The Pause Has a Drafted Exit Ramp. It's a Smaller Phase 2.

Federal News Network obtained the CMMC Reform Task Force’s summary of the July request for information and published a two-part investigation on October 26 and 27. The department has not released that summary, and it declined to comment on the 15 specific questions Federal News Network sent. Everything in this post about what the task force recommends therefore rests on one outlet’s copy of a document the department has not published, and I will say so again where the recommendation is the point.

The new thing is not a date. For fifteen weeks, coverage on this beat has said that no replacement Phase II date has issued, and that is still true. What arrived on October 27 is the shape of the restart, on paper, inside the department’s own reform file. The task force’s answer to its own pause is to bring third-party verification back on a shorter clock and a smaller population.

I think that is the story, and I think the document is thinner than the coverage implies. The second half is the part a contractor can work with.

What the pause left standing

I will do this from the department’s page rather than from a summary of it, because the two say slightly different things and the difference matters.

The live CMMC page opens with a banner: “On July 13, 2026, the Department of War announced the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which was originally scheduled for November 10, 2026. All Phase I self-assessment requirements remain firmly in place.”

Under assessments, it reads: “The CMMC Program is paused in Phase 1 and may only require self-assessments at two levels.” The Level 2 (Self) row specifies a self-assessment every three years, annual affirmation, and POA&Ms “Permitted as defined in 32 CFR § 170.21(a)(2) and must be closed out within 180 days.” The implementation section ends with the sentence I keep coming back to: “This action does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012.”

What paused was a phase. The obligation underneath it did not move. Covington’s September write-up gives the practical version: offerors still need current SPRS status and affirmation to be eligible for award, and contractors still owe the incident reporting, cloud security and media preservation obligations in 7012. I made the point that a suspension memo is not a rule in August, so I am not rebuilding it here.

The exit ramp, in the document’s own words

The summary groups reform options by authority: changes the DoD CIO can make without rulemaking, changes that are harder and may involve rulemaking, and suggestions outside the CIO’s remit. Then it lays the same material out on three timelines. A 90-day lane, a six-to-twelve-month lane, and a year or more.

Two sentences in the 90-day lane carry the post.

Over a 90-day period, the task force says DoD could restart Phase 2 of CMMC with a narrower population, while working on longer-term recommendations through the rulemaking process.

And finally, the DoD CIO could expand POA&M eligibility to 270 days, which the task force recognizes would require rulemaking but could be added to current “in process” amendment.

Against the 180 days on the department’s own page, that is ninety additional days of remediation time. It is also the only item in the 90-day lane that the summary flags as needing a rule, and its speed depends on riding an amendment already in process. That is a scheduling assumption, not a commitment.

The same POA&M extension shows up in the harder bucket too, as “extending the plan of action and milestones (POA&M) compliance requirements.” The two listings need not contradict each other, since the buckets sort by authority and the timelines sort by duration. But the document never reconciles them, and a contractor reading it has no way to tell whether the 270-day window is a 90-day item or a six-to-twelve-month one. The number is right and the timing is not knowable from this document.

Also in the 90-day lane, and worth naming so it does not hide behind the headline: more guidance to assessors and consultants through Cyber AB and the Cybersecurity Assessor and Instructor Certification Organization, and publication of assessor availability statistics. Neither is a Phase 2 decision. Both are things the CIO could do next week without a rule, and the summary does not claim any of them has been scheduled.

“Over a 90-day period” has no stated start. Not from the summary, not from publication, not from a decision. “Could” is doing real work in that sentence, and any reading that converts it into a date is unsupported. Federal News Network describes the summary as dating from early September, and the report it feeds was due to the CIO that month. It is October 30 and the report still is not public.

Why “smaller” is the word to read

The restart recommendation and the narrowing recommendation are not separate ideas in this document. The task force names marking clarity as the mechanism that shrinks the regulated population:

Of all the RFI recommendations, those related to improving clarity in CUI marking has the greatest potential to narrow the DIB population subject to NIST 800-171 implementation and cybersecurity related costs.

That is the department’s own sentence in its own summary, and it carries more weight than the restart line. Read what it promises. The population shrinks because companies stop having to protect data that was never properly marked as CUI, not because a smaller group passes an assessment. Narrowing and clarifying are the same operation here.

The mechanism leads somewhere the 90-day framing does not. Two sentences later, the summary says the narrowing runs through acquisition regulation:

If published, an already planned Federal Acquisition Regulations rule would include establishment of a new standard form for clearly articulating the CUI data to be shared (and safeguarded) during the performance of a contract.

DoD drew the conclusion itself in the next sentence of the summary: “The existing draft rule has the potential to drastically reduce the burden on industry, especially small businesses, by narrowing the population that must comply with NIST 800-171.”

That is a conditional about a FAR rulemaking with a new standard form attached, and neither has published. So the smaller Phase 2 depends partly on an instrument outside the 90-day lane and outside the CIO’s unilateral authority. The restart could happen inside 90 days. The population it restarts on probably cannot be drawn that fast, because the thing that draws it is a contract form that does not exist yet.

That sequence is my reading, not the summary’s. The summary never says the standard form gates the population. It says the form would narrow the population if published, and separately that a narrower population could restart inside 90 days. I am connecting the two because the second depends on the first for its membership. Flagging the inference seems better than leaving it to sit unstated in a paragraph that otherwise reads as a plan.

The summary also does not say who is inside the narrower population. Since marking is named as the lever, the fair statement is that the mechanism is marking and the membership is not drawn. Small businesses are neither protected nor targeted by anything in this document. Anyone who tells you otherwise is supplying a line the department left blank.

