The recent suspension of CMMC Phase 2 has raised important questions for defense contractors about what comes next. From third-party assessments and contract eligibility to NIST SP 800-171 requirements and ongoing compliance obligations, organizations are looking for clarity on what the pause means for their business. While uncertainty remains around the future of CMMC Phase 2, existing cybersecurity responsibilities have not disappeared. Here are 10 of the most common questions defense contractors are asking and what they need to know to stay informed, maintain compliance, and move forward with confidence.
1. Is CMMC Going Away?
No. The suspension of CMMC Phase 2 does not mean the CMMC program has been canceled. While the DoD is reviewing the program and its implementation, uncertainty remains about what changes may be made and when Phase 2 requirements will move forward.
For defense contractors, it's important to distinguish between the suspension of a specific implementation phase and the elimination of the CMMC program. Existing cybersecurity and contractual obligations remain in effect where applicable.
2. Do We Still Need to Comply with NIST SP 800-171?
Yes. The CMMC Phase 2 suspension does not eliminate existing cybersecurity obligations. Defense contractors handling Controlled Unclassified Information (CUI) must still meet applicable NIST SP 800-171 requirements under DFARS 252.204-7012.
Organizations should continue implementing and maintaining required security controls, keeping their System Security Plans (SSPs) accurate, and ensuring their SPRS scores are supported by documented evidence.
3. Are SPRS Scores and Self-Assessments Still Required?
Yes. The CMMC Phase 2 suspension does not eliminate existing SPRS reporting and self-assessment obligations. Defense contractors subject to applicable DFARS requirements must continue to maintain accurate NIST SP 800-171 self-assessments and current Supplier Performance Risk System (SPRS) scores.
An SPRS score should accurately reflect the organization's cybersecurity posture and be supported by an up-to-date System Security Plan (SSP) and documented evidence. Contractors should also remember that a submitted score does not eliminate the possibility of a government review or assessment.
4. Will a C3PAO Assessment Still Be Required Eventually?
Third-party C3PAO assessments were scheduled to become part of CMMC Phase 2, which is currently paused. The suspension has raised questions about when these assessments will be required and whether changes will be made to the current assessment process
5. Should We Stop Preparing for Our CMMC Assessment?
No. A pause in CMMC Phase 2 does not mean contractors should pause their compliance efforts. Organizations handling Controlled Unclassified Information (CUI) must still meet applicable NIST SP 800-171 requirements and maintain an accurate, defensible compliance posture.
This is an opportunity to continue addressing security gaps, strengthening documentation, validating implemented controls, and ensuring your organization is prepared to demonstrate compliance.
6. Can I Still Win DoD Contracts Without CMMC Certification?
Yes, depending on the specific solicitation and contract requirements. The CMMC Phase 2 suspension has created uncertainty around when third-party certification requirements will apply. Contractors should carefully review solicitation language to understand what cybersecurity and CMMC requirements are currently applicable. Subcontractors should also communicate with their prime contractors to understand any cybersecurity or compliance requirements that may be imposed as a condition of doing business.
7. Can a Prime Contractor Require CMMC Readiness Even if the DoD Isn't Enforcing It?
Yes. Prime contractors can establish cybersecurity requirements for their subcontractors, regardless of the CMMC Phase 2 suspension. Depending on the contract, prime contractors may require NIST SP 800-171 compliance, accurate SPRS scores, or evidence of CMMC readiness before awarding subcontract work.
Even during the CMMC Phase 2 suspension, prime contractors can make cybersecurity readiness a condition of doing business.
8. Does the Pause Increase False Claims Act Risk?
The CMMC Phase 2 suspension does not eliminate potential False Claims Act (FCA) liability. Defense contractors can still face legal exposure if they knowingly submit inaccurate cybersecurity self-assessments, SPRS scores, or compliance representations to the government.
