Today, November 10, 2026, was supposed to be the day CMMC Phase 2 started. Under the DFARS rule that took effect a year ago, that was when many new defense contracts handling Controlled Unclassified Information (CUI) would require a Level 2 certification from an authorized third party assessor (a C3PAO) at award. Plenty of machine shops, engineering firms, simulation and training companies and IT providers along the Space Coast, in Orlando and around Tampa had been planning their year around that date.
Then on July 13, 2026 the Department of War (the Department of Defense's new secondary name) suspended Phase 2. The memo paused the third party Level 2 assessments and the government led Level 3 assessments and started a 60 day review by a CMMC Reform Task Force. As of this writing we have not seen a new start date announced. Some contractors heard "suspended" and moved their compliance budget to next year. That is a mistake, and for some firms an expensive one.
The suspension only paused a phase. It did not touch the underlying obligations, most of which are older than CMMC itself.
That affirmation is the part we would focus on. A senior person at your firm signs a statement to the federal government that you meet the requirements and keep meeting them. If your SPRS score says 110 and your System Security Plan is a template nobody has opened since 2022, that statement can become a False Claims Act problem. The Justice Department's Civil Cyber-Fraud Initiative has been bringing these cases since 2021, and whistleblowers who report them can share in the recovery. Former employees and disgruntled IT staff know where the gaps are.
When Phase 2 comes back, in whatever form, demand for C3PAO assessments will spike at the same time, and assessor capacity was already thin. Getting ready for a Level 2 assessment commonly takes six to twelve months for a small company that has not done the work. Firms that use the pause to fix their environment will be scheduling assessments while everyone else is still scoping.
The work itself is the same either way. You need to know where CUI lives (email, file shares, the engineering workstation in the back, the laptop the estimator takes home), shrink that footprint where you can, write an SSP that describes what you actually do, and keep a Plan of Action and Milestones for the gaps that are left. Your SPRS score should come out of that honest self assessment, not the other way around.
The deadline moved. The contract language and the signature on your affirmation did not.
CMBNetworks helps defense suppliers, manufacturers and IT providers across South and Central Florida get ready for NIST SP 800-171 and CMMC Level 2, from CUI scoping and gap assessment to SSP and POA&M work. Our practice is led by a former CISO of WMATA (the 2nd largest transportation organization in the United States) and former HITRUST Lead Assessor, PCI-DSS QSA and SOC auditor, so we know what a third party assessor will ask for. If you want an honest read on where your SPRS score really stands, get in touch.