The Open-Source Enclave: Building Defensible Compliance in the CMMC Pause
The Department of War suspended CMMC Phase 2 third-party assessments on September 3, 2026, codified in DARS Class Deviation 2026-O0025 (Revision 3). The suspension has no end date; it stays in effect until the department rescinds it or folds it into the FAR and DFARS. November 10, 2028, the date that keeps getting quoted as a return, is not when C3PAO audits come back. It is when the CMMC clause (DFARS 252.204-7021) flips from case-by-case to mandatory insertion for any system processing FCI or CUI, a Phase 4 threshold that predates the suspension and that the deviation did not move.
A suspension of C3PAO audits does not change your security obligations. You still have to protect Controlled Unclassified Information (CUI) under NIST SP 800-171 Rev 2 via DFARS 252.204-7012. While Level 1 and Level 2 requirements can be satisfied through SPRS self-assessments for the duration of the suspension, these attestations carry weight.
If an attestation is inaccurate, the DOJ can use the Civil Cyber-Fraud Initiative to enforce the False Claims Act. That liability exists for the duration of the self-assessment period.
I’m seeing more contractors move toward inspectable, self-hosted open-source enclaves instead of proprietary tools.
Projects like Open-CMMC provide a single-VM appliance with FIPS-validated cryptography and audit logging. These tools help build a verifiable evidence base. If your enclave runs a hardened, open-source stack, your logs are harder for a regulator to dispute than the proprietary outputs of a black-box vendor.
Agentic AI is also entering this workflow. Fieldguide recently achieved FedRAMP Moderate authorization, which shows how automated agents can manage CMMC and NIST evidence collection.
These projects are still early. Open-CMMC is now at v2.0.0, with a shop-floor extension covered in a later post, and self-hosting means you own the maintenance and patching. You get transparency, but you take on the full operational responsibility.
The suspension and the self-assessment period that comes with it rest on a class deviation, not a final rule. A new CIO memo could shift the timeline again. Building transparent infrastructure is a more stable approach than waiting for the regulatory environment to settle.
Sources
|- DoD CIO: CMMC Program Overview |- GovConIC: CMMC Class Deviation: What Rev 3 Changed for Contractors |- Kiteworks: CMMC DFARS Revision 3: Phase 2 Pause & Contractor Impact |- LW.com: What Defense Contractors Should Know About DOD’s Suspension of CMMC Phase 2 |- GitHub: TroutSoftware/Open-CMMC |- OrangeSlices: Fieldguide Achieves FedRAMP Moderate Authorization