The recent suspension of CMMC Phase 2 has raised important questions for defense contractors about what comes next. From third-party assessments and contract eligibility to NIST SP 800-171 requirements and ongoing compliance obligations, organizations are looking for clarity on what the pause means for their business. While uncertainty remains around the future of CMMC Phase 2, existing cybersecurity responsibilities have not disappeared. Here are 10 of the most common questions defense contractors are asking and what they need to know to stay informed, maintain compliance, and move forward with confidence.
No. The suspension of CMMC Phase 2 does not mean the CMMC program has been canceled. While the DoD is reviewing the program and its implementation, uncertainty remains about what changes may be made and when Phase 2 requirements will move forward.
For defense contractors, it's important to distinguish between the suspension of a specific implementation phase and the elimination of the CMMC program. Existing cybersecurity and contractual obligations remain in effect where applicable.
Yes. The CMMC Phase 2 suspension does not eliminate existing cybersecurity obligations. Defense contractors handling Controlled Unclassified Information (CUI) must still meet applicable NIST SP 800-171 requirements under DFARS 252.204-7012.
Organizations should continue implementing and maintaining required security controls, keeping their System Security Plans (SSPs) accurate, and ensuring their SPRS scores are supported by documented evidence.
Yes. The CMMC Phase 2 suspension does not eliminate existing SPRS reporting and self-assessment obligations. Defense contractors subject to applicable DFARS requirements must continue to maintain accurate NIST SP 800-171 self-assessments and current Supplier Performance Risk System (SPRS) scores.
An SPRS score should accurately reflect the organization's cybersecurity posture and be supported by an up-to-date System Security Plan (SSP) and documented evidence. Contractors should also remember that a submitted score does not eliminate the possibility of a government review or assessment.
Third-party C3PAO assessments were scheduled to become part of CMMC Phase 2, which is currently paused. The suspension has raised questions about when these assessments will be required and whether changes will be made to the current assessment process
No. A pause in CMMC Phase 2 does not mean contractors should pause their compliance efforts. Organizations handling Controlled Unclassified Information (CUI) must still meet applicable NIST SP 800-171 requirements and maintain an accurate, defensible compliance posture.
This is an opportunity to continue addressing security gaps, strengthening documentation, validating implemented controls, and ensuring your organization is prepared to demonstrate compliance.
Yes, depending on the specific solicitation and contract requirements. The CMMC Phase 2 suspension has created uncertainty around when third-party certification requirements will apply. Contractors should carefully review solicitation language to understand what cybersecurity and CMMC requirements are currently applicable. Subcontractors should also communicate with their prime contractors to understand any cybersecurity or compliance requirements that may be imposed as a condition of doing business.
Yes. Prime contractors can establish cybersecurity requirements for their subcontractors, regardless of the CMMC Phase 2 suspension. Depending on the contract, prime contractors may require NIST SP 800-171 compliance, accurate SPRS scores, or evidence of CMMC readiness before awarding subcontract work.
Even during the CMMC Phase 2 suspension, prime contractors can make cybersecurity readiness a condition of doing business.
The CMMC Phase 2 suspension does not eliminate potential False Claims Act (FCA) liability. Defense contractors can still face legal exposure if they knowingly submit inaccurate cybersecurity self-assessments, SPRS scores, or compliance representations to the government.
Under the Department of Justice's Civil Cyber-Fraud Initiative, cybersecurity misrepresentations can lead to False Claims Act enforcement. Contractors should ensure their reported compliance posture accurately reflects the security controls implemented and the evidence supporting those claims.
The CMMC Phase 2 suspension is not a reason to put cybersecurity and compliance efforts on hold. Defense contractors should continue strengthening their NIST SP 800-171 compliance, maintaining accurate System Security Plans (SSPs), addressing security gaps, and documenting evidence of implemented controls.
Rather than waiting for further guidance from DoD, organizations can use this time to strengthen their cybersecurity posture and build a sustainable compliance program. Compliance should be an ongoing process, not simply preparation for a one-time assessment. This approach supports long-term security and compliance readiness, regardless of how CMMC requirements evolve.
The best approach is to stay focused on the cybersecurity and compliance requirements within your control. While awaiting further guidance from DoD, defense contractors should prioritize the following actions:
CMMC compliance is not a one-time assessment or a check-the-box exercise. It requires an ongoing commitment to maintaining security controls, accurate documentation, and a defensible compliance posture. Even during the Phase 2 suspension, prime contractors may require subcontractors to demonstrate CMMC Level 2 readiness or meet specific cybersecurity requirements as a condition of doing business. In addition, inaccurate cybersecurity representations can still expose contractors to potential False Claims Act liability.
Now is the time to stay the course, not put compliance efforts on hold. By continuing to strengthen cybersecurity practices and maintain compliance readiness, defense contractors can protect their organizations, support contractual obligations, and move forward with confidence.
At CorpInfoTech, we help defense contractors turn complex compliance requirements into a structured, sustainable process through our five-step roadmap: Define → Assess → Implement → Validate → Maintain. Our approach focuses on more than preparing for an assessment. It helps organizations establish and maintain the cybersecurity practices, documentation, and operational discipline needed for long-term compliance.
CorpInfoTech, a Managed Service Provider (MSP) with over 25 years in the SMB space, is a trusted partner for business pursuing compliance and cybersecurity. We are a CMMC Level 2 certified MSP and a Cyber AB Registered Provider Organization (RPO). Also, as the first CIS accredited organization, we help organizations implement the CIS controls as it pertains to CMMC and your overall cybersecurity posture. CorpInfoTech is your trusted partner for secure, compliant growth in every changing digital landscape.