Summary
Despite the CMMC Phase 2 pause, cybersecurity obligations, NIST 800‑171 compliance, and SPRS risk remain. Prime contractors still expect certified suppliers, and independent C3PAO assessments provide legal and competitive advantages. Since assessments continue and scheduling is easier now, organizations that maintain momentum will stay compliant and stand out in the defense supply chain.
On July 13, 2026, the Department of War (DoW) suspended the Cybersecurity Maturity Model Certification (CMMC) Phase 2 rollout. While it does delay the requirement to put CMMC Third-party Assessment Organization (C3PAO) certification into contracts, it does not require stopping the certification assessments themselves.
In fact, a timely C3PAOs-assesed CMMC Level 2 certification is still a phenomenal investment for several reasons.
- The CMMC Program is evolving, not ending.
- The Reform Task Force is working to refine CMMC, not end it.
- The underlying need to adhere to NIST 800-171 Revision (Rev) 2 and Mandatory Incident Reporting (MIR) requirements has not changed.
- Your business must do the more difficult, expensive work of implementation.
- Primes still expect certification.
- While government contracts currently do not require a C3PAO assessment, Boeing, L3Harris, Elbit Systems of America, Leonardo DRS, RTX and HII have told suppliers their cybersecurity obligations continue through the pause, and many encourage the C3PAO certification.
- Certification reduces legal risk.
- Supplier Performance Risk System (SPRS) affirmations still carry False Claims Act (FCA) exposure, and an independent assessment is a strong defense.
- The line is short right now.
- C3PAO bookings had to be made far in advance before the pause; scheduling is easier today than it will be if Phase 2 restarts. Many C3PAOs are still actively booking assessments with contractors who see CMMC Level 2 Certification as a differentiator.
The ecosystem has already seen CMMC get renamed, rescoped, rewritten, paused, and restarted. Every single time, the companies that kept doing the work came out ahead.
So, if you’re asking whether to put your C3PAO assessment on hold while the DoW plans its next move, my answer is the same one I’ve given for years: keep going.
What is the CMMC pause?
This summer, the DoW announced “the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements” and launched a CMMC Reform Task Force. The stated goal of the review is “aligning with Secretary of War Pete Hegseth’s Acquisition Transformation System (ATS) directives prioritizing speed to capability, lowering barriers for small, medium, and non-traditional businesses, and replacing bureaucratic compliance with scalable, resilient cybersecurity measures.” Those are fair goals, and the department went to industry for answers. Nearly a thousand responses came back.
Federal News Network’s (FNN’s) two-part investigation this week walked through what the task force heard. The headline for me: the top cost driver respondents named wasn’t the assessment. It was implementing and maintaining NIST SP 800-171, the controls that sit underneath CMMC. The department’s own summary put the average assessment cost around $47,000 and noted that prices have dropped as supply caught up with demand.
What are the CMMC Reform Task Force’s options?
According to FNN, the task force’s summary of Request for Information (RFI) responses suggested options include clarifying Controlled Unclassified Information (CUI) markings, moving to NIST SP 800-171 Rev 3, making assessments more consistent, extending Plan of Action and Milestones (POA&M) windows, and possibly restarting Phase 2 with a narrower group of contractors within 90 days. None of it has been adopted yet, and the DoW hasn’t commented publicly. But every one of those options refines how CUI gets protected. None of them stops protecting it or ends the CMMC program.
That tracks with what the DoW CIO leadership has said from day one. The July memo was explicit that the cybersecurity requirements in DFARS 7012 remain in effect. What got suspended was the Phase 2 requirement to put C3PAO certification into contracts. It did not suspend the assessments themselves, and it did not touch the obligation.
Sure, CMMC may change. It may adapt, just like it has since 2019. But it isn’t going anywhere.
Your Customer Wants CMMC regardless.
Even if the DoW never put another CMMC clause in a contract, your primes would still ask. Boeing, L3Harris, Elbit Systems of America and Leonardo DRS have all sent letters telling subcontractors that certification is expected. RTX won’t issue a purchase order without the required certification where DFARS 7021 applies. Lockheed Martin is collecting supplier status through Exostar. HII told suppliers that their obligations continue through the pause.
Primes carry the liability for their supply chains, and they’re choosing CMMC-certified subcontractors today, not waiting on regulations to manage the risk.
Then there’s the legal side. Every SPRS affirmation still carries FCA exposure. Attorney Eric Crusius put it well in the FNN series: a third-party certification is “not a perfect inoculation, but it would help.” The Cyber AB’s Matt Travis has made the same case, arguing that certification is the best defense a contractor can have against FCA claims.
CMMC Assessments are not on hold
To be clear, third-party assessments are not paused or suspended. The only thing suspended is the Phase 2 requirement for them in contracts. C3PAOs are conducting Level 2 assessments right now, and eMASS and SPRS are still processing certifications. You can schedule yours today, and you should consider it while your competitors are putting it off.
The hardest part of CMMC was never the assessment. It was getting ready.
Don’t pause the work
I understand the instinct to wait for certainty. But the requirements haven’t changed, your customers haven’t changed their minds, and the adversaries targeting the defense industrial base certainly haven’t paused. A C3PAO assessment remains one of the smartest investments a defense contractor can make. The companies that keep moving now will be the ones primes call first when the dust settles.
Reach out to a Summit 7 expert to future-proof your organization today.
