The suspension of CMMC Phase II third-party assessment requirements on July 13, 2026, presents a pivotal decision for defense contractors. You must decide whether to continue toward formal CMMC Level 2 certification through a C3PAO, switch to a NIST SP 800-171 assessment, or wait for the Reform Task Force report expected in mid-September 2026.
Here's how to make that decision based on your specific circumstances.
The Decision You're Facing
The suspension doesn't eliminate CMMC certification as an option. C3PAOs can still issue CMMC Level 2 certificates, and those certificates remain valid. The change affects the enforcement timeline: the November 10, 2026 requirement for third-party assessments no longer applies.
Your decision hinges on three questions: What do your contracts require right now? What will your prime contractors demand? How much time do you have before the Reform Task Force potentially changes the framework again?
Key Factors That Affect Your Choice
Your contractual position matters most. If you're under a DoW contract with explicit CMMC certification language, that language hasn't been retroactively voided. Review your active contracts and upcoming solicitations. Some will reference 32 CFR Part 170 directly; others will flow down cybersecurity requirements through prime contractor terms.
Prime contractor pressure operates independently. The suspension affects DoW enforcement, not commercial relationships. Major primes set their own subcontractor security standards, and many have already invested in CMMC-aligned supply chain risk programs. If your largest customer is a prime with mature supply chain security expectations, federal policy changes won't necessarily reduce what they require from you.
Your current compliance posture creates constraints. If you've already implemented the 110 NIST SP 800-171 Rev 2 practices and documented your System Security Plan, you're closer to certification than someone starting from zero. If you're still remediating gaps, the path forward looks different.
Resource availability is finite. A full CMMC Level 2 assessment requires more preparation, documentation, and assessor time than a NIST SP 800-171 assessment. If you're a small business with limited IT security staff, the suspension might offer breathing room to build capability before pursuing formal certification.
Path A: Continue Toward CMMC Level 2 Certification
Choose this path if:
You're already engaged with a C3PAO and have completed or nearly completed your Phase 1 readiness activities. The investment is sunk; finishing the certification validates that work.
Your prime contractors explicitly require CMMC certification as a condition of subcontract awards, regardless of federal enforcement timelines. Some primes have told their supply chains they won't wait for DoW to restart Phase II.
You compete for contracts where certification creates differentiation. In a competitive bid environment, holding a valid CMMC Level 2 certificate signals capability that self-assessment cannot match.
You want certainty now rather than waiting for Reform Task Force changes. The 60-day review could result in a modified framework, revised assessment procedures, or different certification requirements. A certificate issued under current rules is valid regardless of what comes next.
This path requires full implementation of NIST SP 800-171 Rev 2 controls, documented evidence for all 110 practices, a complete System Security Plan, and successful C3PAO assessment. Budget for the assessment cost and the staff time required to support the assessor's evidence review.
Path B: Pivot to NIST SP 800-171 Assessment
Choose this path if:
Your contracts reference DFARS 252.204-7012 but don't explicitly require CMMC certification. The DFARS clause mandates safeguarding Controlled Unclassified Information and adequate security, which NIST SP 800-171 compliance satisfies.
You need to demonstrate compliance quickly without the overhead of full CMMC certification. A focused NIST assessment verifies your implementation of the 110 practices and produces a score you can report in the Supplier Performance Risk System.
You're a small business managing limited resources and want to defer certification costs until the Reform Task Force clarifies the long-term framework. This approach maintains your DFARS compliance obligation while preserving budget flexibility.
You want an independent validation of your security posture that stops short of formal certification. Some organizations use third-party NIST assessments as a bridge: they get external verification now and can pursue CMMC certification later if requirements change.
This path still requires implementing all applicable NIST SP 800-171 controls and producing evidence of that implementation. The difference is assessment scope and the resulting artifact: you receive an assessment report and score rather than a CMMC certificate.
Path C: Strategic Wait
Choose this path if:
You have no immediate contract requirements driving certification or assessment timelines. If your next bid opportunity is six months out and doesn't yet have defined cybersecurity requirements, waiting for Reform Task Force guidance makes sense.
You're still in active remediation of significant control gaps. If you're not ready for assessment under current requirements, the suspension buys time to build capability without the pressure of an imminent deadline.
You're a non-traditional defense contractor evaluating whether to enter the DIB market. The Reform Task Force is specifically examining impacts on small and non-traditional businesses, so forthcoming changes might reduce barriers to entry.
This path is not "do nothing." Continue implementing NIST SP 800-171 controls, document your security practices, and maintain DFARS 252.204-7012 compliance. You're building readiness for whatever framework emerges from the review, whether that's modified CMMC requirements or enhanced self-assessment procedures.
The risk: if the Reform Task Force recommends minimal changes and DoW restarts Phase II enforcement quickly, you'll face compressed timelines to achieve whatever certification your contracts require.
Summary Matrix
| Factor | CMMC L2 Certification | NIST 800-171 Assessment | Strategic Wait |
|---|---|---|---|
| Best for | Organizations with prime contractor pressure or competitive differentiation needs | Organizations meeting DFARS obligations without explicit CMMC requirements | Organizations with timeline flexibility and no immediate contract drivers |
| Timeline | 3-6 months depending on readiness | 2-4 months depending on scope | Ongoing implementation until Reform Task Force reports |
| Cost | Higher (full C3PAO assessment) | Moderate (focused assessment) | Lower (internal resources only) |
| Outcome | Valid CMMC certificate | Assessment report and score | Maintained compliance posture |
| Risk | Investment before potential framework changes | May need certification later if requirements change | Compressed timeline if Phase II restarts quickly |
The suspension doesn't change your fundamental obligation under DFARS 252.204-7012 to safeguard Controlled Unclassified Information. It changes the enforcement mechanism and timeline for demonstrating that capability through third-party certification. Choose your path based on contractual requirements, prime contractor expectations, and your organization's readiness level. The Reform Task Force report will clarify the long-term framework, but your compliance obligations continue regardless.
