By Josh von Rueden
Senior Director, Cybersecurity and Risk Management
July 17, 2026
On Monday, July 13, the Department of Defense placed an immediate freeze on CMMC Phase 2, the third-party assessment requirement that was set to take effect this November. A newly formed task force will review the entire program and report back within 60 days.
If your company holds DoD contracts or sits anywhere in the defense supply chain, this announcement probably landed in your inbox with a mix of relief and confusion. Both reactions are understandable. Here is what actually changed, what did not, and what we are advising defense contractors to do about it.
What changed
The Phase 2 and later phase deadlines are suspended. That includes the requirement to complete a C3PAO external assessment, which many contractors had been racing to schedule ahead of the November 2026 contract clauses.
Until the task force completes its review, no one knows what the certification step will look like, or whether the program returns in its current form at all.
What did not change
Everything that carries legal weight today is still in force. NIST 800-171, DFARS 252.204-7012, the self-assessment requirement, and your SPRS score affirmation remain contract obligations.
If you handle Controlled Unclassified Information as a prime or a subcontractor, those requirements flow down to you, and the Department of Justice is actively enforcing them under the False Claims Act.
That last point deserves emphasis, because recent enforcement actions were built entirely on the Phase 1 requirements that remain in effect:
- In June 2026, LOGZONE paid $507,000 after self-scoring a perfect 110 in SPRS while a government assessment found the true score to be negative 170. There was no breach and no whistleblower. The gap between the claimed score and reality was the entire case.
- In 2025, MORSE Corp paid $4.6 million after learning its submitted score was inflated and sitting on that knowledge for a year. The failure to correct the record was the violation.
- Also in 2025, Aero Turbine and its private equity owner Gallant Capital paid $1.75 million even after voluntarily disclosing their noncompliance. A parent company is not a firewall, and disclosure does not erase exposure.
What we recommend
Continue building Phase 1 maturity. Hold Phase 2 spend.
The self-assessment, an honest SPRS score, and the security controls behind them are required today regardless of what the task force decides. Pausing that work does not save money. It adds legal exposure now and puts you further behind if the audit requirement returns.
What you can reasonably hold is new spending aimed specifically at the third-party assessment: C3PAO scheduling, audit rehearsals, and investments tied to the certification levels beyond Phase 1. That is the exact piece the Pentagon paused, and it may look different, or lighter, once the review concludes.
There are two exceptions where we advise clients not to hold. If a prime already requires certification in your subcontract, that contractual obligation stands independent of the DoD timeline. And if you are mid-assessment and nearly done, finishing is almost always the better economics than restarting later.
The question everyone is asking
Is CMMC dead? No. The certification mechanism is paused. The underlying security standard is unchanged, and it is being enforced right now through the False Claims Act.
Betting on outright cancellation trades a known contractual obligation for a guess, and the downside is not just fines. Primes and contracting officers still check SPRS, and a weak or inflated score can quietly cost you awards while you wait for clarity.
The contractors who come through this window well will be the ones who used the pause to build genuine, defensible maturity rather than treating it as permission to stop.
Where Hartman stands
Hartman Executive Advisors leads, develops, and maintains compliant CMMC programs for defense contractors. We are unbiased advisors, not auditors and not product resellers, so we have no deadline to sell you. Our focus is keeping your program defensible, your SPRS score honest, and your contracts protected while the rules evolve.
If the pause has you rethinking your compliance plan for the year, we are glad to talk it through.