I covered the evidence and documentation half of this material yesterday, including the OSCAL recommendation for machine-readable assessment evidence and the cost cluster around assembling proof. This post is about program scope and timing, and I am not re-deriving that.

Three days, twenty people, and a spreadsheet

Here is the part of Federal News Network’s reporting I have not seen anyone pick up, and it changes how much weight the exit ramp can carry.

The task force convened in early September to work through the more than 1,100 comments the RFI drew. A government official quoted by Federal News Network said about 20 people took the material and reviewed it in three days. They were told not to use AI because there was no time to establish a non-biased model. Most of the analysis was done by hand, sorting responses into buckets, with a contractor-built keyword search tool for matching specific issues and a spreadsheet underneath.

In the same article, a former government official said the CMMC program office “was not involved or embraced in writing the final recommendations,” and that those were directed by task force lead Cynthia Carpenter, who worked on the DIB operations side of the CIO’s office.

Set that against the last time the department handled a comment set of this size. When DoD updated the CMMC rule in October 2024 and created 32 CFR Part 170, it reviewed roughly 1,400 comments and needed about eight months. This round had a comparable volume and took three days.

A three-day pass can be exactly right when the goal is a summary of themes rather than a rule, and the summary presents itself as findings rather than as a decision document. Speed is not automatically a defect. It does bound the claim, though. Twenty people reading by hand for three days can tell you what the commenters said. They cannot tell you which of the three horizons each recommendation survives, and the document’s unresolved question about where the POA&M extension belongs is the kind of thing a longer process catches.

The response base is the second thing to keep in view. The 997 reviewed responses included 509 from the defense industrial base, which the government source put at less than 1 percent of the sector. The RFI was open 30 days. A department that wants to know what the base thinks, rather than what a motivated subset thinks, would have run it longer. The 30-day window is a fact, and it explains the response pattern without needing a theory about industry apathy.

The counter-reading

A narrower Phase 2 is as consistent with a managed retreat as with a tactical shift. Shrinking a population is what an organization does when it has concluded a program cannot scale, and the same document recommends that the CIO “advocate on behalf of the DIB” for grants, subsidies and tax credits while noting the department “could not unilaterally address these recommendations.” That is the vocabulary of burden relief. A program being carefully restarted does not usually arrive with a request for subsidies attached.

The long-horizon items point the same way. Finalizing the move to NIST SP 800-171 Revision 3 sits among the recommendations, and that is a change of baseline rather than only of schedule. Moving to Rev 3 resets what compliance means and restarts transition clocks. A department planning a straightforward restart on the current baseline would not normally bundle a baseline change into it.

Katie Arrington, who ran CMMC’s rollout before Davies, put a specific forecast on the record: “I think they will say vendors will need to achieve Level 2 certification by 2029 and the ecosystem will die because you turned off the demand and the supply will not be there anymore.” She called that a self-fulfilling prophecy. That is a prediction from an interested party who has been publicly critical of the current CIO, and I am quoting it as a prediction. It is still the most specific forecast anyone has put on the record, and it sits four years past the 90-day lane.

Where that leaves me: I do not think the summary tells you whether CMMC comes back smaller or fades out smaller. It tells you that the department’s own reform body thinks the answer involves fewer companies either way, and that the mechanism for choosing which companies is a marking rule nobody has published.

What a contractor can actually use

The date is not available. There is no date, and there will not be one in a document that says “could” and “over a 90-day period” without a start.

The window is different. If the 270-day POA&M expansion lands, a remediation plan can carry a longer tail than the 180 days on the current page. If it does not, 180 stays. Either way the structure of the question is the same and it is answerable now: which of your open controls are genuine remediation items that a POA&M can cover, and which are the ones you were hoping the pause would retire. The second category is where the exposure is, because the pause never touched it and the exit ramp does not either.

Marking is the one lever where your own action changes your position regardless of which way the decision goes. If the CUI standard form publishes and narrows the population, clean marking is what lets you demonstrate you are outside the scope instead of arguing it. If it does not publish, clean marking is what your SSP still rests on. The task force called marking the highest-value item in the entire RFI. That is an argument for treating it as a project rather than a chore, whatever happens to Phase 2.

The word “suspended” deserves care too. It describes a phase. The two things a contractor is actually exposed to, the DFARS obligations and the risk of an attestation nobody can support, never suspended. Eric Crusius’s warning in part one is the line I would tape above a desk: “a lot of companies are conflating the pause of third-party assessments with the lack of a need to comply with the underlying security controls.”

Bottom line

The pause has a drafted exit, and the draft is a restart on fewer companies inside a quarter with a longer remediation tail, contingent on a rulemaking and a contract form that have not appeared. It is a recommendation inside an unreleased summary that about 20 people assembled in three days without the program office in the room. None of that makes it wrong. It makes it a sketch, and the useful part of a sketch is the shape: fewer companies under assessment, more time to fix what is broken, and marking as the line that decides who is in.

The department’s own page still says Phase I self-assessments remain firmly in place, and 7012 still applies. Spend against that. Plan against the window if the number helps you. Do not spend against a date, because the only timing the reform file commits to is a horizon with no start.

Sources

1. RFI offers path forward for DoD with CMMC — Jason Miller, Federal News Network, October 27, 2026 (part 2 of 2)
2. DoD’s reasons for CMMC pause falling apart in face of RFI responses — Jason Miller, Federal News Network, October 26, 2026 (part 1 of 2)
3. About CMMC — U.S. Department of War, Chief Information Officer (read October 30, 2026)
4. CMMC Reform Task Force Updates September 2026 — Covington, Inside Government Contracts, September 2026
5. Federal Register API: documents matching “CMMC”, newest first — retrieved October 30, 2026 (count 42; newest two dated August 14, 2026; newest CMMC-relevant rulemaking June 23, 2026)