Little to nothing directly — insurers and enterprise customers run their own third-party risk assessments independent of federal CMMC status, and those requirements aren't tied to the DoW timeline.

5

Looking Ahead Q21. What do you think happens next from the DoD? The Reform Task Force delivers findings to the DoW CIO within 60 days of the memo (roughly mid-September 2026). Expect either a redesigned framework, revised phase-in dates, or a leaner model incorporating commercial tools/MSPdelivered controls — the RFI questions strongly hint at that direction.

Q22. Do you expect CMMC to return in a different form?

My honest read: some form of third-party or recognized-provider verification likely returns, but probably reshaped to lower cost and complexity for small/mid businesses — closer to leveraging existing commercial security tools/MSP relationships than the current C3PAO model. That's an informed guess, not a certainty; skeptics point to the 2021 pause producing essentially the same requirements under a new name.

Q23. What timeline should contractors realistically expect?

Task force report due ~September 2026, but the 2021 precedent suggests the path from “review complete” to “new rule in force” can take considerably longer than 60 days. Plan for months, not weeks, after the report lands.

Q24. If you had to make one prediction about the future of CMMC, what would it be?

CUI protection requirements aren't going away — the mechanism verifying them is what's up for redesign. Expect a scaled framework that keeps the core NIST 800-171 backbone but changes how compliance gets verified (more reliance on self-attestation with audit-backed integrity checks, versus universal third-party assessment).

6

Practical Advice Q25. If you had a $25,000 cybersecurity budget today, where would you invest it?

Gap assessment against NIST SP 800-171; MFA and centralized logging/monitoring (often MSP-delivered, high ROI); a formal incident response plan and tabletop test; SSP and POA&M documentation brought current; basic security awareness training for staff.

Q26. What are the first three things every contractor should do over the next 90 days?

1) Don't pause NIST 800-171 implementation work already underway. 2) Bring SSP and POA&M fully current and accurate. 3) Check active contracts for embedded case-by-case C3PAO language and submit RFI feedback if you have relevant cost data (due Aug. 14).

Q27. What documentation should every contractor have ready regardless of what happens with CMMC? SSP, POA&M, current SPRS score, a data flow/asset inventory showing where CUI/FCI lives, and a documented incident response plan.

Q28. How can small businesses prepare without overspending?

Prioritize the highest-coverage controls (MFA, access control, encryption, logging) over exotic tooling; use MSP-delivered shared services instead of building inhouse; focus spend on self-assessment accuracy rather than C3PAO-readiness activities that may change shape anyway.

7

Practical Advice Cont.

Q29. What tools or controls provide the biggest return on investment?

MFA, centralized logging/SIEM (often via MSP), endpoint detection and response, encrypted backups, and least-privilege access control — these map to a large share of NIST 800-171 controls and hold value under any future framework.

Q30. If a contractor did nothing for six months because of this announcement, what risks would they face?

Stale/inaccurate SPRS scores, real threat exposure that doesn't pause with the regulation, loss of competitive standing with primes who keep vetting suppliers anyway, and a compressed, costly catch-up if a revised framework arrives with a short compliance window.

8

Audience Q&A "We're a 15-person machine shop. Should we still be preparing for CMMC?" Yes — keep implementing NIST 800-171; the mandate mechanism is paused, the underlying requirement to protect CUI/FCI is not.

"Our prime contractor hasn't said anything. Should we ask them?"

Yes, proactively confirm whether their flow-down clauses have changed; don't assume silence means no requirement.

"We're already scheduled for an assessment. Should we continue?"

Confirm with your C3PAO/prime whether that specific milestone was covered by the suspension; if it was a discretionary Phase II prep step, you can likely delay it without risk.

"We've spent thousands preparing. Was that money wasted?"

No — NIST 800-171 control implementation carries forward regardless of the certification mechanism's fate.

"Should we continue implementing NIST SP 800-171 controls?"

Yes, unequivocally.

9

Audience Q&A Cont.

"How does this affect organizations handling Controlled Unclassified Information (CUI)?"

Their DFARS 7012 safeguarding obligations are unchanged; only the third-party verification step is paused.

"Can we still win DoD work if we're not CMMC ready?"

Current requirements are Phase I self-assessment level — being NIST 800-171 compliant and SPRS-current is what matters right now, not C3PAO certification.

"What should companies tell their customers who are asking questions?"

That your cybersecurity program continues uninterrupted under DFARS/NIST 800-171 obligations, and you're monitoring the Reform Task Force review for what comes next.

10