When the Department of War suspended CMMC Phase 2 on July 13, 2026, a lot of small defense contractors heard “CMMC is over.” It isn’t. What’s paused is the third-party (C3PAO) certification tier; the underlying security obligations are fully intact — and there’s a short window to influence what comes next (Holland & Knight, 2026; A-LIGN, 2026).
The window: comments due August 14
A new CMMC Reform Task Force is conducting a top-to-bottom review and must report to the DoW CIO within 60 days — putting its recommendations in the mid-September 2026 timeframe. Alongside the suspension, the Department opened a public Request for Information, with responses due 12:00 p.m. ET on August 14, 2026 (Holland & Knight, 2026). This is industry’s direct channel to weigh in on cost drivers, administrative burden, and which controls actually reduce risk. DoD’s own CIO cited SBA data suggesting future CMMC phases could cost small and midsize firms more than $7 billion annually, against an assessor shortage — roughly 100 authorized C3PAOs for 100,000-plus companies (Government Contracts Law, 2026). If the burden has hit you, this is the moment to say so.
What has NOT changed — keep doing it
- Phase 1 self-assessments remain in force — Level 1 or Level 2 (Self), scored against NIST SP 800-171 (A-LIGN, 2026).
- Your SPRS score and annual affirmation are still required, and DFARS 252.204-7012 safeguarding obligations continue without interruption (Holland & Knight, 2026).
- False Claims Act exposure is arguably higher now, not lower — with no external assessor, your self-attestation carries the legal weight, and DOJ’s Civil Cyber-Fraud Initiative is still active (Aprio, 2026).
What to do now
Keep your Phase 1 self-assessment current and your SPRS submission accurate and defensible. Ask your primes whether they’re amending Phase 2 flow-downs (many are holding steady, because their contract risk didn’t change on July 13). Keep your scoping, system security plan, and evidence work moving — none of it becomes wasted effort. And if the cost of CMMC has been squeezing you, submit an RFI response before August 14. A pause is not a pass. Brick by brick.
FAQ
Is CMMC being cancelled?
Not as of now. Only Phase 2 (and later phases) are suspended pending review; officials haven’t ruled out changes, but the program rule and DFARS obligations remain on the books (Government Contracts Law, 2026).
Should I stop my compliance spending?
No. Self-assessment, SPRS scoring, and DFARS 7012 safeguarding are all still live — and your existing contract clauses still bind you until formally modified (A-LIGN, 2026).
Sources
A-LIGN. (2026). What the CMMC Phase II suspension means for defense contractors.
Aprio. (2026). CMMC Phase 2 is on hold: What contractors should do now.
Government Contracts Law. (2026, July). DoD suspends CMMC Phase 2: What happened and what it means.
Holland & Knight. (2026, July). DoW suspends CMMC Phase II requirements.
Need a defensible SPRS score and a clean self-assessment file? That’s exactly the kind of readiness we help with. Explore GovCon iSource.
