Government contractors have been preparing for CMMC for years. For many small and mid-sized defense contractors, the biggest concern has been the cost, complexity, and timing of third-party assessments.
On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect on November 10, 2026. This means the next phase of mandatory third-party assessment requirements has been paused while the Department conducts a broader review of the program.
That does not mean CMMC is gone.
It also does not mean contractors can stop working on cybersecurity.
As of August 2026, Phase I self-assessment requirements remain in place. Contractors that handle Federal Contract Information or Controlled Unclassified Information still need to understand their obligations, maintain accurate assessments, protect sensitive data, and continue aligning with cybersecurity requirements such as NIST SP 800-171 Rev. 2 and DFARS 252.204-7012.
The message for government contractors is simple: the timeline may have changed, but the responsibility to protect federal data has not.
What Changed on July 13, 2026?
The July 13 announcement suspended CMMC Phase II implementation requirements. Phase II was expected to expand third-party assessment requirements for certain contractors, especially those seeking Level 2 certification through a CMMC Third-Party Assessment Organization.
That upcoming requirement is now paused.
The Department also established a CMMC Reform Task Force to review the program and recommend changes. The review is intended to reduce unnecessary compliance burden, lower barriers for small, medium, and non-traditional businesses, and focus cybersecurity efforts on practical, scalable protection.
The DoW CIO CMMC Portal remains the best official source for current CMMC updates: DoW CIO CMMC Portal.
For contractors, the biggest practical change is that third-party assessment pressure has been delayed. Organizations that were preparing for a C3PAO assessment may now have more time to improve their environments, close gaps, document controls, and reassess their strategy.
However, this should not be treated as a reason to pause cybersecurity work.
What Has Not Changed?
Several important requirements remain active.
First, Phase I self-assessments are still in place. The DoW CIO CMMC Portal states that the program is paused in Phase I and may only require self-assessments at Level 1 and Level 2 during this period.
Second, contractors still need to protect federal data. For organizations that handle Federal Contract Information, Level 1 self-assessment requirements remain relevant. For organizations that handle Controlled Unclassified Information, Level 2 self-assessment against NIST SP 800-171 Rev. 2 remains central.
Third, DFARS 252.204-7012 still matters. Contractors and subcontractors that handle covered defense information remain contractually obligated to safeguard that information and meet applicable cyber incident reporting requirements.
Fourth, SPRS submissions and affirmations remain important. Contractors should make sure their self-assessment scores are accurate, current, and supported by real evidence.
Finally, prime contractors may still ask subcontractors to demonstrate cybersecurity readiness. Even if certain CMMC assessment requirements are paused, primes, customers, and contracting partners may still expect assurance that sensitive information is being protected.
Why Contractors Should Not Hit Pause
It may be tempting to view the Phase II suspension as a chance to slow down. That would be a mistake.
The suspension affects the timing and structure of future CMMC requirements. It does not eliminate the underlying need for strong cybersecurity.
Cyberattacks against the defense industrial base continue. Contractors remain attractive targets because they may handle technical data, contract information, intellectual property, employee data, and sensitive communications. Smaller contractors can be especially vulnerable if they lack dedicated security staff, mature documentation, or properly configured cloud environments.
A delay in third-party assessments does not reduce the risk of phishing, ransomware, account compromise, insider mistakes, vendor exposure, or data leakage.
It also does not reduce the need to be ready when requirements change again. The review period may lead to a revised CMMC approach, but contractors that continue improving now will be in a better position regardless of the final direction.
What Government Contractors Should Do Now
The best approach is to use this period wisely.
Instead of rushing toward a third-party assessment date, contractors should focus on building a cybersecurity program that is accurate, documented, and sustainable.
1. Confirm What Type of Information You Handle
Start with scope.
Do you handle only Federal Contract Information? Do you store, process, or transmit Controlled Unclassified Information? Do subcontractors or vendors have access to sensitive contract data? Is CUI stored in email, SharePoint, Teams, OneDrive, local servers, endpoints, or third-party applications?
Many compliance challenges begin with unclear scope. If you do not know where sensitive data lives, you cannot properly protect it.
2. Review Your Current Self-Assessment
If your company has submitted a score in SPRS, review it carefully.
The score should reflect your actual implementation of the required controls. It should not be aspirational. It should not be based only on policy language. It should be supported by evidence.
For Level 2 self-assessment, contractors should use NIST SP 800-171 Rev. 2 and NIST SP 800-171A to evaluate how security requirements are implemented. You can find official NIST resources here: NIST SP 800-171 Rev. 2.
3. Update Your System Security Plan
Your System Security Plan should explain how your organization implements required security controls.
