Paused, not repealed: what CMMC’s suspension left defense contractors paying for

The week

Six weeks before the Pentagon was due to start demanding outside cybersecurity certification from its suppliers, nobody could say when, or even whether, that demand would arrive. For the finance director of a mid-sized defense supplier in late September 2026, with next year's budget due, that was a practical problem. Since last year, the budget had carried a line for exactly that certification.

The program in question is the Cybersecurity Maturity Model Certification, or CMMC. It exists to make sure that companies working for the Defense Department actually protect the sensitive government information they handle. That information is called controlled unclassified information: not secret, but not meant for public release either, such as technical drawings, specifications or logistics data. CMMC sets levels of required protection and, at the higher levels, asks for proof from someone other than the contractor itself.

Phase 2 of the program was due to begin on November 10, 2026. From then, many solicitations involving controlled unclassified information were to require Level 2 certification by an accredited third-party assessor, known as a C3PAO. An approved outside auditor would come in and check the contractor's security, rather than the contractor assessing itself.

On July 13, the Defense Department, which now styles itself the Department of War, suspended Phase 2 and froze later phases. It told contracting offices to remove third-party and Level 3 requirements from active solicitations and contracts. It also set up a CMMC Reform Task Force and opened a request for information, a formal invitation for industry to comment, which drew about 1,100 responses according to the department's CIO.

What did not change matters just as much. Level 1 and Level 2 self-assessments stayed in force, as did DFARS clause 252.204-7012, the long-standing contract clause that sets out how defense contractors must safeguard information and report cyber incidents. Contractors still had to assess themselves; only the outside check had been called off.

The 60-day review closed in mid-September, with a report to follow. By the last week of September the report had not been published, and no replacement schedule had been announced. For the finance director, that left a budget with an awkward hole in it, and a question that every contractor in the defense supply chain was asking: what are we still paying for?

CMMC's first phase, from November 2025, made the senior official's affirmation the instrument that mattered most. The July suspension removed the third-party check that was supposed to test those affirmations from late 2026. It did not remove the requirements being affirmed. For a contractor's finance and contracts teams, preparing fiscal 2027 budgets that autumn, the result was a sorting problem.

Security spending fell into three groups: what the suspension left owed, what it deferred, and what it repriced. Getting that sort right is the difference between a sensible budget and a bet on the outcome of a government review. Contractors should confirm the requirements in each solicitation and contract with counsel, since the department said its review could change the program.

Codes, scores and signatures

Defense cybersecurity rules come wrapped in acronyms, and the money makes more sense once they are unpacked.

NIST SP 800-171 is a publication from the National Institute of Standards and Technology that lists security requirements for protecting sensitive government information on private company systems. It covers familiar ideas: who can log in, how passwords and access are controlled, whether activity is logged, how devices are configured, how staff are trained and what happens when something goes wrong. It works like a building code: it says what a safe structure must have, not who inspects it.

DFARS is the Defense Federal Acquisition Regulation Supplement, the Pentagon's own set of contracting rules. Clause 252.204-7012 is the part of a defense contract that says, in effect, "you must follow the building code and tell us quickly if there is a fire."

SPRS, the Supplier Performance Risk System, is a government database where contractors post a score from their own self-assessment against 800-171. It is a public declaration, to the customer, of how well the building meets code.

CMMC sits on top of all this. It sets levels of required protection and adds a formal affirmation by a senior company official, plus, at higher levels, an outside inspection. The affirmation is a signed statement that the company meets the requirements it claims. The C3PAO is the accredited outside inspector.

Finally, the False Claims Act is a federal law that lets the government pursue companies that obtain government money on the basis of false statements. That last piece is why a signature on a cybersecurity affirmation is not a formality.

What the suspension left owed

The core obligations predate CMMC. Clause 252.204-7012 requires contractors handling covered defense information to implement the 110 requirements of NIST SP 800-171. They must report cyber incidents to the department within 72 hours, preserve images of affected systems and flow the clause down to subcontractors. Preserving images means taking a forensic copy of the affected computers, so investigators can later see what happened, rather than simply wiping and rebuilding them. Flowing down means writing the same obligations into contracts with suppliers, so the protection follows the information.

Related clauses require a current self-assessment score in SPRS before award. Phase 1 added CMMC self-assessments and an annual affirmation by a senior official. All of this stayed in place.

The legal exposure stayed too. The Justice Department's Civil Cyber-Fraud Initiative uses the False Claims Act against contractors that misrepresent their cybersecurity. In March 2025, according to the department, MORSECORP agreed to pay $4.6 million to resolve allegations that included posting an SPRS score that did not reflect its actual compliance. With no third-party assessment scheduled, the SPRS score and the affirmation are the main statements the government has to rely on. That raises, not lowers, the value of evidence behind them.

