Speed to Capability Is the New Compliance Standard

October 1, 2026·10 min read

The CMMC suspension is the most written-about subject on this site, and I have written a share of it. What stays live, where the False Claims Act risk moved, why a memo is not a rule. I am not going to explain the pause again. I want to write about the thing the pause was attached to, because that part has not been written here and it matters more than the pause itself.

The suspension was not a CMMC decision. It was an application of the Department of War’s acquisition doctrine, which it calls the Acquisition Transformation System. The ATS has five pillars and sits on top of Executive Order 14265, with more than a year of buildup behind it. If you are a subcontractor deciding where to spend compliance money next year, that doctrine is what you should budget against. The pause is only the first place it touched your contract.

The doctrine predates the pause

The story starts on April 9, 2025, with Executive Order 14265, “Modernizing Defense Acquisitions and Spurring Innovation in the Defense Industrial Base.” The order declares a policy of accelerating defense procurement with “an emphasis on speed, flexibility, and execution,” a first preference for commercial solutions, and a general preference for Other Transactions Authority. That is where the doctrine starts. Everything after builds on it.

In November 2025, Secretary of War Pete Hegseth announced the overhaul in the bluntest terms he had: “The Defense Acquisition System, as you know it, is dead. It’s now the warfighting acquisitions system.” He cancelled JCIDS and introduced the “85 percent solution,” the idea that you field an 85 percent solution now rather than wait for a perfect one. The Defense Acquisition System was rebranded the Warfighting Acquisition System, with “speed to capability delivery” as its organizing principle and a commercial-first default.

The naming is genuinely muddled, and I want to flag it once rather than clean it up. Public communications say “Acquisition Transformation System (ATS).” The implementing memo describes a “Warfighting Acquisition System on five pillars under the Acquisition Transformation Strategy.” Trade press sometimes writes “Warfighting Acquisition System (WAS).” These are not cleanly interchangeable. The stable anchor is the five pillars, because those are written into the memo that actually suspended CMMC:

rebuilding the Arsenal of Freedom
elevating and empowering the acquisition workforce to rapidly deliver capability
maximizing acquisition flexibility through reduced regulations and process
developing high-performance systems through rigorous enterprise technical execution excellence
improving lifecycle risk management

Pillar 3 is the one that ate CMMC.

Pillar 3 meets a certification

The mechanics are short, and I have covered them before. On July 13, 2026, the Department suspended CMMC Phase II, months before third-party certification was due to become mandatory on November 10. Under Secretary Michael Duffey’s implementing memo, 26-P-1023, restricts program offices to designating only Level 1 (Self) or Level 2 (Self). Level 2 (C3PAO) and Level 3 (DIBCAC) designations are barred, and waivers are suspended. By September 3, Class Deviation 2026-O0025 Revision 3 carried the removal of third-party assessment from contracts as binding regulation rather than temporary policy. The obligations underneath did not move. I have written about what stays live and the False Claims Act exposure, why the memo form matters, and the class deviation and its supply-chain bans, so I will not repeat them here.

The stated reason is arithmetic. SBA Administrator Kelly Loeffler cites third-party certification at $593,800 against $388,600 for self-assessment, across “over 100,000 small businesses,” against roughly 100 approved assessors. CIO Kirsten Davies puts the capacity gap more plainly: “over 100,000 DIB businesses still that needed a third-party assessment… somewhere in the neighborhood of 100, maybe a little over 100 assessors… the math just simply doesn’t math.” She also called CMMC a “compliance checklist” and wrote that enforcing the deadlines “directly contradicts” the speed-to-capability directives.

“Reducing the compliance burden” is doing a lot of work in that framing, and it deserves scrutiny. Duffey is explicit that the standards did not move: “We’re not relaxing any standards by any means… What we’re removing is the bureaucracy of the third-party assessment.” What got suspended was the contractual requirement for third-party assessment, the one piece a small firm could outsource. What stayed is everything a firm has to do itself: implement NIST SP 800-171 Rev 2, keep the SPRS score accurate, sign the annual affirmation, and answer the primes that flow the requirements down. Reed Smith is blunt that the suspension “does not change False Claims Act exposure,” because the SPRS score and the senior official’s affirmation remain live legal certifications.

For a subcontractor, that is the part that matters. The burden did not go away. It moved toward your own attestation, and until the report lands, the thing standing between you and an enforcement action is the evidence you can actually produce about your own systems.

The review is over, and the output is invisible

The 60-day review was supposed to settle some of this. It did not. The task force’s clock ran out on September 11. The report was due to Davies that day, and it has not been published. Whether it ever is public is, by the Department’s own account, her call. The RFI drew more than 1,100 comments, collected by email with no public docket, so the reform’s inputs were invisible and its output may be too. The vendors have been writing the reform in the open in the meantime, a dynamic I have covered separately.

