The Pentagon suspended the CMMC third-party assessment requirement on July 13, 2026. If you read that as the deadline lifting, read it again. The outside check went away. The claim you sign did not, and the claim you sign is the part the government prosecutes.
What happened, in order
On July 13, 2026, the Pentagon issued two memoranda suspending Phase 2 of the Cybersecurity Maturity Model Certification program. Phase 2 was the step, scheduled for November 10, 2026, that would have made an assessment by a certified third party a condition of award on contracts involving controlled unclassified information. The later phases are frozen alongside it, until further notice.
Contracting officers were told to strip Level 2 and Level 3 requirements out of open solicitations and existing contracts as soon as they can. Note the gap in that sentence. You keep complying with the terms in your contract today until your modification actually arrives in writing. A press release is not a contract modification.
A CMMC Reform Task Force is now reviewing the whole program. It asked industry seven questions, including what compliance has actually cost and which controls actually reduced risk. That comment window closed at noon Eastern on Friday, August 14, 2026. The task force reports to the Pentagon's chief information officer in mid-September 2026. The stated reason for all of it was cost: assessment and remediation prices high enough that small suppliers were leaving the defense industrial base rather than pay them.
What did not change
- DFARS 252.204-7012. Still in your contract. Still requires the 110 controls of NIST SP 800-171 and cyber incident reporting inside 72 hours.
- FAR 52.204-21. The basic safeguarding floor, untouched.
- Your SPRS score and your annual affirmation. These are Phase 1 obligations, in force since November 2025, and they remain conditions of award.
- Flow-down to your subcontractors. Unchanged, and still your breach if you skip it.
- Government-led assessments. The government's own assessors still show up, and they still pick targets by risk.
- Whatever your prime decides. A prime can require any cybersecurity standard it likes in a subcontract, on any schedule it likes, no matter what the federal timeline says.
The part worth sitting with
Strip out the third-party assessment and what remains is a score you calculate yourself and an affirmation you sign yourself. That is not a lighter obligation. It is the same obligation with the outside verification removed and your signature left holding it.
On June 18, 2026, an Alabama defense contractor agreed to pay $507,144 to settle False Claims Act allegations over cybersecurity requirements on two Navy contracts. The detail that matters: the company had reported a perfect self-assessment score of 110 in October 2021. A government assessment roughly three years later scored it at negative 170, near the bottom of a scale that runs from negative 203 to 110. Justice Department cybersecurity fraud recoveries have risen sharply for two straight years, and every one of these cases turns on the same thing. Somebody wrote a number down.
Know your real number before you affirm it. Our six-question cyber read gives you an honest read on where you stand against the 110 controls, scored on the spot, before we ask your name. It takes about ten minutes and it is free.
We are updating what we told you in July
Our second brief said the assessor queue was the real deadline, because booking a certified assessor took longer than fixing the findings. That was true when we published it. It is not true now. The queue is no longer the constraint. The obligation behind the queue never moved, and the enforcement risk quietly got worse, because the audit that would have caught an inflated score before it reached a contract is the thing that just went away.
What to do before mid-September
- Pull your current SPRS score and ask one question: could you defend every point of it with evidence, today, to a hostile reader. If not, that gap is now your largest exposure.
- Do not stop remediation. The controls did not change. The only thing that changed is who checks first.
- Get written confirmation from every prime you serve about what they still expect and when. Their requirements are independent of the federal timeline, and several will keep theirs.
- Leave existing contract terms alone until a signed modification says otherwise. Talk to your contracting officer, not to a headline.
- Watch for the task force report in mid-September 2026, and treat whatever it says as a change in method, not a change in whether you owe the work.