CMMC Isn’t Paused, Phase 2 Is: What Should Defense Contractors Be Doing Now?

If you've spent any time around the Defense Industrial Base over the past few months, you've probably heard some version of the same statement: “CMMC has been paused.” There's just one problem with that statement—it isn't really what happened.

On July 13, 2026, the Department of Defense suspended Phase 2 of the CMMC Rollout, the phase that would have introduced third-party CMMC Level 2 certification requirements, while the program undergoes review. Meanwhile, Phase 1 remains in effect, including applicable Level 1 and Level 2 self-assessment requirements.

That distinction matters. When a business owner or IT leader hears the word pause, the natural reaction may be to wait. Why spend money? Why finish the policies? Why remediate the network? Why prepare for an assessment that may not be required on the timeline everyone expected?

For defense contractors, that would be exactly the wrong takeaway.

What the CMMC Phase 2 Suspension Actually Changed

Before getting into what defense contractors should do, it helps to be precise about what the DoD’s implementing guidance actually says:

• Third-party assessments can’t be required during the suspension. Program managers may only include CMMC Level 1 (Self) or CMMC Level 2 (Self) in requirement documents.
• The underlying cybersecurity requirements remain. DFARS 252.204-7012 remains in effect, and the DoD will continue enforcing NIST SP 800-171 Rev. 2 through CMMC self-assessments and select government-led assessments.
• Certification is still available. According to The Cyber AB, C3PAOs can continue to conduct CMMC Level 2 certification assessments during the suspension.

The DoD has said further guidance will follow the conclusion of its review. Until then, that’s the full picture, and it’s the one worth planning around.

The Assessment Requirement Paused. The Responsibility Didn't.

Long before CMMC became part of the daily vocabulary of defense contractors, organizations handling Controlled Unclassified Information (CUI) were already responsible for protecting it. CMMC didn't create that responsibility. The cybersecurity requirements contained in DFARS 252.204-7012 and NIST SP 800-171 existed before CMMC's certification process arrived.

CMMC added a more formal mechanism for assessing and verifying whether those requirements were actually being implemented. That's why the current situation is better understood as a suspension of a particular third-party assessment requirement, not a pause in CMMC or in cybersecurity compliance. A third-party assessor may not be standing at the door right now, but the requirements behind the assessment haven't disappeared—and neither have the risks.

This distinction is more than semantics. If organizations interpret the current situation as “CMMC is paused,” there's a very real possibility that cybersecurity projects get delayed, budgets get redirected and noncompliance efforts stop. If they instead understand that the underlying responsibilities remain, the conversation changes from “When do we have to do this?” to “What work do we still need to get done?”

There Is a Bigger Question Than “What Happens to CMMC?”

Since the announcement, much of the industry conversation has understandably focused on what happens next. Will the third-party requirements resume? Will the DoD change the certification? Will certification become less expensive? When will a new timeline be announced?

Those are reasonable questions, but they are also questions individual defense contractors can't answer. Until the DoD completes its review and provides additional direction, much of that conversation is speculation.

A more useful question for contractors is much simpler: What does our organization still need to get done?

That question doesn't require a task force report or another government memo to answer. If your System Security Plan (SSP) doesn't accurately represent your environment today, it needs attention. If your organization has open cybersecurity gaps, they still need to be addressed. If policies were created simply to satisfy a requirement but don't reflect how employees actually operate, they need work. If technical controls exist on paper but aren't fully implemented, the problem remains. And if you can't clearly explain where CUI enters your organization, where it resides, who can access it and how it leaves, you may be at risk today.

None of those issues depend on the date of your C3PAO assessment. And if you’re asked for a current SPRS score tomorrow, every one of them matters today.

Maybe What Contractors Have Been Given Is Time

There is another way to look at the current situation. For organizations that were racing toward a third-party assessment, the suspension may have created something they desperately needed: time.

Over the past several years, many defense contractors have been trying to simultaneously understand CMMC, interpret NIST SP 800-171, implement technology, write policies, identify CUI, build System Security Plans, remediate gaps and continue running their businesses. That's a significant undertaking, particularly for smaller manufacturers and subcontractors without mature cybersecurity teams.

The additional time can be valuable, but only if organizations use it. Finish the SSP that's been sitting in draft. Close the known gaps, and track them in a Plan of Action and Milestones (POA&M). Validate that policies actually match operations. Make sure employees understand their responsibilities. Look at the CUI boundary again. Review the evidence supporting your controls. Verify that your self-assessment reflects the environment that exists today rather than the environment you intended to build two years ago.

