Industries · Defence suppliers

CMMC is paused.The obligation isn’t.CPCSC,in plain language.

In July the Department of Defense suspended CMMC Phase 2, and in September it made that suspension binding. The third-party assessment you were told to prepare for is, for now, being stripped out of contracts. What did not go away is the security requirement underneath it — or your exposure if you attest to something you cannot support.

If a defence contract just came back with security requirements attached — CPCSC, a Security Requirements Check List, or a US prime asking about CMMC — and you have never had a security program, this page is for you. It is the written version of a conversation we have most weeks.

No pitch, and nothing held back for the call. If you read this and handle it yourself, that is a good outcome.

Where this stands

Current as of21 September 2026

CMMC is mid-reform, and the reporting around it is contradictory. The dated record:

13 Jul 2026The DoD CIO suspends CMMC Phase 2, which had been due to begin 10 November 2026. Phases 3 and 4 are frozen. The stated reason is assessment capacity and cost — not that the security requirements were wrong.
3 Sep 2026A class deviation directs contracting officers to remove CMMC third-party assessment requirements from contracts. This moves the pause from policy memo to binding acquisition instrument, which makes it harder to reverse than a suspension would have been.
~11 Sep 2026The CMMC Reform Task Force delivers its recommendations to the DoD CIO. Publication is at her discretion and had not happened when this page was last updated.
NowPhase 1 stands. Self-attestation against NIST SP 800-171 is still required, and the contract clauses that created the obligation are still in your contracts.

The Canadian programme is not affected by the US suspension. The dated record on both sides of the border:

OngoingCPCSC certification is being introduced into Canadian defence procurement for contracts involving sensitive information. Nothing in the US suspension changes it.
OngoingThe Controlled Goods Program remains a separate legal requirement, satisfied by registration rather than by any cyber certification.
3 Sep 2026On the US side, CMMC third-party assessment requirements are being stripped from contracts under a class deviation. If you subcontract to a US prime, this affects the assessment — not the underlying obligation to protect the data.

Why do I have to do this when my competitors aren’t?

Because you already agreed to it, and that part was never suspended. If your contracts carry DFARS 252.204-7012 — and they have carried it since 2017 — you committed to implementing the 110 security requirements in NIST SP 800-171 and to reporting an incident within 72 hours. CMMC did not create that obligation. CMMC was the part where somebody else checked, and it is the checking that has been paused.

That distinction is the whole story right now, and most of the commentary is getting it backwards. Removing the assessor does not reduce your risk. It relocates it. Under CMMC you would have failed an assessment and been given findings to fix. Under a self-attestation regime, the same gap is a statement you made to the government that was not true — and the Justice Department has been prosecuting exactly that under the False Claims Act since 2021. Fewer people checking your work is not the same as less exposure.

Your competitors fall into four groups now. Some genuinely do not hold regulated data and have a much lower bar than they have been told. Some have not yet bid on a contract carrying the clause. Some have read "paused" as "cancelled" and stopped. And some are carrying a score in SPRS they could not defend if anyone asked. Only the first group is actually fine.

Primes are a separate matter entirely. What the government suspends does not bind your customer. A prime whose own obligations flow down to you can, and does, write security requirements into subcontracts on its own schedule.

Because the requirement travels with the contract, and it is arriving from two directions at once. Canadian defence procurement is introducing CPCSC certification for contracts involving sensitive information. Separately, if you subcontract to a US prime and touch US Controlled Unclassified Information, the underlying obligation reaches you directly — Canadian residency does not exempt you from an American contract clause.

Suppliers who appear to be ignoring it are usually either genuinely out of scope, or have not yet bid on a contract that carries the requirement. Neither is a strategy you can copy, because the requirement is attached to the work rather than to the company.

The asymmetry that matters: certification cannot be bought at bid time. Scoping, remediation, and an assessor’s calendar take months. "My competitor isn’t doing it" tends to resolve, a year later, into "my competitor can’t bid."

The part most vendors won’t tell you

Plenty of suppliers scope the whole company when a single enclave would have done, and spend accordingly. If you only ever hold Federal Contract Information and never Controlled Unclassified Information, your obligation is the basic safeguarding set — far short of the 110. Establishing which of those two you are is the cheapest hour you will spend on this, and it is the first thing we do. It is also the question the pause has not changed at all.

Plenty of suppliers scope the whole company when a single enclave would have done, and spend accordingly. The level you owe depends on what the contract actually puts in your hands, and the lowest tier is a self-assessment rather than a third-party certification. Establishing which tier you are in is the cheapest hour you will spend on this, and it is the first thing we do.

Is the data I have really regulated?

