For many defense contractors, November 10, 2026 had been circled on the calendar for well over a year. That was the date Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program had been scheduled to begin, bringing mandatory third-party assessments for most companies handling sensitive government information. Then, in July, the Department of War (formerly the Department of Defense) hit pause. If you breathed a sigh of relief, we understand. But the CMMC Phase 2 suspension is narrower than it sounds, and the work underneath it still matters.
What is CMMC, in plain language?
CMMC is the Department’s program for verifying that the companies it works with actually protect government information. It reaches across the entire defense supply chain, from prime contractors to the smaller shops that make parts, provide services, or support those primes.
Much of that information falls into a category called Controlled Unclassified Information (CUI). It isn’t classified, but it’s sensitive enough that the government requires it to be protected. Think technical drawings, specifications, and contract details. For most contractors that handle CUI, protecting it means implementing the 110 security requirements in NIST SP 800-171, a standard from the National Institute of Standards and Technology. Those requirements cover things like who can access your systems, how you respond to incidents, and how you protect data across your network.
How the CMMC rollout was supposed to work
CMMC was designed to roll out in phases. Phase 1 began in November 2025 and allows self-assessments, meaning the company reviews its own security against the requirements and reports the result. Contractors at this level also post their score in the Supplier Performance Risk System (SPRS), the government database where those results are recorded.
Phase 2 was the bigger step. It would have required most contractors handling CUI to be assessed by an accredited outside organization, known as a CMMC Third-Party Assessment Organization (C3PAO), before winning certain contracts. That’s the requirement that had so many businesses watching the calendar.
What changed with the CMMC Phase 2 suspension
On July 13, 2026, the Department’s Chief Information Officer issued a memo suspending Phase 2. While the suspension is in place, contracts can only call for self-assessments. Third-party assessments can’t be required as a condition of new work. For many contractors, that means the pressure to line up an outside assessment by a fixed date has eased, at least for now.
The Department also formed a CMMC Reform Task Force to review the program, with a focus on reducing the costs and barriers that have made compliance especially hard on small businesses. The task force wrapped up its 60-day review in September. As of early October, its recommendations had not been made public, so nobody outside the Department knows yet what the next version of CMMC will look like.
What didn’t change
Here’s the part we most want contractors to hear. The pause applies to the third-party assessment requirement. As this legal analysis from Latham & Watkins points out, it doesn’t remove the cybersecurity rules that were already part of your contracts.
The clause known as DFARS 252.204-7012, part of the Defense Federal Acquisition Regulation Supplement, still applies, and so do the NIST SP 800-171 requirements that come with it. Phase 1 self-assessment requirements remain in place too. If your contracts called for these protections before July, they still do.
Accuracy matters more than ever. When your company submits a self-assessment, it’s making a statement to the government about where your security stands. Overstating that score can carry serious legal and contract consequences, so the number you report needs to reflect what’s actually in place, not what’s planned.
And if you’re a subcontractor, expect the questions to keep coming. Prime contractors are still responsible for passing these requirements down to the companies they work with, and they’ll keep asking you for proof.
That can actually work in your favor. For a small subcontractor, being the supplier who can answer a prime’s security questions quickly and confidently is a real advantage. Primes want partners they don’t have to worry about, and an accurate self-assessment backed by solid documentation tells them you’re one of those partners.
Why waiting is the riskier choice
It’s tempting to treat a pause as permission to stop. We’d gently push back on that. The requirements underneath CMMC aren’t going away, and whatever the reformed program looks like, it will still be built on protecting CUI. The contractors who keep building now will be ready for whatever comes next. The ones who stop may find themselves starting over on someone else’s timeline.
There’s a simpler reason, too. These controls protect your business whether or not a contract requires them. Limiting who can reach your systems, requiring multi-factor authentication (our MFA guide for small business covers the basics), keeping good records, and having a plan for incidents are smart practices for any company that holds sensitive information.
We support clients who are working through the CMMC process, and our advice to them hasn’t changed with the suspension: keep going, one steady step at a time. Progress made now is progress you won’t have to rush later.
A checklist for contractors during the pause
- Know what your contracts require. Review current contracts and open solicitations to see which cybersecurity clauses apply to you. Requirements can differ from one contract to the next.
- Keep working toward full NIST SP 800-171 implementation. Pick up where you left off. Steady progress now is far easier than a scramble later.
- Make sure your score reflects reality. If your self-assessment was submitted a while ago, check it against what’s actually in place and correct anything that has drifted.
- Document everything and close open items. Keep records of your controls, assessment results, and remediation plans. If you have open items on your Plan of Action and Milestones (POA&M), the list of gaps you’ve committed to fixing, work on closing them out.
- Watch for the task force’s recommendations. Keep an eye out for the task force report and any new guidance from the Department, so you can adjust once the next version of CMMC takes shape.
Questions to ask your IT team
- Does our self-assessment score match what’s actually in place on our network?
- Where does our documentation live, and when was it last updated?
- Which POA&M items are still open, and what’s the plan to close them?
- If a prime contractor asked us for proof of compliance on short notice, could we provide it quickly?
The takeaway
The CMMC Phase 2 suspension gives contractors breathing room, not a finish line. The rules already in your contracts still apply, your self-assessment still needs to be accurate, and your primes still want proof. The good news is that none of this has to be overwhelming. Small, steady steps add up, and they leave you ready for whatever the Department decides next.
At the end of the day, this is your business and your call to make. We’d just love to see you keep moving.
As always, your Paradigm team is just a call, email, or text away for any questions or concerns that may arise.
If you’d like help reviewing your environment against NIST SP 800-171, strengthening the technical controls behind your self-assessment, or getting your documentation in order, we’re here to help. Give us a call at 321-248-3954 or email info@paradigmitgroup.net. No pressure, no sales pitch. Just an honest conversation about where you stand.
Your Paradigm Team