Under the Department of Justice's Civil Cyber-Fraud Initiative, cybersecurity misrepresentations can lead to False Claims Act enforcement. Contractors should ensure their reported compliance posture accurately reflects the security controls implemented and the evidence supporting those claims.
9. What Should We be Doing During the Pause?
The CMMC Phase 2 suspension is not a reason to put cybersecurity and compliance efforts on hold. Defense contractors should continue strengthening their NIST SP 800-171 compliance, maintaining accurate System Security Plans (SSPs), addressing security gaps, and documenting evidence of implemented controls.
Rather than waiting for further guidance from DoD, organizations can use this time to strengthen their cybersecurity posture and build a sustainable compliance program. Compliance should be an ongoing process, not simply preparation for a one-time assessment. This approach supports long-term security and compliance readiness, regardless of how CMMC requirements evolve.
10. What Should We Be Doing Right Now?
The best approach is to stay focused on the cybersecurity and compliance requirements within your control. While awaiting further guidance from DoD, defense contractors should prioritize the following actions:
- Close compliance gaps: Continue addressing outstanding NIST SP 800-171 requirements and implementing necessary security controls.
- Maintain accurate documentation: Keep your System Security Plan (SSP) and Plan of Action and Milestones (POA&M) current and aligned with your environment.
- Validate SPRS scores: Ensure reported scores accurately reflect implemented controls and are supported by evidence.
- Maintain assessment readiness: Organize supporting documentation and regularly validate that security controls are operating as intended.
- Monitor contractual requirements: Review DoD announcements, solicitation language, and prime contractor expectations for changes that may affect your organization.
Staying the Course on CMMC Compliance
CMMC compliance is not a one-time assessment or a check-the-box exercise. It requires an ongoing commitment to maintaining security controls, accurate documentation, and a defensible compliance posture. Even during the Phase 2 suspension, prime contractors may require subcontractors to demonstrate CMMC Level 2 readiness or meet specific cybersecurity requirements as a condition of doing business. In addition, inaccurate cybersecurity representations can still expose contractors to potential False Claims Act liability.
Now is the time to stay the course, not put compliance efforts on hold. By continuing to strengthen cybersecurity practices and maintain compliance readiness, defense contractors can protect their organizations, support contractual obligations, and move forward with confidence.
At CorpInfoTech, we help defense contractors turn complex compliance requirements into a structured, sustainable process through our five-step roadmap: Define → Assess → Implement → Validate → Maintain. Our approach focuses on more than preparing for an assessment. It helps organizations establish and maintain the cybersecurity practices, documentation, and operational discipline needed for long-term compliance.
Key Takeaways: What Defense Contractors Need to Know
- CMMC is not going away. The Phase 2 suspension does not eliminate existing cybersecurity and compliance obligations.
- NIST SP 800-171 requirements remain in effect. Contractors must continue meeting applicable DFARS cybersecurity requirements.
- SPRS scores and self-assessments still matter. Reported compliance must be accurate, current, and supported by evidence.
- Prime contractors can establish cybersecurity requirements. Subcontractors may still be expected to demonstrate CMMC Level 2 readiness to remain eligible for opportunities.
- False Claims Act exposure remains. Inaccurate cybersecurity representations can create legal and financial risks.
- Compliance is an ongoing responsibility. Maintaining security controls and documentation is essential beyond any single assessment.
- Stay the course. Use this time to strengthen your cybersecurity posture and maintain compliance readiness rather than waiting for further DoD announcements.
CorpInfoTech, a Managed Service Provider (MSP) with over 25 years in the SMB space, is a trusted partner for business pursuing compliance and cybersecurity. We are a CMMC Level 2 certified MSP and a Cyber AB Registered Provider Organization (RPO). Also, as the first CIS accredited organization, we help organizations implement the CIS controls as it pertains to CMMC and your overall cybersecurity posture. CorpInfoTech is your trusted partner for secure, compliant growth in every changing digital landscape.
