Clarion Street

The CMMC Pause Took Away the Calendar That Assessment Firms Staffed Against

·12 min read

November 10 is three weeks away and nothing is attached to it. That was the date Phase 2 was going to become a condition of award across a large slice of Department of War (DoW) procurement: no Level 2 (C3PAO) certificate, no bid. Class Deviation 2026-O0025 Revision 3 directed contracting officers in September to remove or revise those requirements in new and existing solicitations and contracts, and it carries no end date. It “remains in effect until rescinded or incorporated into the FAR, DFARS, and DFARS PGI.”

This site has covered what the pause does to a contractor: the False Claims Act exposure, where the spend should go, the survey data on who actually stood down. This post is about the other side of the transaction, the firms that were supposed to do the assessing. Less has been written about them, and the evidence about their condition is thinner and comes mostly from people who sell assessments.

What the assessors have said on the record

Three third-party assessors spoke at an AFCEA TechNet Augusta workshop on August 17. Fernando Machado, managing principal and CISO at Cybersec Investments, said the pause was “sparking layoffs at the some 100-plus assessment organizations” and that defense firms were cancelling assessments already on the calendar. Costs were going up at least temporarily, he said, because volume is what drives unit cost down.

A month later, in Inside Defense, Machado again: “We’ve seen a decrease” in demand for assessments. “Other C3PAOs have laid off some of their assessors because of this pause.” And: “Everybody’s struggling with how things are going, and we’re trying to stay afloat.” An unnamed source in the same piece said the pause had “created devastating impacts on their pipeline,” then called the picture a mixed bag, citing “more than a few C3PAOs that have had a slight drop off but they are still doing level two assessments.”

Redspin’s Robert Teague gave the most granular account. Half of his firm’s assessment clients are continuing. The other half are pausing until DoW says something. A quarter of the pausing half cancelled outright because “they think CMMC is going away,” and half of Redspin’s consulting clients cancelled. Redspin itself has not laid anyone off.

Ali Pabrai, CEO of ecfirst, took the opposite view on the same panel. The pause “is actually an opportunity for organizations to leap ahead and to build that resilience and mitigate that risk,” he said. That is a remark about what contractors should do rather than about his own bookings, and he made it standing next to two firms describing cancellations.

None of that reporting includes a number. No firm is named as having cut staff, and no figure appears in either piece. The layoff claims come from three assessor-firm principals and one anonymous source, each describing a market they sell into. Teague’s split is the closest thing to a measurement, and it covers one company.

What the accreditation numbers show

The Cyber AB’s September town hall was more useful than any of the quotes, because it is a census of the credentialed base rather than an impression of it. The accreditation body reported 117 authorized or accredited C3PAOs, four of them fully accredited to ISO/IEC 17020. In August Machado put the count at 111. Secureframe’s sweep of the marketplace in March found 103. The base grew through the suspension. CCAs, CCPs, and Lead CCAs each grew 3 to 4% between August and September.

Throughput grew too. Final Level 2 certificates reached 2,362 in September, up 12% from August, with another 71 conditional certificates. That is not a market in retreat, at least not in the number of assessments being finished.

One figure moved the other way. Level 2 assessments in progress dipped 5% to 151. The recap reports the label and the number and does not define the category, so I treat it as an indicator rather than a measurement of demand. Read plainly, it counts assessments that have started and not finished. A lower number could mean work is completing faster than new bookings arrive, or that a few firms are simply between engagements; it cannot show which. Across 117 accredited firms that works out to fewer than two in flight per firm, which is arithmetic rather than a verdict. The recap gives the number without saying what it should be, and I don’t know either.

I would weight the accreditation numbers above everything Machado and Teague said, because the Cyber AB has no sales pitch riding on its own census. The corollary matters as much as the figure. Secureframe modeled ecosystem capacity from the March town hall data and found utilization somewhere between 12% and 59% depending on the assumptions, which means that under even the most pessimistic reading of how many assessments an assessor can run, little more than half the capacity was in use before the pause happened. A drop in demand landing on a sector already running well under capacity is bad for the firms in it. It is not the same thing as the sector disappearing.

