If you hold or chase DoD work in Northern Virginia, you have probably heard some version of “CMMC is dead.” It isn't. Here is what actually happened, what is still legally binding on your company today, and why roughly half the Defense Industrial Base is pressing ahead with preparation anyway — including the part of the supply chain that sits between the Pentagon, Fort Belvoir, and Quantico.
What actually happened in July
On July 13, 2026, the Department of War announced an immediate suspension of the CMMC Phase 2 rollout — the stage of the 48 CFR phase-in that was scheduled to start putting third-party (C3PAO) Level 2 certification requirements into new solicitations on November 10, 2026. A follow-up memo on July 14 directed contracting activities to amend active solicitations and contracts that already carried Level 2 C3PAO or Level 3 assessment requirements to remove them during the suspension.
Alongside the suspension, the Department’s CIO stood up a CMMC Reform Task Force to run a top-to-bottom review of the certification program, feed in industry comments gathered through a public Request for Information, and deliver a report within 60 days. As of mid-October 2026, no revised Phase 2 date has been announced.
What did not change (this is the part that bites)
The pause suspended a contract clause rollout. It did not suspend a single underlying cybersecurity obligation. If your contracts carry DFARS 252.204-7012 — and nearly every CUI-touching DoD contract does — you are contractually required to implement NIST SP 800-171 today, pause or no pause.
- DFARS 252.204-7012 safeguarding obligations: unaffected and fully in force.
- Phase 1, in effect since November 10, 2025: Level 1 self-assessments for FCI and Level 2 self-assessments with affirmations for CUI continue to appear in solicitations.
- Your SPRS score: still required, still expected to be current — and still a False Claims Act exposure if it is inflated. The Department of Justice’s Civil Cyber-Fraud Initiative has already pursued contractors over cybersecurity misstatements, and false Phase 1 self-attestations are squarely in its lane.
- Prime flowdowns: a prime can require CMMC Level 2 certification from its subs contractually, right now, regardless of what the FAR clause timeline says. Several large primes are doing exactly that.
In other words: the government paused its enforcement mechanism, not your obligations. For a deeper look at who owes what, see Who needs CMMC in Northern Virginia?.
Why half the DIB is not slowing down
Industry reporting in mid-October found that almost half of defense contractors are continuing their CMMC programs despite the pause. That is not compliance enthusiasm — it is queue math and contract math.
- Realistic Level 2 preparation runs 6–18 months. If Phase 2 resumes on a new date, the companies that paused will be starting from the back of the line — for remediation vendors and for C3PAO calendars.
- Primes in the DC metro are already using certification status as a discriminator when they pick subs. A certificate (or a credible, evidenced self-assessment) wins work during the pause, not after it.
- Remediation done calmly is cheaper than remediation done against a deadline. The pause is the cheapest window you will ever get.
The sensible NoVA playbook for the pause
- Keep your SPRS self-assessment current and honest — it is the live legal exposure.
- Ask your primes, in writing, what they will require from subcontractors and when. Build to that, not to rumor.
- Use the window to fix the expensive, slow items: scoping decisions, enclave design (including Microsoft 365 GCC High where it fits), MFA and FIPS-validated encryption, logging.
- Keep your evidence organized as you go, so whichever date lands next, the assessment is an administrative event rather than a scramble.
If you want the full picture of what the work costs with and without an enclave, we broke the 2026 numbers down in What CMMC Level 2 actually costs.