CMMC Reform Is Underway: What DoD’s Listening Sessions Mean for Small Defense Contractors Right Now

Published August 11, 2026 | TIKC NewsWire

The Pentagon suspended CMMC Phase 2 third-party certifications in June and stood up a reform review team. That team held its first listening session on July 16. The Pentagon wants to move quickly with its review of the Cybersecurity Maturity Model Certification program, but plenty of questions swirl around what defense officials can do differently this time to balance compliance concerns for small businesses with the need to enforce cybersecurity requirements. Here is the current state of play and what small businesses must understand right now.

Where the CMMC Reform Stands

The suspension covers Phase 2 third-party assessments — the requirement for CMMC Level 2 certification through accredited C3PAO assessors. The suspension does not eliminate CMMC or its underlying cybersecurity requirements. The reform team is examining the cost and burden of third-party assessments on small businesses, the adequacy of CMMC Level 1 self-assessment as a compliance pathway, and whether the C3PAO ecosystem has the capacity to certify the volume of contractors DoD needs without creating a bottleneck.

What Has Not Changed

The CMMC Phase 2 suspension does not suspend DFARS 252.204-7012. Every contractor subject to that clause is still required to implement NIST SP 800-171 controls and maintain an accurate SPRS score. What it suspends is the timeline for requiring third-party C3PAO assessments — contractors cannot yet be required to obtain a CMMC Level 2 certification as a contract condition while the review is underway.

What Small Defense Contractors Should Do Right Now

Do not stop your NIST 800-171 implementation. The underlying cybersecurity controls — NIST SP 800-171’s 110 practices — are not going away. Contractors who use the suspension as a reason to pause implementation are making a strategic error: the SPRS score reflecting your 800-171 implementation is a legal document, and inaccurate scores remain an enforcement liability regardless of CMMC’s status.

Update your SPRS score if it does not reflect your actual posture. The SPRS self-assessment score is a certification of your cybersecurity posture. If your controls have improved or deteriorated since your last assessment, update the score. A score that materially understates or overstates your actual implementation is a compliance and legal risk.

Watch for Phase 2 restart timing. The reform review is expected to produce recommendations within 60 days of its July 16 start — meaning results could arrive in mid-September. Monitor DoD CIO communications and Federal Register notices for any rule changes.

The Bottom Line

CMMC is being reformed, not eliminated. The core cybersecurity requirements are unchanged. Use this window to get your NIST 800-171 implementation solid, your SPRS score accurate, and your documentation in order. When Phase 2 restarts, contractors who used the pause wisely will be ahead of those who treated it as a reprieve. Brick by brick — cyber compliance is not optional, and the reform will not make it easier, only more structured.

Frequently Asked Questions

What did the CMMC Phase 2 suspension actually suspend?

The suspension paused the requirement for contractors to obtain CMMC Level 2 certification through accredited C3PAO third-party assessors as a contract condition. It did not suspend DFARS 252.204-7012, NIST SP 800-171 implementation requirements, or SPRS self-assessment obligations.

Do I still need to maintain my SPRS score during the suspension?

Yes. The SPRS score is a self-certification of your cybersecurity posture under DFARS 252.204-7012, which remains fully in force. An inaccurate SPRS score is a False Claims Act exposure regardless of CMMC’s Phase 2 status.

When will CMMC Phase 2 restart?

The reform review team began work July 16 and is expected to produce recommendations within approximately 60 days — suggesting mid-September 2026. The restart timeline and any modifications will be announced through DoD CIO communications and potentially a Federal Register rule change.

References

Federal News Network. (2026, July 30). DoD Plans CMMC Listening Sessions As Questions Swirl Around Review. https://federalnewsnetwork.com/defense-main/2026/07/dod-plans-cmmc-listening-sessions-as-questions-swirl-around-review/