Pause Is Not a Vacation: Five Owner Questions After the CMMC Phase 2 Suspension

Third-party CMMC assessments are on hold. Self-assessment and baseline cybersecurity clauses are not. Here is what any owner in a regulated supply chain should ask this month.

When a big certification program pauses, the hallway rumor starts fast: “We can stop spending.” That is usually the most expensive rumor of the year.

In July 2026, the Department of War (DoW) Chief Information Officer suspended advancement to Cybersecurity Maturity Model Certification (CMMC) Phase 2. A July 13 memorandum implementing that suspension is clear: during the pause, program offices may only include CMMC Level 1 (Self) or Level 2 (Self) in procurement documents — not Level 2 (C3PAO) or Level 3 (DIBCAC) third-party assessments. Active solicitations and contracts with those third-party assessment requirements were directed to be amended or modified. Critically, the memo also states that baseline compliance with NIST SP 800-171 Revision 2 through those self-assessment paths continues, and that DFARS 252.204-7012 cybersecurity and cyber-incident reporting requirements remain in effect.

Reporting in early September 2026 described a September 3 class deviation that further codifies removal of third-party assessment language while preserving those baseline obligations. Whether you wear a “defense contractor” label or simply sit two layers deep in a manufacturing or professional-services supply chain, the owner lesson is the same: pause ≠ vacation from protecting customer data.

1. What still applies to us in writing?

Ask counsel or your contracts lead to list the live clauses: DFARS 252.204-7012, FAR basic safeguarding, flow-downs from primes, and any remaining Level 1/2 self-assessment language. “CMMC paused” is not a legal memo. A one-page clause inventory with dates is.

2. Are we treating self-assessment as real work or as a checkbox?

Level 1 and Level 2 self assessments were intentionally left available. Guessing “implemented” without evidence is how questionnaires fail customers and underwriters alike. Name who owns the score, where evidence lives, and the last date it was refreshed.

3. Did we cancel the wrong spend?

Third-party assessment fees may wait. MFA, logging, backup restore tests, and access hygiene should not. Coverage of the pause cited Small Business Administration estimates near $593,800 for small businesses facing third-party certification burden — relief on that line item is real. Relief on basic cyber hygiene is fantasy.

4. What is our one-sentence ask to the MSP?

“Please confirm in writing which of our systems could process Federal Contract Information or Controlled Unclassified Information (or equivalent customer-restricted data), what evidence we already have for a NIST SP 800-171-style self-assessment, and the top five gaps before our next prime or customer security review.”

5. What does “good enough this quarter” look like?

Pick a finish line: scoped systems list, unique admins, MFA on privileged users, dated backup restore test, training attestation, and a living SPRS or self-assessment folder if you report scores. Dated progress beats a glossy binder waiting for a third-party assessor who is not coming this month.

Why Non-Defense SMBs Should Still Care

Primes and large customers copy assessment language into ordinary vendor packets.
Insurers ask about “framework alignment” even when CMMC is not in your contract.
Listening-session coverage noted that compliance theater is not the same as security — and that OT/manufacturing realities were underserved. If you run a plant or building systems, inventory those now (see NIST’s new OT draft) instead of waiting for the next reform memo.

What “Good Enough” Looks Like This Month

One-page clause inventory: what is paused vs. what remains in force.
Named self-assessment owner + evidence folder with a refresh date.
Written MSP reply to the one-sentence ticket above.
No cancellation of MFA, logging, or backup tests “because CMMC paused.”
Calendar block titled “self-assessment evidence refresh” before the next customer deadline.

This is stewardship. Program reform may continue. Your customers and underwriters will not wait for the perfect certification design before asking whether you can protect their data.

If you want a fractional CISO to turn these five questions into a one-page owner packet — MSP ticket included — Security Medic / Hudson Valley CISO can help. Calmly, with evidence, not theater.

References

DoW / DoD memo, “Implementing … Suspension of the Advancement to CMMC Phase 2 Requirements” (Jul 13, 2026): ImplementingSuspensionCMMC-PhaseII.pdf
MeriTalk, “DOD Codifies Pause of CMMC Phase 2…” (Sep 10, 2026) — reporting on Sep 3 class deviation and CIO remarks: meritalk.com/…