CMMC Phase 2 Suspension: What Texas Defense Suppliers Still Owe (Updated October 2026)

Phase 2 was scheduled to begin on November 10, 2026. From that date, DoD solicitations covering controlled unclassified information would have required a certified third-party assessment before award. That trigger is now suspended, and the announcement holds pending and future CMMC implementation milestones in abeyance across Department of War solicitations and contracts until further notice.

The stated rationale from Department of War Chief Information Officer Kirsten Davies was cost and arithmetic. The memo, titled Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements, describes the current CMMC program as structurally incompatible with the need to rapidly expand the defense industrial base, and points to significant and often prohibitive burdens on small, medium and non-traditional contractors.

Then there's the capacity problem. The number of defense industrial base companies that would have needed a third-party assessment dwarfs the pool of authorized Certified Third-Party Assessment Organizations (C3PAOs) available to perform them, and Davies said plainly that the math didn't work for small and mid-sized businesses to get compliant by the transition date.

The same memo stood up a CMMC Reform Task Force reporting to the Department CIO. The review took effect immediately with the July 13 announcement, and the task force held its first meeting on July 17, 2026. It draws leadership from acquisition and sustainment, intelligence and security, the Office of the CIO, general counsel, public affairs and legislative affairs, plus the Small Business Administration and the White House.

Its mandate is to reduce those burdens on the defense industrial base, lower barriers for small, medium and non-traditional businesses, and explore scalable, realistic security measures that could replace the current third-party compliance model. A public Request for Information posted to SAM.gov is collecting industry input on cost drivers, administrative burden, which NIST SP 800-171 Revision 2 controls actually reduce risk, and how the department might recognize commercial security tools and managed services already in use. Responses closed on August 14, 2026.

Recommendations were due within 60 days of the July 13 announcement, which put the deadline at September 11, 2026. That window has closed. The report goes to Davies first, and it's her call whether and when the recommendations are made public. As of this update there's no published report, so plan on reform rather than repeal, and don't build a schedule around a release date nobody has committed to.

The July memo set policy. What binds a contracting officer is a class deviation, and this one has a paper trail. Three days after the announcement, on July 16, 2026, the Department's pricing and contracting policy office carried the suspension into Revision 2 of class deviation 2026-O0025. On September 3, 2026, John M. Tenaglia, Principal Director for Defense Pricing, Contracting, and Acquisition Policy, signed Revision 3, which restates that direction and carries it forward (DARS class deviation 2026-O0025, Revision 3). Contracting officers must work with requiring activities to remove or revise CMMC requirements in new and existing solicitations and contracts. Active solicitations get amended as soon as practicable, and existing contracts that carry the requirements get modified before the next option period is exercised or through the next scheduled administrative modification.

Read the same document for what it keeps. It permits requiring activities to include Level 1 (Self) or Level 2 (Self) assessments in any procurement, and it requires baseline compliance with NIST SP 800-171 Rev 2 under DFARS 252.204-7012. It also says, in so many words, that it remains in effect until rescinded or incorporated into the FAR and DFARS. A class deviation is harder to unwind than a memo, and it reaches contracts already in performance, but it isn't a rulemaking: 32 CFR Part 170 and the DFARS clauses were never amended, and a later revision can restore the third-party requirement without notice-and-comment. Durable enough to plan around, not permanent enough to stop the work.

Read the release carefully and one sentence does all the work: all Phase 1 self-assessment requirements remain firmly in place. Phase 1 was never suspended. What was suspended is the escalation from self-attestation to independent verification.

During the review period, the department says it will continue enforcing NIST SP 800-171 Revision 2 through CMMC Level 1 and Level 2 self-assessments and select government-led assessments, and all other contractual cybersecurity clauses remain intact. DCMA's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) did not lose its assessment authority on July 13. The C3PAO third-party assessment delay removes a scheduling problem and a line item. It removes nothing from your security obligations.

Every DFARS 252.204-7012 obligation survives. You still safeguard covered defense information. You still implement the 110 controls in NIST SP 800-171 Rev. 2. You still maintain a System Security Plan and a Plan of Action and Milestones, and under DFARS 252.204-7019 and 252.204-7020 you still post and keep current a NIST SP 800-171 self-assessment SPRS score in the Supplier Performance Risk System.

That score is not a marketing number. It is a representation to the government, calculated on a scale that tops out at 110 and can run deeply negative when high-weight controls are missing. If your last SPRS entry is more than a year old, or predates a network refresh, a Microsoft 365 tenant migration or an acquisition, it is stale and it is still binding. Refresh it. Our NIST 800-171 compliance walkthrough covers how the scoring methodology penalizes the controls most shops skip first.

