Clarion Street

Certification vs. Controls: Spending Through the CMMC Fog

·8 min read

Sometime in the last month, a specific misreading started showing up in the commentary I read. Kaizen Solutions Group, Redspin, and Brea Networks have each published a warning in the past few weeks, and they all flag the same thing: contractors looking at Class Deviation 2026-O0025 Revision 3 and reading its “November 10, 2028” date as a two-year delay of the whole CMMC program, then standing down compliance work on the strength of it. I cannot prove how widespread the misreading is, and I am not going to claim the whole market has it wrong. I can tell you the reading is wrong, and that acting on it costs money.

It is not a delay. The date is the original Phase 4 date from 32 CFR 170.3(e), printed in the clause since November 2025. Revision 3 reprinted it. It did not create it or extend it. The pause removed third-party C3PAO assessment requirements from new solicitations and contracts. It did not pause NIST SP 800-171 Rev 2, SPRS scoring, the annual affirmation, or DFARS 252.204-7012 incident reporting. I covered what the suspension actually changed when it happened in the false-claims concentration piece and what the compliance shadow added after it. The short version: the verification mechanism paused and the obligations did not.

Certification versus controls

That leaves one question that matters for budgeting: which dollars are you spending on the paused thing versus the never-paused thing. Kaizen Solutions Group draws the line as certification-related spend against control-implementation-related spend, and I think it is the right cut. Three buckets follow from it.

Control implementation means the 110 controls in NIST SP 800-171 Rev 2. Keep spending here. These are enforceable today under DFARS 252.204-7012, and they are the basis of the enforcement that has already landed over the past year. Nothing in the deviation suspends them.

Certification means the third-party C3PAO assessment. This is the only genuinely deferrable spend, and only where no prime or customer requires it contractually. Some primes are still flowing C3PAO requirements down regardless of the federal pause, so read your contract before you defer. If a customer names the assessment as a condition of award, your certification spend is not deferrable.

Evidence discipline means SPRS score accuracy and keeping the SSP and POA&M current. Keep spending here too, and I would put this one first in order of importance. With the third-party auditor removed from the loop, your SPRS score and your annual affirmation are now the representations the government can hold up against you. The Logzone case shows the shape of the risk. The government alleged the company submitted payment claims while knowingly failing to comply with DFARS 252.204-7012, and the record sets a self-reported score of 110 against a government assessment of -170. The score gap was not the charge. The reminder I take from it is about accuracy: your SPRS score and your SSP are records you own, and the cheapest time to make them accurate is now. If your score says more than you have actually implemented, correct it before someone else notices.

What the 2028 date actually is

The date is the thing I keep seeing people misread. It is the original Phase 4 date from 32 CFR 170.3(e), present in the clause since November 2025. Revision 3 carried it forward from Revision 2, which carried it forward from before the pause. The deviation changed the instrument, not the policy. A memorandum can be withdrawn by the office that issued it. A class deviation stays in effect until it is rescinded or incorporated into the FAR and DFARS, which takes regulatory action. The codification made the pause harder to reverse, not longer.

The cost of misreading it shows up later. A company that treats 2028 as a delay stands down remediation now, then re-compresses the same work under deadline pressure in two years. That work costs more and produces weaker evidence. Evidence assembled against a deadline is exactly the kind that does not survive a government-led Medium or High assessment under DFARS 252.240-7997.

Enforcement did not pause either

If you need a reason to keep the control work moving, the two most recent settlements are it. In June 2026, Logzone, a Huntsville, Alabama contractor, agreed to pay $507,144 to resolve allegations that it knowingly submitted false claims for payment on two Navy contracts while failing to implement NIST SP 800-171 controls. DOJ said a Defense Contract Management Agency assessment in February 2024 produced a score of -170, at the low end of the -203 to 110 range, after Logzone had self-reported a perfect score of 110 in October 2021. On September 1, Honeywell Aerospace agreed to pay $2.04 million to resolve allegations that, from April 2020 through December 2023, a business unit submitted false claims while failing to meet NIST SP 800-171 requirements on one of its networks. That case grew out of a whistleblower suit by a former employee. Both settlements were built on DFARS 252.204-7012 and NIST SP 800-171, not on any CMMC assessment requirement. The pause removed the auditor and left the enforcement in place.

