The Pentagon Just Suspended CMMC Phase 2 — What Texas Defense Suppliers Should Do With the Next 60 Days

Phase 2 was scheduled to begin on November 10, 2026. From that date, DoD solicitations covering controlled unclassified information would have required a certified third-party assessment before award. That trigger is now suspended, and the announcement holds pending and future CMMC implementation milestones in abeyance across Department of War solicitations and contracts until further notice.

The stated rationale from Department of War Chief Information Officer Kirsten Davies was cost and arithmetic. The memo describes the current CMMC program as structurally incompatible with the need to rapidly expand the defense industrial base, and points to significant and often prohibitive burdens on small, medium and non-traditional contractors. Figures cited in the announcement put the annual cost for small and mid-sized businesses to achieve compliance approvals at roughly $7 billion.

Then there is the capacity problem. More than 100,000 defense industrial base companies would have needed third-party assessments. Roughly 100 authorized Certified Third-Party Assessment Organizations (C3PAOs) exist to perform them. In Davies' own words, "the math just simply doesn't math for small to medium-sized businesses to even get compliant by the transition date."

The same memo stood up a CMMC Reform Task Force reporting to the Department CIO. The review took effect immediately with the July 13 announcement, and the task force held its first meeting on July 17, 2026. It draws leadership from acquisition and sustainment, intelligence and security, the Office of the CIO, general counsel, public affairs and legislative affairs, plus the Small Business Administration and the White House.

Its mandate is to reduce those burdens on the defense industrial base, lower barriers for small, medium and non-traditional businesses, and explore scalable, realistic security measures that could replace the current third-party compliance model. A public Request for Information posted to SAM.gov is collecting industry input on cost drivers, administrative burden, which NIST SP 800-171 Revision 2 controls actually reduce risk, and how the department might recognize commercial security tools and managed services already in use. Responses are due by 12:00 p.m. Eastern on Friday, August 14, 2026.

Recommendations are due within 60 days of the July 13 announcement, which lands around mid-September 2026. Davies has indicated the task force expects roughly another two weeks to synthesize its findings, with a public report and recommendations following shortly after. Treat mid-September as the earliest date, not a guaranteed publication date.

Read the release carefully and one sentence does all the work: all Phase 1 self-assessment requirements remain firmly in place. Phase 1 was never suspended. What was suspended is the escalation from self-attestation to independent verification.

During the review period, the department says it will continue enforcing NIST SP 800-171 Revision 2 through CMMC Level 1 and Level 2 self-assessments and select government-led assessments, and all other contractual cybersecurity clauses remain intact. DCMA's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) did not lose its assessment authority on July 13. The C3PAO third-party assessment delay removes a scheduling problem and a line item. It removes nothing from your security obligations.

Every DFARS 252.204-7012 obligation survives. You still safeguard covered defense information. You still implement the 110 controls in NIST SP 800-171 Rev. 2. You still maintain a System Security Plan and a Plan of Action and Milestones, and under DFARS 252.204-7019 and 252.204-7020 you still post and keep current a NIST SP 800-171 self-assessment SPRS score in the Supplier Performance Risk System.

That score is not a marketing number. It is a representation to the government, calculated on a scale that tops out at 110 and can run deeply negative when high-weight controls are missing. If your last SPRS entry is more than a year old, or predates a network refresh, a Microsoft 365 tenant migration or an acquisition, it is stale and it is still binding. Refresh it. Our NIST 800-171 compliance walkthrough covers how the scoring methodology penalizes the controls most shops skip first.

The 48 CFR final rule published September 10, 2025 took effect on November 10, 2025. Since then, contracting officers have been authorized to insert DFARS clause 252.204-7021, along with the solicitation provision at 252.204-7025, into applicable solicitations, contracts, task orders and delivery orders. The DFARS 252.204-7021 requirement for Level 1 and Level 2 self-assessment and annual affirmation by a senior company official persists through the suspension.

If your contract already carries 7021 at Level 1 or Level 2 self-assessment, nothing changed for you. Your affirming official still signs. Practically, this means the flow-down to your own subcontractors still needs to happen, and the clause language in quotes you send out this quarter should not be edited to reflect a suspension that does not apply to Phase 1.

This is the part that should keep a shop owner up at night. With third-party verification suspended, the government's primary enforcement lever is the False Claims Act cybersecurity attestation theory, and DOJ has been actively using it.

In June 2026, LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve allegations that it knowingly failed to implement required NIST SP 800-171 controls on two Department of the Navy contracts. The detail that matters: LOGZONE reported a perfect self-assessment score of 110 in SPRS in October 2021. When DCMA assessed the environment in February 2024, the score came back at -170, near the bottom of the scoring range. That gap between the attested number and the audited reality is the entire case. Of the settlement, $253,572 was restitution, meaning the government applied a two-times multiplier.

A suspended audit regime does not reduce this exposure. It concentrates it, because self-attestation is now the whole ballgame and whistleblower relators are paying attention.

Practical Gulf Coast defense supply chain compliance work for a Houston fabricator, a Beaumont refinery services contractor or an aerospace supplier near Ellington Field and the Johnson Space Center should look like this between now and mid-September.

