Clarion Street

CMMC Paused, but the DIB Didn't: What the First Post-Pause Data Shows

·5 min read

For two months the posts here have warned against one specific mistake: reading the CMMC Phase 2 suspension as a reason to stand down. On July 13 the Department of War (DoW, formerly DoD) suspended third-party C3PAO certification, months before it was due to become a condition of award on November 10. The warning was that verification paused while the obligations did not, and that a contractor who stopped work was buying itself a False Claims Act problem. That was the risk case in the false-claims concentration piece and the compliance shadow post. The first surveys are now in, and they mostly say the stand-down did not happen at scale. I want to be specific about where that is reassuring and where it is not.

Redspin published its third annual Defense Industrial Base survey on October 1, fielded in July and August, in the middle of the pause. The headline number is 78.2% of respondents continuing toward Level 2 certification or already holding it, against 21.9% who said they are delaying or significantly slowing their certification work. The market did not panic; roughly four out of five contractors kept going.

Spending tells the same story with more texture. Between 75.4% and 84.4% of respondents reported no change in cybersecurity spending across categories, and where spending did move, increases outnumbered decreases in most categories. The one clear pullback was certification spend itself: 20.3% paused it and 3.1% decreased it. This is the certification versus controls split I wrote about earlier this month, now showing up in survey data. Contractors kept paying for controls and stopped paying only for the assessment.

The part I did not expect to be this clean: 75% of respondents said Level 2 still has value independent of whether a contract requires it, with 68.8% citing independent validation and 62.5% citing CUI protection. Most of the market is not treating certification as a hoop it only jumps through because the government makes it. That is a stronger retention signal than I would have predicted in July.

The drift that did happen is narrow, and it is the part worth watching. Among the 21.9% who slowed down, most are still doing the underlying work: half say they are actively implementing or improving NIST controls, and 37.5% are running self-assessments and maintaining SPRS scores. What dropped is new spending. Only 12.5% of that group said they are still investing in cybersecurity technology, personnel, or processes. Redspin’s read is that these contractors are maintaining compliance with what they already have rather than spending anything new during the pause. The subset that no longer sees value in Level 2 is not arguing the controls are useless. They point to cost: implementation costs outweighing the benefits (100%), assessment costs (83.3%), and program uncertainty (66.7%). They ran the numbers and balked at the price.

Primes are doing more to hold the line than the government is right now. Only 23.3% of primes said they are relaxing Phase 2 expectations for suppliers, against 37.2% holding the line and 39.5% undecided. 76.6% of subcontractors said they have heard nothing from their prime about it. A subcontractor who stood down in July is not getting cover from anyone up the chain. The primes are keeping the expectation alive without saying so.

ISC2’s survey, surfaced at the September 30 Cyber AB town hall, lands in the same place. 68% of CMMC practitioners continued their CMMC work through the uncertainty, 26% delayed or canceled assessment preparation, and 76% said a CMMC program is necessary. On the pause itself the split was nearly even: 42% disagreed with it, 38% supported it.

Now the caveats, because the two surveys share the same three problems. Redspin is a C3PAO and CMMC services provider that sponsored its own survey, and it has a commercial interest in contractors continuing to pursue certification. Treat the “most contractors stayed the course” finding as directional, not neutral. The samples are small and self-selected: 131 responses for Redspin, roughly 70% from organizations under 500 employees, and a little over 200 for ISC2. Both skew toward small and midsize contractors and toward people already engaged in CMMC work, the ones least likely to have abandoned it. Both are self-report. They ask what contractors say they are doing, not what an assessor verified. A self-reported “we are still implementing controls” is the same class of claim the SPRS accuracy and False Claims Act exposure is built on.

That last point is why I am not writing this as an all-clear. The roughly 22% who slowed down is a real population, and it is where the risk concentrates. Redspin found that every respondent who paused spending on NIST 800-171 consulting, managed security services, or cloud platforms came from that slowed group, so for a slice of it the cuts ran past the assessment and into the controls. That slice is smaller than the worst reading of the pause implied, and it is not zero.

The reform decision is still open. The task force report was due to CIO Kirsten Davies on September 11 and has not been made public as of October 20. The most recent signal is a staffing move: Jon Steinbach was named strategic technical advisor to Davies on October 19. Until the report drops, “maintaining the framework” still means NIST SP 800-171 Rev 2. Redspin’s takeaway is that a contractor who stood down in July is now behind most of its peers, and that a C3PAO certificate still carries value as independent validation even with no deadline forcing it. That is a vendor making a case to its own market, but the peer gap is hard to argue with.

Sources

  1. Redspin 2026 Survey: Most Contractors Didn’t Pause After the Phase 2 Pause — CMMC.com
  2. Committed to the Mission: The State of the DIB with CMMC in Flux — Redspin (2026 report)
  3. September 2026 Cyber AB Town Hall Recap — CMMC.com
  4. CMMC Reform Task Force Updates, September 2026 — Inside Government Contracts
  5. Pentagon CIO gets new strategic technical advisor — DefenseScoop, Oct 19, 2026