A strong SSP should be specific to your environment. It should identify systems, users, data flows, tools, responsibilities, access controls, monitoring processes, and any limitations or gaps. It should not be a generic template that does not match reality.
If your environment has changed, your SSP should be updated. This includes changes to Microsoft 365, GCC High, endpoints, remote work tools, vendors, subcontractors, backup systems, security tools, and cloud services.
4. Clean Up Your POA&M
If you have gaps, they should be tracked in a Plan of Action and Milestones.
A POA&M should clearly identify what is missing, who owns the remediation, what steps are required, and when the issue is expected to be resolved. Contractors should avoid treating POA&Ms as a place where unresolved issues sit indefinitely.
Use this pause to close the gaps that are realistic to fix now. Focus first on the areas that create the most risk, such as MFA, access control, endpoint protection, logging, backup protection, incident response, and CUI storage.
5. Strengthen Access Controls
Access control remains one of the most important areas for GovCons.
Review who has access to sensitive systems and data. Remove former employees, stale vendor accounts, unnecessary administrator privileges, and old project access. Make sure users only have access to the systems and data they need for their current role.
This is especially important if CUI is involved. Access creep can create unnecessary exposure and make compliance harder to defend.
6. Validate Your Cloud Environment
Many contractors rely heavily on Microsoft 365, SharePoint, Teams, OneDrive, email, and other cloud platforms. These tools can support secure operations, but only if they are configured properly.
Contractors should review MFA, conditional access, administrative roles, external sharing, audit logging, retention settings, device management, and secure file sharing. They should also make sure CUI is not being stored or transmitted in systems that are not appropriate for that data.
Cloud security is not automatic. It requires configuration, monitoring, and governance.
7. Review Incident Response and Reporting
Cybersecurity compliance is not only about prevention. Contractors also need to know how they will respond when something goes wrong.
Review your incident response plan. Make sure employees know how to report suspicious activity. Confirm who contacts IT, leadership, legal counsel, cyber insurance, vendors, and government reporting channels when needed.
Also make sure your team understands the cyber incident reporting obligations tied to DFARS 252.204-7012. The official acquisition clause is available here: DFARS 252.204-7012.
8. Watch the Official CMMC Portal
Because the program is under review, contractors should track official updates directly from the DoW CIO CMMC Portal. Industry commentary can be useful, but official guidance should drive decisions.
The July 2026 update also launched a reform process that may lead to changes in assessment structure, evidence expectations, or implementation timelines. Contractors should pay attention to any new memos, RFI updates, task force findings, and implementation guidance.
What This Means for Small and Mid-Sized Contractors
For small and mid-sized GovCons, the suspension may create some breathing room. Many smaller contractors were concerned about the cost and availability of third-party assessments, especially if they were still working through documentation, tool selection, cloud migration, or control implementation.
But breathing room is not the same as a free pass.
This is a good time to take a practical approach:
- Identify where CUI lives
- Confirm whether your self-assessment is accurate
- Update your SSP
- Close high-risk POA&M items
- Strengthen MFA and access control
- Review cloud security settings
- Validate backups and incident response
- Maintain evidence of implementation
- Monitor official CMMC updates
The organizations that use this time wisely will be better prepared for whatever comes next.
How V2 Systems Can Help
CMMC uncertainty can be frustrating, but the path forward is still clear: protect sensitive data, document your environment, maintain accurate assessments, and build practical cybersecurity controls that can stand up to review.
V2 Systems helps government contractors strengthen IT environments, improve cybersecurity, and support compliance readiness tied to CMMC, NIST 800-171, DFARS, ITAR, and related federal requirements. Learn more about our IT services for government contractors.
We can help organizations assess their current posture, review Microsoft 365 security, support documentation efforts, improve access controls, identify gaps, and build a more manageable cybersecurity roadmap.
For organizations that need practical support with compliance operations, V2 Systems also offers Managed Compliance Services to help businesses stay organized, reduce risk, and prepare for evolving requirements.
And for companies that need day-to-day technology support, our Managed IT Services help keep systems secure, reliable, and aligned with business needs.
The Bottom Line
CMMC Phase II is suspended for now, but cybersecurity requirements for government contractors remain active.
Contractors should not stop preparing. They should use this period to improve the parts of their cybersecurity program that matter most: scope, access control, documentation, evidence, cloud security, incident response, and NIST SP 800-171 implementation.
The review process may change the future of CMMC, but it will not change the need to protect federal data.
Contact V2 Systems today for a complimentary two-hour consultation and learn how we can help your organization stay compliant, reduce risk, and prepare for what comes next. We work with clients nationwide.
For more insight, continue reading related V2 Systems resources such as The Audit Readiness Problem Government Contractors Can’t Afford to Ignore and Microsoft 365 Compliance Manager: A Step-by-Step Guide for Government Contractors.