Take a precision machining firm with 120 staff that makes components for a larger prime contractor. Its SPRS score was posted two years ago by an IT manager who has since left. Its chief operating officer signs the annual affirmation. If nobody can now produce the evidence behind that score, the signature is resting on a memory. The suspension did nothing to change that risk. If anything, it put more weight on the signature, because no outside assessor is coming to catch the gap first.

The budget lines that follow are concrete:

• Remediation of any requirements scored as unmet.
• An evidence file for each requirement, showing how it is met: policies, configuration screenshots, logs, training records.
• An internal or independent review before the annual affirmation.
• A tested incident reporting procedure, so the 72-hour clock can actually be met.

A useful measure is the number of open items on the plan of action and their target closure dates, reviewed by the official who signs the affirmation. The plan of action is the company's list of known gaps and how it intends to close them. Phase 2's start date has no bearing on any of it.

What the suspension deferred

The third-party assessment itself was the main cost the pause deferred. A contractor that had planned to book a C3PAO for the first half of 2027 no longer had a contractual reason to do so on that date. Certifications already issued remained valid, and the program rule allows a higher assessment to satisfy a lower requirement.

Contracts already awarded need separate handling. Under the July guidance, contracting officers were to remove third-party requirements from existing contracts at the next option exercise or administrative modification. An option exercise is when the government chooses to extend a contract for another period; an administrative modification is a paperwork change to the contract. Until one of those happens, the original text remains in the contract. Contracts teams should list every affected award, ask each contracting officer in writing how the requirement will be treated in the meantime, and keep the answer with the contract file. A written answer is cheap now and valuable later, if anyone ever asks why the company did not meet a clause that was still in its contract.

Deferral is a choice with trade-offs. Waiting saves cash and avoids buying an assessment that a reformed program might define differently. It also risks the queue. Assessor capacity was the bottleneck that much of the industry worried about before July, and capacity does not grow quickly. If thousands of suppliers all wait for the same announcement and then call the same limited pool of assessors, those at the back of the line may find that their customers' deadlines arrive first.

A sensible middle course is a readiness assessment by an independent firm, scored against the existing assessment guide. It produces evidence for the affirmation now and shortens any certification later. In effect it serves two purposes with one purchase: it protects the signature today and rehearses the inspection that may come tomorrow. Contractors with formal certification already in hand can treat it as a differentiator with primes, even where solicitations no longer require it.

What the suspension repriced

Two investments changed value without becoming optional.

Scope and the enclave

The first is scope. Contractors that confined controlled unclassified information to an enclave did so partly to shrink a future assessment. An enclave is a walled-off part of the company's IT, a separate set of systems and accounts where the sensitive work happens, rather than spreading that information across every laptop and file share. The company then only has to secure, and prove it secured, that one area.

The enclave still reduces the number of systems that must meet 800-171, and so the cost of the self-assessment and the risk behind the affirmation. Its payback period lengthened, but it still pays back. Cloud services used for that information must still meet the department's FedRAMP Moderate equivalency expectations, so platform choices remain constrained. FedRAMP is the federal government's program for approving cloud services for government use; "equivalency" means the provider must offer protection equivalent to that approved baseline. In practice, a contractor cannot simply move sensitive drawings to any consumer file-sharing service because the outside assessment has been paused.

The supply chain

The second is the supply chain. Under Phase 2, primes expected to require certification from subcontractors handling controlled unclassified information, and many smaller suppliers budgeted for it. With the requirement paused, the department's clauses still flow 7012 obligations down, but certification is no longer mandated. Primes may still impose their own requirements by contract.

Each prime now has to decide whether to hold suppliers to certification, accept self-assessments with evidence, or restructure work so fewer suppliers touch controlled information. Whichever it chooses, it should say so in writing. Suppliers are making budget decisions on the assumption either way. A small supplier that cancels its assessment because it assumes the prime no longer cares, only to find the prime's next purchase order demands certification, has lost both time and a place in the assessor queue.

Pricing

Pricing follows from all three groups. Security costs that are still owed belong in indirect rates and bid pricing as they did before. Indirect rates are the overhead charges a contractor builds into its prices to cover costs that are not tied to one contract. Deferred certification costs should be held as a contingency, with a trigger tied to the department's announcement of a new schedule. Firms that removed all CMMC costs from their 2027 budgets on the strength of a pause were betting on the review's outcome.

How the work runs inside a contractor

Seen up close, the work moves through a company over a year in four steps.

It usually starts with an owner. Someone, often the head of IT or a security manager, holds the list of 110 requirements and, for each one, a short note of how the company meets it and where the proof lives. For a requirement about limiting who can reach sensitive files, the proof might be a list of the people with access, a record of who approved each one and a screenshot of the settings. For a requirement about training, it might be attendance records. The work is unglamorous, but it is what turns a score into something a company can stand behind.