The freshest signal is from the Cyber AB’s September 29 town hall. The task force is now in what the recap describes as a roughly 15-day drafting window with Davies, which matches the timeline she gave in July: 60 days to gather feedback, then 15 days to write the report. Cyber AB president Matt Travis puts any public release in “the back half of October at the earliest,” after review by DoW General Counsel, Small Business, OMB, and the White House. Final Level 2 certificates reached 2,362, up 12 percent month over month.

I want to be careful about how much I read into the town hall. The future-state concepts it floats are the Cyber AB’s own speculation, clearly labeled as such, and the Cyber AB is the accreditation body, so it has a stake in the answer. Treat these as signals, not predictions.

Who verifies now?

The verified answer today is narrower than most coverage implies. Program offices are barred from designating Level 2 (C3PAO) or Level 3 (DIBCAC) requirements, but C3PAOs are still conducting certifications, and CMMC eMASS and SPRS are still processing them. Interim enforcement is Level 1 and Level 2 self-assessment plus select government-led assessments, and DFARS 252.204-7012 stays in force. Those are the pieces on the record. The standards have not moved.

The only detailed picture of what comes next belongs to the Cyber AB, and the recap is careful to mark its limits. The future-state slides were labeled speculation, the presenters said they had no inside information, and the Department had not seen them. The Cyber AB is also the accreditation body, so it has a stake in the answer. None of this is a forecast.

The concepts it floats are still worth naming: compliance-as-code with government-provided configuration requirements in OSCAL format, telemetry analysis and live risk scoring by DISA, a hybrid where C3PAOs assess a priority subset of controls while the rest is self-attested, Continuous Monitoring and Risk Scoring, FedRAMP integration, and a move to NIST SP 800-171 Rev 3. Separately, the Department has replaced its own internal RMF process with the Cybersecurity Risk Management Construct, described as dynamic and continuous. That is an internal practice, not a DIB verification mechanism, so I would not read it as the future of CMMC.

If the compliance-as-code direction materializes, it lines up with the open-source enclave argument this site has already made, and the tooling side of continuous compliance is already covered in the compliance automation gap post. What already happened does not depend on that speculation. Reducing the certification burden did not reduce the obligation. It changed who has to prove the obligation is met, and for a subcontractor that proof now sits with you.

What a subcontractor budgets against

The question is not simply whether to keep the C3PAO fee in the budget. A program office cannot require a C3PAO assessment right now, but a prime can still flow the requirement down, and the certification itself has not stopped. The spend that keeps its value no matter how the report lands is keeping your implementation evidence current: the SPRS score accurate, the annual affirmation truthful, and 800-171 Rev 2 controls demonstrably in place. Those are live legal certifications today, and the Department can still run select government-led assessments while new contractual C3PAO designations are suspended. Whatever the report says, that evidence keeps its value.

There is a second wrinkle most small firms have not priced in. Davies and the RFI both point at operational and manufacturing technology as a new compliance surface. A rollback of third-party assessment could, in the same stroke, extend requirements toward the shop floor that most small contractors have never treated as a compliance surface. If your compliance model stops at the office network and the CUI enclave, the reform may not.

One more track is still moving that the pause did not touch. The government-wide FAR CUI rule, built on NIST SP 800-171 Rev 3 for civilian and defense contractors alike, is still in motion. I have written about that divergence. A subcontractor that reads “CMMC is suspended” as “cybersecurity spend is paused” is misreading two calendars at once.

Industry is hedging rather than retreating. An ISC2 survey reported 76 percent agree a CMMC program is necessary, 42 percent disagreed with the pause against 38 percent who supported it, and 66 percent said preparation increased their workload. More than two-thirds continued CMMC work despite the uncertainty, while a third reallocated time and 26 percent delayed or canceled assessment preparation. That last number is the one that worries me. Those are the firms treating the pause as a stop order on a program whose requirements have not moved even as the contractual requirement for third-party assessment was suspended.

Bottom line

The CMMC suspension has been framed as a compliance reprieve, and that framing is wrong. It is a Pillar 3 application of an acquisition doctrine that has been building since April 2025, and what it suspended was the contractual requirement for third-party assessment, the single piece of the program a small firm could outsource. What remains is the obligation itself, plus an unanswered question about who will verify it. For a subcontractor, the budget question was never whether you can skip the C3PAO. It is whether your implementation evidence is current enough to stand behind, today, with a customer that has put speed to capability at the center of how it buys.