The report is the thing we are waiting on

The Reform Task Force report was due to CIO Kirsten Davies on September 11 and has not been published. What is in it is unknown, and anyone claiming otherwise is guessing. The Cyber AB’s Matt Travis estimated public release at “the back half of October at the earliest,” after review by the department’s General Counsel and Small Business offices, then OMB and the White House. At the September town hall, Travis and Mike Snyder walked through what a reformed program could look like, and both stressed that the exercise was their own speculation. They pointed toward operational technology, manufacturing resilience, and continuous validation rather than a lower technical bar. The department’s own CIO has made a version of the same point in public: press reports quoted Davies at the Billington Cybersecurity Summit in early September describing a parallel review of the Risk Management Framework and a focus on operational and manufacturing technology risk. The program has not stopped running while this plays out. C3PAOs are still assessing, and final Level 2 certificates reached 2,362 in September, up 12% from August, according to the Cyber AB’s September town hall recap.

There is a separate headwind worth knowing about even though it is not this deviation. A GAO report found that 80 of 117 federal cybersecurity regulations, about 70%, carry potentially duplicative reporting requirements. The Cyber AB, summarizing that report at its September town hall, flagged conflicting incident-reporting timelines ranging from 4 to 72 hours. Harmonization is coming at some point, and it will be its own lift. It is not a reason to stand down the controls you already have.

Where this advice comes from

The certification-versus-controls framing is advisory analysis, not a government position. Most of the “what stays in force” detail comes from law-firm and vendor commentary rather than the deviation’s own prose, which confirms the mechanics but does not do the budgeting for you. KSG, the source I am leaning on hardest for the spend split, sells control-implementation work, so its “keep spending on controls” advice is also its pitch. The law-firm positions line up with it, which is why I am comfortable repeating it, but weight it accordingly.

One thing I will not imply: that Revision 3 changed nothing for anyone. It bundled in new supply-chain obligations, the Huawei and semiconductor bans, drone and UAS restrictions, and employee-data-transfer limits. Those added real work for some contractors. That is the compliance shadow I wrote about in September, and it does not disappear just because the C3PAO assessment did.

The practical takeaway is the same either way. Sort your spend into the three buckets before the report drops. If you cannot tell which dollars are certification and which are controls, that is the first thing to fix, and it does not require waiting on the report.

Sources

  1. DFARS Class Deviation 2026-O0025 Revision 3 — signed memo and Attachment 1 (DFARS Part 240)
  2. CMMC’s Phase 2 suspension locked in with binding regulation — Washington Technology
  3. DOW Suspends CMMC Phase II: What the Pause Means for Contractors Right Now — Skadden
  4. CMMC Reform Task Force Report: What Contractors Are Getting Wrong — Kaizen Solutions Group
  5. Cybersecurity Maturity Model Certification (program page) — DoD CIO
  6. September 2026 Cyber AB Town Hall Recap — CMMC.com
  7. CMMC Reform Task Force Updates September 2026 — Covington / Inside Government Contracts
  8. Class Deviation Revision 3: Still in the Holding Pattern — Redspin
  9. CMMC Revision 3 Explained: Phase 2 Suspension, the 2028 Date, and What Contractors Need to Know — Brea Networks
  10. GAO-26-108606: Cybersecurity Regulations — Multiple Sectors Are Subject to Potentially Duplicative Reporting Requirements
  11. Alabama Defense Contractor Agrees to Pay $507,144 to Resolve False Claims Act Liability Relating to Cybersecurity Violations — DOJ
  12. Honeywell Aerospace Inc. Agrees to Pay Over $2M to Settle False Claims Act Allegations of Failing to Comply with Cybersecurity Requirements in a U.S. Department of Defense Contract — DOJ
  13. LOGZONE Inc. Settlement Agreement (PDF) — DOJ