Next comes the plan of action. Few companies meet every requirement perfectly at all times. Where there is a gap, it goes on the list with an owner and a target date. The plan is only useful if it moves, which is why reviewing open items and closure dates matters more than producing the document once.

Then there is the rehearsal. Incident reporting within 72 hours sounds simple until a real event happens on a Friday evening. A tabletop exercise, in which the team talks through a realistic scenario around a table, shows quickly who would make the call, who would preserve system images and who would contact the department. Gaps found in rehearsal are cheap; gaps found in a real incident are not.

Finally, the affirmation. Before signing, the senior official should see a short summary: the current SPRS score, how many items remain open, what changed since last year and whether an internal or independent review found anything new. At the machining firm described above, that briefing would take an hour and would give the chief operating officer a factual basis for the signature. Without it, the signature rests on trust alone.

All four of these steps were needed before the suspension and remain needed after it. What the pause removed was the outside assessor who would have tested them; what it left was the company's own responsibility to be able to show its work.

A board problem filed under IT

It is easy to file CMMC under "IT compliance" and leave it there. That misreads where the risk sits. The obligations that remained are contractual, the statements that remained are signed by a senior official, and the enforcement tool that remained is a fraud statute. That puts the issue squarely with the CEO, the CFO and general counsel.

There is also a commercial dimension. Defense work is built on trust between primes and their suppliers. A supplier that can show clean evidence, a credible plan of action and, where it has one, an existing certification is easier to keep on a program. One that fell silent during the pause may find itself replaced, without much ceremony, when a prime restructures work to reduce the number of suppliers touching sensitive information.

And there is a staff dimension. Evidence files, incident procedures and enclaves depend on people who know how they work. A pause that encourages cost cutting can easily lose the one or two employees who carried that knowledge, making any later restart more expensive than the savings were worth.

Three columns: owed, deferred, repriced

A well-prepared contractor in autumn 2026 would have a three-column budget for security: owed, deferred and repriced. The owed column would be funded in full. The deferred column would hold a contingency with a clear trigger. The repriced column would show a reasoned decision on the enclave and, for primes, a written supplier policy. The senior official signing the affirmation would see the open plan-of-action items regularly and be able to point to evidence for each requirement.

The usual errors run the other way:

• Reading "paused" as "repealed." The underlying duties under 7012, SPRS and the affirmation never paused.
• Cutting evidence along with the assessment. Without an outside check, evidence is the company's main defense of its own statements.
• Leaving old contract text unaddressed. Until a contract is modified, the original requirement is still written into it.
• Staying silent with suppliers. Primes that do not state their policy leave subcontractors guessing with their budgets.
• Dismantling the enclave. It still cuts the scope and cost of compliance, just on a longer payback.

Where the budget meeting should start

1. Which of our duties under clause 7012, SPRS and the annual affirmation are unchanged by the suspension, and are they fully funded in the 2027 budget?
2. When was our SPRS score last updated, who produced it and where is the evidence behind each requirement?
3. Which of our existing contracts still contain third-party certification text, and do we have each contracting officer's position in writing?
4. If we defer certification, what contingency are we holding and what event triggers spending it?
5. For primes: have we told every subcontractor in writing what we will require of them? For suppliers: have we asked each prime?

The pause changed the timetable for one part of the program. It did not change what the company has promised, in writing and over a senior official's signature, to the government it serves.

With hindsight

The task force's report remains unpublished in mid-October 2026, and the department has not announced a new Phase 2 date or said whether the program will change shape. The uncertainty that faced finance directors in late September has, if anything, stretched into the budget year itself.

In September, Revision 3 of the DFARS class deviation for part 240 restated the pause and told contracting officers to remove third-party requirements from solicitations and contracts. A class deviation is a formal, temporary departure from the normal contracting rules, issued for a whole category of contracts at once. Its restatement confirms the direction of travel for now, without settling where the program ends up.

Phase 1 self-assessments, SPRS scores, annual affirmations and the 7012 clause remain in force. That is the steady ground under all of this: whatever happens to third-party certification, the obligations a contractor signs up to today are the same ones it signed up to before July.

The department's CIO has said she intends to publish the report but has given no date. Outcomes discussed in industry commentary range from a later Phase 2 with more assessor capacity to narrower certification for higher-risk information. None has been announced. Those possibilities are scenarios to plan around, not forecasts to budget on.

The sorting set out here still applies whichever path the department takes. Money spent on what is owed protects the company under any outcome. Money held as a contingency for what is deferred can be released or redeployed once the department speaks. Decisions on what was repriced, the enclave and the supplier policy, can be revisited when the report appears. Uncertainty about the inspector is not uncertainty about the obligation. Contractors should follow official guidance and confirm requirements solicitation by solicitation with counsel.