What the CMMC Phase 2 Pause Means for Small Defense Contractors

In July 2026 the Department of Defense suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. If you own a small business that works on defense contracts, the headline sounds like a reprieve. It is not one. The pause changed a single moving part of the rollout and left the obligations that actually govern your business exactly where they were. Reading it as permission to stop is the most expensive mistake you can make with it.

What was actually paused

What the suspension reaches is the piece that requires an outside assessor. Under the CMMC schedule, higher-sensitivity contracts were set to require a certification performed by a Certified Third-Party Assessment Organization (C3PAO) as a condition of award. That third-party certification step is what got put on hold. The audit you were bracing for is not being scheduled right now.

That is the whole of it. One step, the outside audit, is paused. Everything else that creates your duty to protect government information is untouched.

What did not change, and still binds you

Your real obligations do not come from the paused piece. They come from clauses that are already in your contracts and remain in full force.

The safeguarding duty. Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 requires you to protect Controlled Unclassified Information (CUI) on your systems and to report incidents. The pause does nothing to it.

The self-assessment. DFARS clauses 252.204-7019 and 7020 require you to perform a National Institute of Standards and Technology (NIST) Special Publication 800-171 self-assessment and post the score in the Supplier Performance Risk System (SPRS). For most solicitations, a current score on file is a condition of eligibility. That requirement is still live, and primes still check it before they subcontract to you.

Level 1 self-assessment. If your work involves Federal Contract Information, the basic safeguarding self-assessment tied to CMMC Level 1 was never part of the suspension.

So the standard your systems must meet is unchanged. What moved was the date on which an outside party comes to verify it.

The part that is easy to miss: your liability went up

Here is the counterintuitive piece. With third-party audits paused across the industry, the government is leaning harder on self-assessment, and the responsibility for an accurate score sits squarely with you. A number you post in SPRS is a representation to the federal government. If it is inflated and a contract or an incident later exposes the gap, the exposure runs through the False Claims Act, where the penalties are measured in multiples of the contract value, not the cost of the controls.

That makes an honest, evidence-backed self-assessment worth more during the pause, not less. It is the record that protects you when there is no assessor standing between your claim and your reality.

What the pause is actually good for

Used correctly, the suspension is breathing room, and breathing room is valuable. It is time to close real gaps on a schedule you set rather than one an assessor forces. The contractors who come out of this ahead are the ones who treat the paused audit as a deadline that moved, not a deadline that vanished, and who spend the time getting genuinely ready.

Three things to do while the clock is quiet:

1. Score yourself honestly against all 110 requirements of NIST 800-171 and make sure the number in SPRS matches what you can actually prove.

2. Fix the highest-weight technical gaps now, the identity, encryption, and monitoring controls that take real engineering time and cannot be closed in a hurry later.

3. Build the evidence trail behind the score, so that whenever the third-party assessment does return, and it will, the closeout is a formality rather than a scramble.

The pause did not lower the bar. It removed the referee for a while and handed you the whistle. The smart move is to call your own game honestly and be ready when the referee comes back.