On July 13, 2026, the Department of War (DoW) announced the immediate suspension of CMMC Phase II. The requirement for third-party certification assessments, scheduled to begin appearing in contracts on November 10, 2026, is now on hold pending a 60-day review by a new CMMC Reform Task Force.
Contractors are still required to complete and upload their SPRS self-assessments to the DoD’s SPRS system. Failing to do so, or submitting inaccurate information, can still expose organizations to liability under the False Claims Act. In fact, the continued SPRS self-assessment requirement gives companies an opportunity to achieve and maintain CMMC readiness more cost-effectively by combining continuous compliance/readiness software with experienced cybersecurity professionals, often at a fraction of the cost of traditional approaches. The Department paused one verification mechanism. It did not pause the security standard, the self-assessment requirement, the annual affirmation your executive signs, or the enforcement behind all of it. Here is what the announcement says, what remains in force, and what your organization should do during the review period.
What the Department Announced
The official DoW release makes four things explicit:
DoW Chief Information Officer Kirsten A. Davies is establishing a CMMC Reform Task Force to conduct a top-to-bottom review of the program, informed by a public Request for Information (RFI). The task force will deliver its recommendations to the DoW CIO within 60 days, on or about September 13, 2026.
The Department has been direct about what this is and is not. Under Secretary of War for Acquisition and Sustainment, Michael Duffey, put it this way: “We’re not relaxing the standards by any means. We expect businesses to adhere to the standards that NIST has outlined. What we’re removing is the bureaucracy of the third-party assessment.” (Breaking Defense, July 13, 2026)
The stated goal is to reduce compliance costs and barriers for small and non-traditional businesses, not to lower the security bar. The standard stayed. The audit process is under review.
This is the part the headlines miss. Nearly every obligation a defense contractor carried on July 12 was still there on July 14:
One sentence captures it: The government removed the mandatory verifier, not the obligation.
The Signature Is Now the Center of Gravity
Under the current rules, your compliance officer enters SPRS on the strength of your own assessment, and a named senior executive at your company affirms it annually. That affirmation is a continuing legal representation to the federal government. It must stay accurate through cloud migrations, acquisitions, new managed service providers, and every other change to your environment.
Before the pause, a third-party assessor would eventually stand behind your Level 2 status.
The full evidence burden sits inside your walls: the scope, the score, the artifacts, and the judgment calls.
That raises a practical question for every contractor: what does your Affirming Official actually review before signing? A spreadsheet from IT and a verbal assurance, or evidence mapped to each of the 110 requirements? The answer matters, because enforcement did not pause either.
Enforcement Did Not Pause
The Department of Justice pursues false cybersecurity representations under the False Claims Act, which carries treble damages plus per-claim penalties. Under the statute, “knowingly” includes deliberate ignorance and reckless disregard. A good-faith error is not fraud. An unchallenged score, signed year after year without validation, is harder to defend as good faith.
The recent record shows how these cases arise:
These settlements resolve allegations without any adjudication of liability. The pattern across them is consistent, though: self-reported compliance, no independent challenge to the score, and a government assessment or an insider who saw the gap. The Company B case is the one to sit with. It involved a small business, a self-assessment, and a direct government audit. That is exactly the posture most of the Defense Industrial Base is in during this pause.
Your Primes Are Not Waiting for Washington
Prime contractors set their own subcontractor cybersecurity expectations, and nothing in the suspension stops a prime from requiring evidence, or a certification, before sharing sensitive data with you. Over the past year, primes have pushed their supply chains toward CMMC Level 2 readiness on their own timelines. Company G gave suppliers roughly 80 business days to produce Level 2 certifications.
There is a structural reason for this. Every prime’s own Affirming Official signs on top of a supply chain they cannot fully see into, and primes must verify subcontractor status and affirmations before award under DFARS 252.204-7021. Reduced federal pressure does not mean reduced commercial pressure. In many cases, it means more.
The Real Cost Was Never the Audit
Much of the public case for the pause rests on cited cost figures approaching $600,000 per certification. That number warrants scrutiny because it conflates two distinct costs into one. According to the Small Business Administration’s own estimates, a firm doing only a self-assessment, with no third-party audit at all, still spends about $388,600. That entire figure is the cost of implementing NIST 800-171: the people, the processes, the secured environment, the documentation. The third-party assessment itself typically runs $20,000 to $50,000 every three years outside of Level 3.
In other words, roughly two-thirds of the commonly cited cost is security implementation work that the suspension does not touch, because DFARS 252.204-7012 and NIST 800-171 still require it. Implementation is also a durable part of the investment. You keep the hardened environment, and it keeps protecting you. The audit was always the smaller, recurring verification cost on top.
For contractors weighing whether to slow down: pausing readiness work saves little, compresses the same work into a shorter runway later, and leaves your next affirmation resting on unvalidated assumptions in the meantime.
Your investment stands. Certifications remain valid, C3PAOs continue to issue them, and DoW leadership has publicly recognized organizations that achieved certification. You are also differentiated with primes today, and first in line if third-party requirements return in any form.
We recommend you continue. Completing the third-party assessment demonstrates certified alignment with NIST SP 800-171, will be accepted by DoW, and gives you a rigorous, unbiased view of your vulnerabilities. It reduces risk, demonstrates regulatory compliance, and builds trust with investors, boards, customers, and insurers. Where timing genuinely needs to change, confirm the decision against your actual contract language first, including what your prime requires. An alternative for some organizations is a standalone NIST SP 800-171 assessment, but verify it satisfies your specific contractual requirements before choosing that path.
Use the pause as runway, not as a reprieve. The same work is required under every plausible outcome of the review. Practical priorities for the next 60 days include:
The Reform Task Force is soliciting industry input through a public RFI, with responses due August 14, 2026. If compliance costs or assessor availability have affected your business, this is the direct channel to the people writing the next chapter. Bring real numbers. The task force report is expected on or about September 13, 2026, and we will publish analysis as guidance develops.
The headlines changed. Our mission did not. For more than 20 years, ControlCase has helped organizations navigate evolving cybersecurity, privacy, and compliance requirements through every version of these programs. As an Authorized C3PAO, RPO, and 3PAO accredited across more than 100 frameworks, and with the CyberNINES team alongside us, we continue to support clients with assessments, readiness engagements, consulting, and project work as scheduled, and we will adapt with you whatever direction the Department ultimately takes.
Our recommendation through the review period is simple. Continue protecting your information. Continue strengthening your cybersecurity. Continue preparing. Organizations who keep improving today will be better positioned under every outcome of the Department’s review.
Questions about your specific contracts, your SPRS score, or your assessment timeline?