• Keep executing the 110-control remediation plan on schedule. Every control you close is a control you do not have to close under deadline pressure when the framework returns in some form.
• Refresh the SPRS score and date it. Recalculate honestly, including negatives. A defensible 62 beats an indefensible 110.
• Close the highest-weight POA&M gaps first. In practice that means multifactor authentication on all remote and privileged access, FIPS-validated encryption for CUI at rest and in transit, centralized audit logging with actual retention, and documented privileged access controls with separation of duties.
• Define and document the CUI boundary. A scoped enclave, whether GCC High, a segmented VLAN for the shop floor, or a dedicated engineering environment, is the single biggest cost lever in any future assessment. Scope work done now pays off regardless of what the task force recommends.
• Do not sign a C3PAO slot or a multi-year assessment contract yet. Published market estimates have commonly put C3PAO Level 2 assessment fees for a well-scoped small business somewhere in the $25,000 to $75,000 range, with readiness and remediation work frequently costing more than the assessment itself. Nothing requires you to commit that spend before the report lands. Deposits made now may buy an assessment against a framework that no longer exists by the fall.

What to Tell a Prime That Asks About Your Certification Status This Quarter

Give them facts, not a shrug. A clean answer sounds like this: our current SPRS self-assessment score is X as of [date], posted under CAGE code [code]; our System Security Plan is current as of [date]; we have an active POA&M with [n] open items and target closure dates; our senior affirming official is [name]; and we are complying with all Phase 1 DFARS 252.204-7021 obligations. We have paused scheduling a C3PAO assessment pending the CMMC Reform Task Force report, consistent with the July 13, 2026 suspension.

That answer keeps you on the bid list. "We were waiting on CMMC" does not.

The honest read on the CMMC Level 2 timeline 2026 is that nobody outside the task force knows the endpoint. The plausible outcomes range from a rescoped control set with fewer mandatory items, to broader acceptance of commercial security certifications and continuous monitoring evidence in place of point-in-time audits, to a narrower third-party requirement applied only to higher-risk programs. The RFI's interest in how the department might recognize commercial cybersecurity tools and managed services already in use points toward the middle option, though nothing has been decided.

What is not plausible is that the underlying security expectation goes away. The department has been explicit that it is reducing certification burden, not lowering the cybersecurity baseline. Texas suppliers who use this window to genuinely harden their environments, rather than to stop, will be the ones who can bid without a scramble in Q4. Firms without dedicated security leadership often bridge this gap with a fractional vCISO rather than hiring for it.

Does the CMMC Phase 2 suspension mean I can stop my compliance project?

No. Phase 1 self-assessment requirements remain firmly in place. DFARS 252.204-7012, 7019, 7020 and 7021 still apply, your SPRS score must be current, and the department will continue enforcing NIST SP 800-171 Rev. 2 through self-assessments and select government-led assessments. Only the mandatory C3PAO third-party assessment trigger scheduled for November 10, 2026 was suspended.

Should I cancel a C3PAO assessment I already scheduled?

Talk to the assessor about deferral terms rather than cancellation, and check whether a prime contract independently requires certification. If you are voluntarily pursuing Level 2 to differentiate yourself, completing it still has competitive value. What we advise against is signing new multi-year assessment commitments before the task force reports, which is expected in the mid-September to early-fall 2026 window.

Can I still be sued over my SPRS score during the suspension?

Yes, and this is the sharpest risk in the current environment. The LOGZONE settlement announced in June 2026 resolved False Claims Act allegations for $507,144 over a self-reported score of 110 that DCMA later assessed at -170. Suspending third-party audits does not suspend the False Claims Act.

What should a Houston-area shop prioritize in the next 60 days?

Multifactor authentication everywhere, FIPS-validated encryption on CUI, working audit logging with retention, a documented CUI boundary, and an honest recalculated SPRS score with a dated System Security Plan. These are the items that carry the heaviest scoring weight and the heaviest legal exposure. Our Houston cybersecurity services team scopes this work as a fixed project.

Does this change anything for subcontractors below Level 2?

Level 1 self-assessment obligations for federal contract information are unchanged, including the annual affirmation. If you flow work down further, your own subcontract clauses should stay as written. The suspension applies to the third-party verification phase, not to flow-down.

When will we know what replaces CMMC Phase 2?

The task force's recommendations are due within 60 days of the July 13, 2026 announcement, which points to mid-September. Davies has said the group expects roughly two additional weeks to synthesize findings before a public report. Watch SAM.gov and the Department of War newsroom rather than planning around a firm date.

Sixty days is enough time to close MFA gaps, stand up logging, scope a CUI enclave and post a defensible SPRS score. It is not enough time to start from zero in October if the task force comes back with a tighter deadline than anyone expects. LayerLogix works with manufacturers, fabricators and engineering firms across Houston, The Woodlands and the Gulf Coast on exactly this work, with 20+ years of experience and 100% Texas-based support. If you want a straight assessment of where your 110 controls actually stand before a prime asks, start with our CMMC compliance services, review our Houston CMMC compliance page, or talk to our Houston IT support team about a scoped readiness review.