The 48 CFR final rule published September 10, 2025 took effect on November 10, 2025. Since then, contracting officers have been authorized to insert DFARS clause 252.204-7021, along with the solicitation provision at 252.204-7025, into applicable solicitations, contracts, task orders and delivery orders. The DFARS 252.204-7021 requirement for Level 1 and Level 2 self-assessment and annual affirmation by a senior company official persists through the suspension.

If your contract already carries 7021 at Level 1 or Level 2 self-assessment, nothing changed for you. Your affirming official still signs. Practically, this means the flow-down to your own subcontractors still needs to happen, and the clause language in quotes you send out this quarter shouldn't be edited to reflect a suspension that doesn't apply to Phase 1. The class deviation changes what a contracting officer may put in a solicitation for the third-party levels; it doesn't rewrite the clause for the self-assessment levels you already hold.

This is the part that should keep a shop owner up at night. With third-party verification suspended, the government's primary enforcement lever is the False Claims Act cybersecurity attestation theory, and DOJ has been actively using it.

In June 2026, LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve allegations that it billed the Navy on two contracts while knowing it hadn't implemented required NIST SP 800-171 controls (U.S. Department of Justice settlement announcement). The detail that matters: on October 13, 2021 the company posted a perfect self-assessment score of 110 in SPRS. When DCMA's DIBCAC completed its own assessment on February 2, 2024, the score came back at -170, near the bottom of a scale that runs from -203 to 110. Of the settlement, $253,572 was restitution, meaning the government applied a two-times multiplier (settlement agreement). The gap between the attested number and the assessed reality is the entire case. The settlement resolved allegations rather than establishing liability, which is cold comfort if your own gap looks similar.

A suspended audit regime doesn't reduce this exposure. It concentrates it, because self-attestation is now the whole ballgame and whistleblower relators are paying attention.

Practical Gulf Coast defense supply chain compliance work for a Houston fabricator, a Beaumont refinery services contractor or an aerospace supplier near Ellington Field and the Johnson Space Center should look like this while the suspension runs.

• Keep executing the 110-control remediation plan on schedule. Every control you close is a control you do not have to close under deadline pressure when the framework returns in some form.
• Refresh the SPRS score and date it. Recalculate honestly, including negatives. A defensible 62 beats an indefensible 110.
• Close the highest-weight POA&M gaps first. In practice that means multifactor authentication on all remote and privileged access, FIPS-validated encryption for CUI at rest and in transit, centralized audit logging with actual retention, and documented privileged access controls with separation of duties.
• Define and document the CUI boundary. A scoped enclave, whether GCC High, a segmented VLAN for the shop floor, or a dedicated engineering environment, is the single biggest cost lever in any future assessment. Scope work done now pays off regardless of what the task force recommends.
• Don't sign a C3PAO slot or a multi-year assessment contract yet. A Level 2 assessment is a significant line item for a small business, and readiness and remediation work frequently costs more than the assessment itself. No contract can currently designate Level 2 (C3PAO), and nothing requires you to commit that spend before the task force report lands and the Department says what replaces Phase 2. Deposits made now may buy an assessment against a construct that no longer exists by the time it's scheduled.

For the build-side detail behind these bullets, from finding the CUI and classifying assets to the Rev 2 versus Rev 3 trap and the controls CUI never required you to buy, read our companion guide on what a defense supplier should do during the CMMC suspension. The month-by-month sequence (scoping, gap analysis, control deployment, SSP authoring, mock assessment) is in our CMMC 2.0 preparation roadmap for Texas defense contractors; everything in it except the C3PAO engagement step still applies today.

What to Tell a Prime That Asks About Your Certification Status This Quarter

Give them facts, not a shrug. A clean answer sounds like this: our current SPRS self-assessment score is X as of [date], posted under CAGE code [code]; our System Security Plan is current as of [date]; we have an active POA&M with [n] open items and target closure dates; our senior affirming official is [name]; and we are complying with all Phase 1 DFARS 252.204-7021 obligations. We have paused scheduling a C3PAO assessment pending the CMMC Reform Task Force report, consistent with the July 13, 2026 suspension and class deviation 2026-O0025.

That answer keeps you on the bid list. "We were waiting on CMMC" does not.