Those aren't wasted efforts if CMMC changes. They're the building blocks of a stronger cybersecurity program, and most of them are things organizations handling sensitive defense information should be doing regardless of when a third-party assessment becomes mandatory.

Compliance Is More Than Buying the Right Technology

One lesson we've seen repeatedly while working with defense contractors is how easily compliance can become a technology conversation. Organizations focus on buying the right firewall, deploying MFA, adding endpoint protection, implementing a SIEM or moving CUI into an enclave. Those technologies can absolutely be part of the solution, but CMMC and NIST SP 800-171 aren't shopping lists.

A company can implement excellent cybersecurity technology and still have significant gaps. People matter. Processes matter. Policies and documentation matter. Scope and evidence matter. More importantly, all of those pieces have to tell the same story.

A delayed third-party assessment doesn't make that alignment any less important. In fact, the additional time may give organizations an opportunity to make sure the cybersecurity program they've built actually works rather than simply racing to make it assessment-ready.

Don't Forget About the Customer

There is another practical consideration that can get lost when everyone focuses exclusively on government timelines: your customer.

Prime contractors have their own supply-chain risks to manage. What the government currently requires and what a prime wants to see from a subcontractor aren't necessarily the same question. Some primes may continue asking about SPRS scores, CMMC readiness or certification status when evaluating their supply chains. For more on how requirements move through the supply chain, see CMMC compliance requirements explained for subcontractors.

That makes this a good time for a conversation. Ask your primes what they expect from their subcontractors and suppliers. Understand what they're looking for over the next year and whether certification status will influence sourcing or subcontracting decisions.

The answers may help determine whether and when pursuing a voluntary third-party assessment makes business sense for your organization. We believe that's how the certification question should be approached right now—as a business decision based on your customers, opportunities, readiness and risk, rather than simply as a reaction to the latest headline.

We're Not Going to Predict What Happens Next

There are plenty of opinions about what the DoD may do next. At SSE, we're not interested in adding another prediction to the pile. The rollout could return largely as designed, it could change, the timeline could move, and/or the assessment model could evolve. Until the DoD tells the industry what comes next, no one can say with certainty what the final outcome will be.

What contractors can control during this time is what happens inside their own organizations. They can understand their environment and their CUI. They can identify and remediate gaps. They can keep their SSP and policies current. They can validate that controls are operating and maintain the evidence to prove it. They can make sure their assessments accurately represent their cybersecurity posture, and they can talk with the customers who ultimately buy from them.

That work doesn't depend on predicting what Washington does next.

CMMC Phase 2 Suspension FAQs

Is CMMC Paused?

No. The DoD suspended Phase 2 of the CMMC rollout. Phase 1 remains in effect, and CMMC is still codified in 32 CFR Part 170.

Are CMMC Self-Assessments Still Required?

Yes. CMMC Level 1 (Self) and Level 2 (Self) requirements still apply wherever a solicitation or contract includes them.

Do I Still Need to Comply With DFARS 7012 and NIST SP 800-171?

Yes. DFARS 252.204-7012 remains in effect, and the DoD continues to enforce NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments.

Can My Company Still Get a CMMC Level 2 Certification?

Yes. C3PAOs can still conduct CMMC Level 2 certification assessments.

How Long Will the CMMC Phase 2 Suspension Last?

The DoD hasn’t said. It has stated that further guidance will follow the conclusion of its review, originally announced as 60 days.

You May Have Time, But Don’t Take Your Time

The CMMC rollout may have created a deadline that forced many organizations to finally address cybersecurity work that had been sitting on the sidelines. The danger now is that suspending the immediate third-party assessment requirement also removes that sense of urgency.

It shouldn't.

Protecting sensitive defense information was important before CMMC, it remains important while third-party assessment requirements are suspended, and it will remain important regardless of what comes next. Rather than spending the next several months waiting for another announcement, defense contractors have an opportunity to use this time productively—to finish policies, update their SSP, validate their CUI boundary, implement missing controls, collect evidence and build cybersecurity into normal business operations.

Organizations that continued working through “the pause” will be further ahead. If the program changes, that work will still result in a stronger cybersecurity program and a better ability to protect the information entrusted to the organization.

Perhaps that's the simplest way to think about the current situation. CMMC isn't paused. Your cybersecurity program shouldn't be either.

If you’d like help with readiness, remediation, or a C3PAO assessment, contact the SSE team.