Why the price went up when the requirement went away

The intuition is that relief from a mandate should make compliance cheaper. For assessment fees, the opposite happened, at least for a while.

Machado said the pause was pushing assessment costs up temporarily, because volume is what drives cost down. Daniel Turissini, a third-party assessor and chair of AFCEA’s Homeland Security Committee, put it in terms of cancellations: “This pause is going to make it very hard to keep costs down because there has been a lot of cancellations over the past couple of weeks. Now, I think that will level out.” Prices had been falling before July. Turissini estimated $30,000 to $70,000 for a small business, spread over as much as three years.

The more useful correction from that panel was about the number everyone quotes. The SBA figure of more than $500,000 for Level 2 certification gets quoted as the price of being certified, and the assessors argued it bundles two different things: implementing the controls and being assessed for them. “Those [implementation] costs should have already been incurred,” Machado said. He sells assessments, so he has an interest in that being true. The basis for the point is in the two categories themselves: implementing 110 controls takes staff time, tooling, and documentation, and an assessment is a review of work that already exists. That is an argument about what the SBA figure includes, and it stands or falls on that, not on Machado’s motives. If your 110 controls are not implemented, the assessor’s invoice was never your exposure; the remediation project was. Cybersec quotes small businesses under $100,000, and that figure comes from a firm that wants the work, so treat it as one firm’s number rather than a market rate.

Cancelled assessments free up assessor time without shrinking a firm’s fixed costs. That is the mechanism Machado and Turissini both gave for fees holding or rising rather than falling. Neither offers figures, and Turissini expected the effect to level out. I would not plan on the fee moving in either direction. What a contractor can act on today is the requirement itself: confirm with the buyer what they are asking for before cancelling a booking, because that answer varies by customer.

Who is enforcing now

Machado said small and midsize firms should keep working toward Level 2 because the primes are demanding it, and he displayed letters from Boeing, L3Harris, Elbit Systems of America, and Leonardo DRS warning subcontractors they would not keep working with them if they were not certified. “If you’re not certified, they simply won’t do business with you.” I have not seen those letters. Teague’s version of the same point is blunter: the primes “don’t care about what the Department of Defense is doing. They have locked onto [CMMC] because it is trusted.”

Elbit’s letters are public, and they are better evidence than either quote. On January 9, the company’s vice president of supply chain, Jason Allen, told suppliers that buyers “will not issue purchase orders to suppliers who fail to meet contractual CMMC flow-down requirements,” that Level 2 (C3PAO) certification “will serve as a critical factor when selecting partners,” and that they should engage a C3PAO and schedule an assessment. On July 16, three days after the suspension, Allen sent another letter with the subject line “CMMC Phase II Suspension – Stay the Course.” The requirements were unchanged, open POA&Ms and SPRS reports still had to be current, and the flow-down stayed. But the instruction on assessment changed: “Before scheduling or cancelling a C3PAO assessment, confirm the applicable requirement with your Elbit America buyer.” The level suppliers were told to be ready for was Level 2 (Self), not C3PAO.

The requirement held and the verification ask moved in-house, at least at Elbit. Teague’s claim was that the primes don’t care what the department does. Elbit’s letters show a company that plainly does care, and kept the requirement anyway. The most concrete instruction a subcontractor has received on any of this since July came from a customer rather than from the department.

Our own survey coverage found the same split at the population level: 37.2% of primes said they were holding the line on Phase 2 expectations for suppliers, 23.3% said they were relaxing them, and 39.5% were undecided, which is the group that will settle the question.