The honest read on the CMMC Level 2 timeline 2026 is that nobody outside the task force knows the endpoint. The plausible outcomes range from a rescoped control set with fewer mandatory items, to broader acceptance of commercial security certifications and continuous monitoring evidence in place of point-in-time audits, to a narrower third-party requirement applied only to higher-risk programs. The RFI's interest in how the department might recognize commercial cybersecurity tools and managed services already in use points toward the middle option, though nothing has been decided.

What is not plausible is that the underlying security expectation goes away. The department has been explicit that it is reducing certification burden, not lowering the cybersecurity baseline. Texas suppliers who use this window to genuinely harden their environments, rather than to stop, will be the ones who can bid without a scramble when the replacement lands. Firms without dedicated security leadership often bridge this gap with a fractional vCISO rather than hiring for it.

Until the task force report is public, three things deserve a standing calendar reminder:

• Your SPRS score's accuracy. If it reflects an aspirational environment rather than your real one, fix the score or fix the environment before a relator or a prime's audit team asks.
• Flow-down language from primes. Some prime contractors are keeping contractual CMMC language even where the Department has removed the third-party requirement. Read your renewals rather than assuming the suspension trickles down automatically.
• Any public release from the CMMC Reform Task Force, and any new revision of class deviation 2026-O0025. Between them, those two documents are where the replacement for Phase 2 will first show up.

A practical roadmap for the control families likely to survive any rewrite is the same one behind our CIS Controls implementation groups guide: access control, logging and vulnerability management carry the most weight in every version of this framework the Department has floated.

Does the CMMC Phase 2 suspension mean I can stop my compliance project?

No. Phase 1 self-assessment requirements remain firmly in place. DFARS 252.204-7012, 7019, 7020 and 7021 still apply, your SPRS score must be current, and the department will continue enforcing NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments. Only the mandatory C3PAO third-party assessment trigger scheduled for November 10, 2026 was suspended.

Should I cancel a C3PAO assessment I already scheduled?

Talk to the assessor about deferral terms rather than cancellation, and check whether a prime contract independently requires certification. If you are voluntarily pursuing Level 2 to differentiate yourself, completing it still has competitive value. What we advise against is signing new multi-year assessment commitments before the task force report is public and the Department says what replaces Phase 2. The 60-day window closed on September 11, 2026, and the report hadn't been released as of this update.

Can I still be sued over my SPRS score during the suspension?

Yes, and this is the sharpest risk in the current environment. The LOGZONE settlement announced in June 2026 resolved False Claims Act allegations for $507,144 over a self-reported score of 110 that a DCMA assessment later put at -170 (U.S. Department of Justice; settlement agreement). Suspending third-party audits doesn't suspend the False Claims Act.

What should a Houston-area shop prioritize in the next 60 days?

Multifactor authentication everywhere, FIPS-validated encryption on CUI, working audit logging with retention, a documented CUI boundary, and an honest recalculated SPRS score with a dated System Security Plan. These are the items that carry the heaviest scoring weight and the heaviest legal exposure. Our Houston cybersecurity services team scopes this work as a fixed project.

Does this change anything for subcontractors below Level 2?

Level 1 self-assessment obligations for federal contract information are unchanged, including the annual affirmation. If you flow work down further, your own subcontract clauses should stay as written. The suspension applies to the third-party verification phase, not to flow-down.

When will we know what replaces CMMC Phase 2?

The task force's recommendations were due within 60 days of the July 13, 2026 announcement, which put the deadline at September 11. That date has passed, the report went to the Department CIO, and she decides whether and when it's released. Watch SAM.gov, the DARS class deviation list and the Department of War newsroom rather than planning around a date.

Did the September 3, 2026 class deviation make the suspension permanent?

No. It made the direction to contracting officers formal: they must remove third-party CMMC assessment requirements from solicitations and existing contracts, not merely consider it. It didn't amend 32 CFR Part 170 or the DFARS clauses, and the deviation itself says it stays in effect only until rescinded or incorporated into the FAR and DFARS. A later revision can bring the requirement back without rulemaking.

The suspension is enough time to close MFA gaps, stand up logging, scope a CUI enclave and post a defensible SPRS score. It isn't enough time to start from zero the week the task force report lands if it comes back with a tighter deadline than anyone expects. LayerLogix works with manufacturers, fabricators and engineering firms across Houston, The Woodlands and the Gulf Coast on exactly this work, with 20+ years of experience and 100% Texas-based support. If you want a straight assessment of where your 110 controls actually stand before a prime asks, start with our CMMC compliance services, review our Houston CMMC compliance page, or talk to our Houston IT support team about a scoped readiness review.