Paused, not repealed: what CMMC’s suspension left defense contractors paying for
With third-party CMMC certification suspended and no new schedule six weeks before the old November date, contractors faced a budgeting problem. Some security spending was still owed, some could wait, and some had simply changed price.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
Phase 2 of the Cybersecurity Maturity Model Certification program was due to begin on November 10, 2026. From then, many solicitations involving controlled unclassified information were to require Level 2 certification by an accredited third-party assessor, a C3PAO. On July 13, the Defense Department, which now styles itself the Department of War, suspended Phase 2 and froze later phases. It told contracting offices to remove third-party and Level 3 requirements from active solicitations and contracts. It also set up a CMMC Reform Task Force and opened a request for information, which drew about 1,100 responses according to the department’s CIO. Level 1 and Level 2 self-assessments stayed in force, as did DFARS clause 252.204-7012. The task force’s report was due on September 11. By the last week of September it had not been published, and no replacement schedule had been announced.
Earlier in this series we argued that CMMC’s first phase, from November 2025, made the senior official’s affirmation the instrument that mattered most. The July suspension removed the third-party check that was supposed to test those affirmations from late 2026. It did not remove the requirements being affirmed. For a contractor’s finance and contracts teams, preparing fiscal 2027 budgets that autumn, the result was a sorting problem. Security spending fell into three groups: what the suspension left owed, what it deferred, and what it repriced. Contractors should confirm the requirements in each solicitation and contract with counsel, since the department said its review could change the program.
What the suspension left owed
The core obligations predate CMMC. Clause 252.204-7012 requires contractors handling covered defense information to implement the 110 requirements of NIST SP 800-171. They must report cyber incidents to the department within 72 hours, preserve images of affected systems and flow the clause down to subcontractors. Related clauses require a current self-assessment score in the Supplier Performance Risk System, known as SPRS, before award. Phase 1 added CMMC self-assessments and an annual affirmation by a senior official. All of this stayed in place.
The legal exposure stayed too. The Justice Department’s Civil Cyber-Fraud Initiative uses the False Claims Act against contractors that misrepresent their cybersecurity. In March 2025, according to the department, MORSECORP agreed to pay $4.6 million to resolve allegations that included posting an SPRS score that did not reflect its actual compliance. With no third-party assessment scheduled, the SPRS score and the affirmation are the main statements the government has to rely on. That raises, not lowers, the value of evidence behind them.
The budget lines that follow are concrete. They cover remediation of any requirements scored as unmet, an evidence file for each requirement, an internal or independent review before the annual affirmation and a tested incident reporting procedure. A useful measure is the number of open items on the plan of action and their target closure dates, reviewed by the official who signs the affirmation. None of this depends on when Phase 2 starts.
What the suspension deferred
The third-party assessment itself was the main cost the pause deferred. A contractor that had planned to book a C3PAO for the first half of 2027 no longer had a contractual reason to do so on that date. Certifications already issued remained valid, and the program rule allows a higher assessment to satisfy a lower requirement.
Contracts already awarded need separate handling. Under the July guidance, contracting officers were to remove third-party requirements from existing contracts at the next option exercise or administrative modification. Until then the original text remains in the contract. Contracts teams should list every affected award, ask each contracting officer in writing how the requirement will be treated in the meantime, and keep the answer with the contract file.
Deferral is a choice with trade-offs. Waiting saves cash and avoids buying an assessment that a reformed program might define differently. It also risks the queue. Assessor capacity was the bottleneck that much of the industry worried about before July, and capacity does not grow quickly. A sensible middle course is a readiness assessment by an independent firm, scored against the existing assessment guide. It produces evidence for the affirmation now and shortens any certification later. Contractors with formal certification already in hand can treat it as a differentiator with primes, even where solicitations no longer require it.
What the suspension repriced
Two investments changed value without becoming optional. The first is scope. Contractors that confined controlled unclassified information to an enclave did so partly to shrink a future assessment. The enclave still reduces the number of systems that must meet 800-171, and so the cost of the self-assessment and the risk behind the affirmation. Its payback period lengthened, but it still pays back. Cloud services used for that information must still meet the department’s FedRAMP Moderate equivalency expectations, so platform choices remain constrained.
The second is the supply chain. Under Phase 2, primes expected to require certification from subcontractors handling controlled unclassified information, and many smaller suppliers budgeted for it. With the requirement paused, the department’s clauses still flow 7012 obligations down, but certification is no longer mandated. Primes may still impose their own requirements by contract. Each prime now has to decide whether to hold suppliers to certification, accept self-assessments with evidence, or restructure work so fewer suppliers touch controlled information. Whichever it chooses, it should say so in writing. Suppliers are making budget decisions on the assumption either way.
Pricing follows from all three groups. Security costs that are still owed belong in indirect rates and bid pricing as they did before. Deferred certification costs should be held as a contingency, with a trigger tied to the department’s announcement of a new schedule. Firms that removed all CMMC costs from their 2027 budgets on the strength of a pause were betting on the review’s outcome.
With hindsight
As of mid-October 2026, the task force’s report has still not been published, and the department has not announced a new Phase 2 date or said whether the program will change shape. In September a revised DFARS class deviation, according to law firm and industry summaries, carried the pause into contract language. Phase 1 self-assessments, SPRS scores, annual affirmations and the 7012 clause remain in force. The department’s CIO has said she intends to publish the report but has given no date. Outcomes discussed in industry commentary range from a later Phase 2 with more assessor capacity to narrower certification for higher-risk information. None has been announced. The sorting set out here still applies whichever path the department takes. Contractors should follow official guidance and confirm requirements solicitation by solicitation with counsel.