What reform might do to that demand

Matthew Travis ran through a hypothetical at the September town hall about what reform might look like, and he was emphatic that it was speculation, with every slide labeled as such and no inside information on the task force. In that sketch a C3PAO assesses a priority subset of the 110 controls and the rest are self-attested; C3PAOs pick up work in red teaming and penetration-test validation; continuous monitoring replaces a point-in-time SPRS score; and certified companies get extra evaluation credit in a solicitation instead of facing a hard requirement. On cost, CyberEF’s Mike Snyder said he does not expect a major reduction, with the assessor’s time shifting toward on-site review of critical areas.

Of those four ideas, only the solicitation credit is plainly a change to what a contractor has to buy. If certification becomes an evaluation credit, no certificate is required to bid. The other three may affect how much assessment work a contractor purchases, and how much depends on a final rule that does not exist yet: where the line falls between a priority subset and the rest of the 110 controls, and how far self-attestation is allowed to go. That is my reading of a sketch he labeled speculation; he did not say what any of it does to assessment volume. Travis estimated the back half of October for an announcement at the earliest. In early October he told Inside Defense the end of the month looked likelier. As of today the report is not public, CMMC.com’s newsroom has published nothing newer than October 8, and November 10 will arrive before any of it does.

What I would tell a contractor reading this

If you have a Level 2 assessment scheduled, call your prime before you cancel it. This is Elbit’s own instruction to its suppliers and it costs a phone call. The answer may be that the requirement is staying. Cancelling first and asking afterward is the one move here that is hard to undo, because the assessor who lost the booking is not obliged to hold your slot.

If you are planning an assessment anyway, get the quote and the date in writing before you commit. Not because demand is certain to return, since nothing announced suggests that, but because the only scheduling evidence in the record points one way: firms describing bookings that came apart.

If the budget covers only one of the two this quarter, it should cover the controls. Nothing in the deviation touched DFARS 252.204-7012, and the enforcement that has landed over the past year ran through self-attestation and the False Claims Act rather than through a C3PAO. The certificate is what a prime will ask you about, and certifying controls you have not implemented does not protect anything. It creates a representation you have to defend.

I don’t think the pause was a policy error on its own terms. Phase 2 as written would have required small firms to pay $30,000 to $70,000, on Turissini’s estimate, for an assessment that proves controls they were already contractually required to have, and the department is entitled to reconsider that. What bothers me is how the reconsideration is being run. The deadline is gone, the obligation is intact, verification has moved into customer letters, of which only Elbit’s are public, and the assessors quoted in the trade press reported cancelled bookings, layoffs at other firms, and falling demand. If the intent is a narrower program, the cheapest thing the department could do is say roughly what it will be, even before the final text exists. The assessors and the subcontractors are waiting on the same announcement. I don’t know which of those two groups is harder to replace, and nothing in the record says. What I do know is that the subcontractor’s obligations survived the suspension and the assessor’s calendar did not.

The two figures I will keep pulling are assessments in progress and the C3PAO count, in that order. If the first keeps falling while the second holds, that pairing will need an explanation, and there is not one in the record yet. One month of a 5% dip does not establish anything. Several months of both moving the same way would be worth a post.

Sources

  1. Implementing the Suspension of CMMC Phase II — DoW CIO memorandum 26-P-1023, July 13, 2026
  2. Class Deviation 2026-O0025, Revision 3, DFARS Part 240 — Sept 3, 2026
  3. Assessors Report Contract Cancellations, Layoffs After CMMC Pause — National Defense Magazine, Aug 17, 2026
  4. CMMC assessment firms face cuts, delayed audits as defense contractors await potential program changes — Inside Defense, Sept 8, 2026
  5. September 2026 Cyber AB Town Hall Recap — CMMC.com, Sept 30, 2026
  6. Cyber AB highlights potential changes to CMMC as industry awaits DOD reforms — Inside Defense, Oct 6, 2026
  7. CMMC Ecosystem by the Numbers: Inside the CyberAB Marketplace — Secureframe, April 2026
  8. Elbit Systems of America open letter to suppliers, July 16, 2026
  9. Elbit Systems of America open letter to suppliers, Jan 9, 2026