The CMMC 'Soft Pause': Why the Compliance Shadow is Getting Darker

September 20, 2026·4 min read

The Department of Defense is pausing CMMC Phase 2 third-party assessments through Class Deviation 2026-O0025, Revision 3. Since this revision went live on September 3, 2026, contracting officers can accept Level 1 or Level 2 self-assessments for the foreseeable future. This effectively sidelines mandatory C3PAO certification for now. The CMMC suspension language in Revision 3 is word-for-word the same as in Revision 2, which issued July 16. That earlier revision is when the pause was first written into DFARS Part 240. Revision 3 added the supply-chain package on September 3; it did not change the CMMC pause. The overhaul also renumbered the assessment clauses for new awards: 252.204-7019 dropped out, 252.204-7020 became 252.240-7997, and a new solicitation provision, 252.204-7025, appeared. Those are numbering changes for new contracts, not repeals. The old numbers stay in the eCFR text and still govern contracts from before the overhaul.

This is a change in procedure, not a reduction in security requirements. Your underlying obligations haven’t changed. You still have to implement NIST SP 800-171 Rev 2, maintain your SPRS scores, and provide annual affirmations under DFARS 252.204-7012.

This revision bundles the CMMC delay with new statutory supply-chain bans. The DoD is integrating bans on Chinese semiconductor suppliers (Section 853), restrictions on drone and UAS component sourcing (Sections 817/848), and prohibitions on transferring DoD employee personal data (Sections 803/836) into the same regulatory framework. This creates a “compliance shadow.”

Industry headlines focus on relief from C3PAO costs, but the operational reality is more complex. Contractors are moving away from a single certification hurdle and into a fragmented environment. Instead of one clear target, they now have to juggle self-attestation with granular audits for semiconductors, drones, and HR data.

Compliance is shifting from a verification-heavy model to a declaration-heavy one. This changes the risk profile. With the False Claims Act (FCA) in play, the penalty for a mistake in a self-declaration is high. Without a third-party auditor to share the burden, the legal risk rests entirely on the accuracy of your own assessments and SPRS scores. The first enforcement example landed in June 2026, when Logzone agreed to pay $507,144 to resolve allegations that it submitted a nearly perfect score on its self-assessment, which a DoD audit found wildly inaccurate.

The CMMC Reform Task Force’s 60-day review ended on September 11, 2026, and its report now sits with CIO Kirsten Davies. It has not been made public, and whether Davies releases the recommendations, or when, is the next thing to watch. The list of Chinese military companies (Section 1260H) is also a moving target due to ongoing litigation, like the Alibaba case. Even with the federal pause, some prime contractors will likely still demand third-party certification from their subcontractors.

Davies previewed where the reform is heading at the Billington Cybersecurity Summit on September 9. The department reviewed more than 1,100 responses to its request for information, totaling over 10,000 pages, and ran listening sessions with more than 3,000 attendees. More than half favored a hold or some level of reform. Two findings stood out. “Compliance equals compliance. Compliance doesn’t equal security,” she said, citing Small Business Administration figures of $593,800 for a third-party certification against about $388,600 for self-assessment, with the burden landing hardest on small and midsize firms. The second finding was that the program ignores manufacturing: “Nowhere in CMMC was there even a mention of how to build cyber resilience for a manufacturing line.”

That second finding is the one worth pricing in. The reform is being steered toward operational technology and the factory floor, which a SPRS score does not measure. A contractor whose idea of audit readiness is the controls and the score is aiming at a target the department’s CIO has already said was incomplete.

Sources: