What Changed with CMMC in July, and What a 30-Person Contractor Should Do Now
The DoD suspended CMMC Phase II in July 2026. Third-party certification is on hold. Your SPRS score, DFARS 7012, and NIST 800-171 are not. Here's what that means for a small contractor.
On July 13, 2026, the Department of Defense suspended Phase II of CMMC. That was the stage where third-party Level 2 certification assessments were supposed to start showing up in contracts this November. It’s on hold while the Department reviews the program.
If you’re a small contractor, it’s tempting to read that as “CMMC is over, I can stop worrying.” Don’t. Most of what actually applies to you didn’t change.
What’s paused.
Third-party certification. The requirement to have an outside assessor (a C3PAO) certify your Level 2 environment before you can win certain contracts is suspended. Contracting officers have been told to pull that requirement from active solicitations. The later phases of the rollout are on hold too.
The Department ran a 60-day review that closed in September. As of this writing, the results haven’t been published, and there’s no date for when they will be. What comes next could look a lot like the old plan, or it could change how assessments work. Nobody outside the review knows yet.
What didn’t change.
DFARS 252.204-7012. If it’s in your contract, you’re still required to implement NIST 800-171 and report cyber incidents within 72 hours. That’s been true since 2017.
Your SPRS score. Contracts with the 7019 and 7020 clauses still require a current score on file. The score you submitted is your official statement about your security.
Self-assessments and affirmations. Level 1 and Level 2 self-assessments still apply, and so do the annual affirmations that go with them.
False Claims Act exposure. The Department of Justice has kept pursuing companies whose cybersecurity claims didn’t match reality. A padded SPRS score is a bigger risk than an honest low one.
Your prime’s requirements. Many primes flow security requirements down to their subs regardless of what the DoD does on the certification timeline. Read your flow-downs.
What a 30-person contractor should do now.
1. Figure out if you’re Level 1 or Level 2. If you only handle Federal Contract Information, you’re likely Level 1: 15 basic requirements and an annual self-assessment. If you handle Controlled Unclassified Information (drawings, specs, and technical data are common examples), you’re in Level 2 territory and the full 110 controls of NIST 800-171 apply. Most small contractors are Level 1. Check your contracts and what your prime actually sends you.
2. Check the SPRS score you have on file. If you typed in a number a few years ago and haven’t looked since, find out whether it’s still accurate. If it isn’t, fix the environment, then fix the score.
3. Use the pause to do the infrastructure work. Multi-factor authentication, endpoint protection, access control, logging, and backups. These cover a large share of the 800-171 controls, they’re what cyber insurance carriers ask for anyway, and they take months to do well. If certification comes back, you’ll be ready. If it doesn’t, you’ll still be safer.
4. Get your documents in order. A System Security Plan that describes how your environment actually works, and a Plan of Action and Milestones for the gaps. Templates are fine as a starting point. Documents that don’t match reality are a liability.
5. Be careful with quotes written before July. If a consultant quoted you certification preparation before the suspension, the scope may have changed. Get a second opinion before you sign.
The short version.
The deadline moved. The obligation didn’t. Contractors who use this window to get their environment right will be in a stronger position whatever the review decides, and they’ll be safer in the meantime.
We keep our CMMC and NIST 800-171 page updated as the review plays out. If you want to talk through where you stand, a 30-minute conversation costs you nothing.