Published 2026 | TIKC NewsWire
When the Department of War suspended CMMC Phase 2 on July 13, 2026, a lot of small defense contractors heard “CMMC is over.” It isn’t. What’s paused is the third-party (C3PAO) certification tier; the underlying security obligations are fully intact — and there’s a short window to influence what comes next.
The Window: Comments Due August 14
A new CMMC Reform Task Force is conducting a top-to-bottom review and must report to the DoW CIO within 60 days — putting its recommendations in the mid-September 2026 timeframe. The Department opened a public Request for Information, with responses due 12:00 p.m. ET on August 14, 2026. DoD’s own CIO cited SBA data suggesting future CMMC phases could cost small and midsize firms more than $7 billion annually, against an assessor shortage — roughly 100 authorized C3PAOs for 100,000-plus companies. If the burden has hit you, this is the moment to say so.
What Has NOT Changed — Keep Doing It
- Phase 1 self-assessments remain in force — Level 1 or Level 2 (Self), scored against NIST SP 800-171.
- Your SPRS score and annual affirmation are still required, and DFARS 252.204-7012 safeguarding obligations continue without interruption.
- False Claims Act exposure is arguably higher now, not lower — with no external assessor, your self-attestation carries the legal weight, and DOJ’s Civil Cyber-Fraud Initiative is still active.
What to Do Now
Keep your Phase 1 self-assessment current and your SPRS submission accurate and defensible. Ask your primes whether they’re amending Phase 2 flow-downs. Keep your scoping, system security plan, and evidence work moving — none of it becomes wasted effort. A pause is not a pass. Brick by brick.
FAQ
Is CMMC being cancelled?
Not as of now. Only Phase 2 (and later phases) are suspended pending review; officials haven’t ruled out changes, but the program rule and DFARS obligations remain on the books.
Should I stop my compliance spending?
No. Self-assessment, SPRS scoring, and DFARS 7012 safeguarding are all still live — and your existing contract clauses still bind you until formally modified.
Sources
Holland & Knight. (2026, July). DoW suspends CMMC Phase II requirements.
A-LIGN. (2026). What the CMMC Phase II suspension means for defense contractors.
About the Author
Melanie Patterson
Founder & CEO of Team Integrity Knowledge Center and creator of GovCon iSource. Former nurse turned entrepreneur with over 10 years guiding small, women-owned, and minority-owned businesses to over $10 million in government awards. Build, grow, scale — brick by brick. Contact
