If your organization supports defense work, you may have heard that CMMC is “on hold until 2028.” That summary leaves out the part that matters operationally: the pause affects assessment requirements, not the underlying obligations already in your contracts.

What changed, in practical terms

On July 13, 2026, the Department suspended the move to CMMC Phase 2, which had been scheduled to begin November 10, 2026. Phase 2 would have introduced third-party Level 2 certification requirements for many awards. Later milestones were also paused while a Reform Task Force reviewed the program.

The implementing memo limits new requirements during the review to Level 1 (Self) and Level 2 (Self) assessments. It also says that third-party Level 2 and Level 3 assessments cannot be required on new work during this period. Open solicitations are being amended, while existing contracts are addressed through an option or administrative modification rather than changing automatically.

The Department received more than 1,100 responses to its request for information. The task force’s 60-day review ended in September, but its recommendations had not been published as of early October.

Why people are talking about 2028

Revision 3 of the class deviation, issued September 3, includes November 10, 2028. That date was already part of the phased clause structure; the revision carried it forward. It should not be read as a blanket extension of every cybersecurity obligation.

The useful distinction is this: the pause changes the assessment level that may be required for new work during the review. It does not erase DFARS, NIST SP 800-171 or SPRS obligations that already apply.

What contractors still need to manage

• DFARS 252.204-7012. Adequate security for covered defense information, and incident reports within 72 hours.
• NIST SP 800-171 Rev. 2. All 110 requirements, for any system that handles CUI.
• Your SPRS score. Required under DFARS 252.204-7019 since 2020, separate from CMMC.
• Annual affirmation by a senior official when required for the applicable CMMC self-assessment.
• Government-led assessments, which can independently evaluate implementation and produce findings or scores that differ from a submitted self-assessment.
• Prime contractor flow-downs. Some primes are keeping their own certification expectations.

The CMMC rule itself, 32 CFR Part 170, is still on the books. What stopped is the Department’s choice to require the higher assessment levels.

Why the SPRS score deserves another look

With third-party certification paused, contracting officials may place greater reliance on self-assessments. The government can still perform its own review, and its findings may differ from the score a contractor submitted.

That difference can carry legal and commercial consequences. In September, the Justice Department announced that Honeywell Aerospace agreed to pay just over $2 million to resolve allegations involving NIST SP 800-171 gaps, with no determination of liability. In June, LOGZONE agreed to pay $507,144 to resolve allegations after a government assessment produced a score of negative 170, compared with the company’s earlier submitted self-assessment score of 110.

The practical question is not whether a score was defensible when it was first entered. It is whether the score still describes the environment today and whether the supporting evidence can withstand review.

A sensible review for this quarter

1. Read your contracts, not the headlines. List the clauses each one carries.
2. Re-check your SPRS score against your environment as it is today. Correcting it yourself is far cheaper than having someone else find it.
3. Keep your SSP and POA&M current. Whatever model comes next will start from them.
4. Don’t pause remediation. Pausing a certification is a timing decision. Pausing controls is a compliance gap.
5. Watch for real changes. A task force report is advice. Obligations change through a deviation, a DFARS rule or an amendment to the CMMC rule.

Where to start

None of this means every contractor should react in the same way. Contract language, CUI scope and prime-contractor expectations differ. Start with the clauses that actually apply to your work, then confirm that the SSP, POA&M and SPRS score match the current environment. 

 A 30-minute SPRS review is available at svam.com/cybersecurity-awareness-month/.

This article is general information, not legal advice. Talk to your contracting officer or counsel about your specific contracts.
SVAM supports NIST SP 800-171 gap assessments, SPRS score reconciliation, SSP development and POA&M maintenance

Explore Our Cybersecurity Services →