CMMC Phase II is suspended. What should a small defense contractor do now?

What did DoD suspend?

On July 13, 2026 DoD paused the CMMC rollout and suspended Phase II while the DoD CIO runs a 60 day review (DoD CIO: About CMMC). During the review, contracts may call for CMMC Level 1 or Level 2 self-assessments, not third-party (C3PAO) certification assessments (Cyber Grants Alliance).

What still applies to my company today?

DFARS 252.204-7012 remains in effect, and NIST SP 800-171 Rev 2 is still the baseline. Level 2 self-assessments, posting your score in SPRS, and the annual affirmation by a senior official all still stand (Cyber Grants Alliance). A pause on one type of assessment does not pause the clauses already in your contract.

What should a small contractor do this quarter?

Three things, in this order:

• Read your contract. Find which CMMC level, if any, it names, and whether it handles Federal Contract Information or Controlled Unclassified Information. The level follows the information.
• Get a gap list. A gap assessment shows where you stand against all 110 NIST SP 800-171 requirements before anyone signs anything.
• Keep your score honest. The SPRS score and the affirmation your executive signs must match what is in place. A gap list is how you check that they do.

Why start with a gap assessment and not a certification assessment?

A certification assessment answers "did we pass". A gap assessment answers "what is missing", which is the question you can act on during a pause. An in-kind CMMC gap assessment grant can cover it at no cost to you.

Where do I start?

Apply for the in-kind CMMC gap assessment grant, or book a gap assessment directly if you would rather not wait for a grant match. If you are not sure which level you need, the CMMC level finder takes three questions.