Two places to look, and they answer different halves of the question. Start with the contracts, because they tell you what you promised. Then look at what is actually sitting on your shop floor, because that tells you what you hold. Nothing in the suspension changes either answer.

Look at your contracts

Search your executed contracts and purchase orders for these clause numbers. Each one tells you something specific:

FAR 52.204-21: Basic safeguarding. You hold Federal Contract Information. This is the floor, and it is unaffected by the CMMC suspension.
DFARS 252.204-7012: The one that matters most right now. You have agreed to protect Covered Defense Information, implement NIST SP 800-171, and report incidents within 72 hours. It predates CMMC by seven years and did not go anywhere.
DFARS 252.204-7019 / -7020: A current NIST SP 800-171 self-assessment score posted in SPRS, and government access to verify it. This is the attestation your exposure now rests on.
DFARS 252.204-7021: The CMMC clause. Under the September class deviation, contracting officers are removing its third-party assessment requirements from contracts. If you see it in an older contract, ask your contracting officer what still applies.

Search your executed contracts and purchase orders for these. Each one tells you something specific:

Security Requirements Check List (SRCL): The form attached to the contract that states what security the work requires. If an SRCL is attached, read it first — it is the authoritative statement of what you are being asked to protect.
Controlled Goods: If the work involves controlled goods or controlled technology, registration in the Controlled Goods Program is a separate legal requirement, and it is not satisfied by any cyber certification.
CPCSC certification requirement: The clause naming the certification level the contract requires. It is a condition of award rather than something to finish afterwards.
US flow-down clauses: If your customer is a US prime, look for DFARS 252.204-7012 in the subcontract. It flows down to you regardless of where you are incorporated, and it is not affected by the CMMC suspension.

Look at your documents

Walk the shop floor and the shared drive. You are looking for the difference between two categories:

Drawings and specifications carrying a distribution statement — anything other than "Distribution A" is a signal.
Anything marked CUI, or carrying the legacy FOUO marking that predates it.
Export-controlled technical data under ITAR or EAR, including drawings you received to quote work you did not win.
Tolerances, test results, inspection data, and process specs tied to a military end item.
By contrast, Federal Contract Information is the ordinary non-public paperwork of the contract — delivery schedules, purchase order details, correspondence. Real, protected, but a much lower bar.

Walk the shop floor and the shared drive. You are looking for what the contract told you to protect, actually sitting somewhere:

Anything carrying a Protected A, Protected B, or Classified designation.
Drawings and specifications carrying a distribution statement, including US-origin drawings received to quote work.
Export-controlled technical data, including US-origin data subject to ITAR or EAR.
Controlled goods and the technical data that describes them.
Tolerances, test results, inspection data, and process specs tied to a military end item.

Unmarked does not mean unregulated

Marking data correctly is the government’s job, and it is done inconsistently. We regularly find regulated drawings that arrived with no marking at all, and unregulated ones marked out of caution. If you are not certain what a document is, ask your contracting officer in writing and keep the answer. A written determination is evidence; an assumption is not.

When do I have to do this by?

The honest answer changed in July. There is no longer a third-party assessment date to work backwards from — which is exactly why this question is now harder, not easier, to answer well.

The requirement is being phased into procurement rather than switched on at a single date. What matters to you is not the phase — it is which one your next bid lands in.

What is required of you today

A NIST SP 800-171 self-assessment that reflects how you actually operate, with a score in SPRS you could defend line by line.
The safeguarding obligations in DFARS 252.204-7012, including the 72-hour incident reporting path. Know who makes that report and how, before you need to.
Whatever your prime has written into your subcontract, which may be more than the government currently requires and is not suspended by anything DoD did.

The certification level named in your contract, at the point of award rather than afterwards.
Controlled Goods Program registration, where the work involves controlled goods.
Whatever a US prime has written into your subcontract, including obligations that survive the US assessment pause.

The date that actually governs you

Two of them, and neither is on a government calendar. The first is your next bid, because a prime can impose its own security terms whenever it likes. The second is whenever the reform lands — and a supplier starting from nothing should plan on twelve to eighteen months to build a program that would survive scrutiny. If the reformed requirement arrives inside that window, the pause will have been the time you had, not a reprieve.

Work backwards from the contract you intend to win, not forwards from today. Between scoping, closing the gaps that require real engineering, producing evidence that holds up, and getting onto an assessor’s calendar, a supplier starting from nothing should plan on twelve to eighteen months. If the contract you care about is inside that window, the clock has already started.

What is this actually going to look like?

Three jobs, done by three parties. One of the three is currently suspended, and understanding why it was ever separate tells you most of what you need to know about what comes back.

Three separate jobs, done by three separate parties. Most first-timers expect to hire one company for all of it, and are surprised to learn that they are not allowed to.

The advisory work

Scoping, the gap assessment, the System Security Plan, the POA&M, policies, evidence, and readiness. This is the part we own, and with no assessor in the loop it is now the only thing standing between an optimistic score and a false claim.

The engineering

The technical change itself: segmentation or a dedicated enclave, multi-factor authentication, logging and monitoring, validated encryption, and decisions about where regulated data is allowed to live. We plan it and stay accountable for it; where specialist hands are needed, we bring partners who do this work daily rather than learn on your contract.

The assessment — suspended

An accredited third-party assessor reviewing you against the standard. That requirement is being stripped from contracts, and the shortage of assessment capacity is one of the reasons the programme was paused. Note what has not changed: an assessor may not certify an organization it also consulted for. Whatever the reformed programme looks like, that independence line is why preparing you and judging you were never the same job.

The advisory work

Scoping, the gap assessment, the System Security Plan, the POA&M, policies, evidence, and readiness. This is the part we own, and it is the part that decides how expensive the other two are.

The engineering

The assessment

An accredited assessor reviews you against the standard. It cannot be us, and it cannot be anyone who consulted on your program — assessor independence is a rule, not a preference. We prepare you for it, sit with you through it, and handle the findings.

The order it happens in

Scope it. Decide what actually holds regulated data — and, more importantly, what does not. An enclave that covers one department is a different project from securing an entire company.
Assess the gap honestly. Measure against all 110 requirements and produce a defensible score rather than a flattering one. This is the step the pause made more important, not less.
Fix the score in SPRS. If what is posted today does not match what you could prove, correct it. That is a smaller problem now than it becomes later.
Remediate. The engineering work, sequenced so the expensive items start early and the cheap ones do not block them.
Write the evidence down. The System Security Plan describes how your organization actually operates. It is what an investigator reads, and for now it is also the only thing standing in for an assessment.
Keep it true. Programs decay between milestones, and there is no longer a scheduled milestone to catch the decay.
Watch the reform. When the replacement programme is published, the gap between what you have and what it asks for is the only number that matters. We track it so you do not have to.

Scope it. Decide what actually holds regulated data — and, more importantly, what does not. An enclave that covers one department is a different project from certifying an entire company.
Assess the gap honestly. Measure against the standard and produce a defensible result rather than a flattering one.
Remediate. The engineering work, sequenced so the expensive items start early and the cheap ones do not block them.
Write the evidence down. The System Security Plan describes how your organization actually operates. An assessor reads it, then goes looking for proof.
Readiness check, then assessment. We run the assessment before the assessor does, so nothing in the real one is a surprise.
Keep it. A certification cycle rewards a program that stays true between assessments rather than being rebuilt for each one.

The expensive mistakes

Reading "paused" as "cancelled"

The assessment was suspended. The contract clause that obligates you, and the attestation you have already made, were not. This is the most expensive misreading available right now.

Posting a score you cannot defend

With no assessor in the loop, your SPRS score is a statement to the government rather than a starting position for a review. That is a different kind of risk, and a worse one.

Assuming your IT provider has it covered

Most managed providers are not equipped for this, and a provider handling your regulated data is itself in scope. Ask yours directly, in writing, what they are attesting to.

Assuming your cloud provider’s certification is yours

It covers their half of a shared responsibility model. Configuration, access, and evidence remain yours, and that is where scrutiny turns.

Standing down the program

The work takes longer than the notice period will be. Suppliers who stop now will restart from behind, against a deadline they do not get to choose.

Buying tools before scoping

Scope determines what you need. Bought in the other order, you pay for coverage across systems that should never have been in scope.

Assuming the US pause applies to you

It does not. The Canadian programme is separate, and a US prime’s flow-down obligations are separate again.

Assuming your IT provider has it covered

Most managed providers are not equipped for this, and a provider handling your regulated data is itself in scope. Ask yours directly, in writing, what they are attesting to.

Assuming your cloud provider’s certification is yours

It covers their half of a shared responsibility model. Configuration, access, and evidence remain yours, and that is where assessments turn.

Treating the SSP as a writing exercise

It is a description of reality. If it describes something you do not actually do, you have documented your own finding.

Where we would start

With two questions: what your contracts actually obligate you to, and whether the score you have already posted would survive being read closely. The Compliance Readiness Snapshot is a free 30-minute readout covering both, plus what the reform is likely to mean for you. No pitch, and useful whether or not you ever hire us.

With the scoping question, because every number downstream depends on it. The Compliance Readiness Snapshot is a free 30-minute readout: what your contracts actually obligate you to, which level you are facing, and what the first three moves are. No pitch, and useful whether or not you ever hire us.

Find out what you’re actually on the hook for — in 30 minutes.

Request your Snapshot