NIST SP 800-171

CMMC automation has split into two poles: a document generator that scored itself 44 out of 100, and continuous-monitoring tooling built for an assessment target that keeps moving. Which parts to buy, which to build, and which to defer.

Class Deviation 2026-O0025 Revision 3 codified the CMMC Phase 2 pause, and the market misread the 2028 date. Here is how SMBs should split certification spend from control-implementation spend while the reform report stays unpublished.

The CMMC pause was not a CMMC decision. It was Pillar 3 of a five-pillar acquisition doctrine building since Executive Order 14265, and it moved the compliance question from who signs the certificate to how the government will confirm security at all.

The CMMC pause touched only third-party verification on DoD contracts. A separate government-wide FAR rule is still moving, and it would extend NIST SP 800-171 Rev 3 to civilian contractors for the first time.

The CMMC 2.0 final rule pairs a triennial assessment with an annual affirmation of continuous compliance and a standing continuous-monitoring control, but the GRC tooling market still runs on point-in-time checklists. Software-defined compliance and AI-driven observability are the bridge.

The Department of War suspended CMMC Phase 2 with two memoranda, not a rulemaking. The program's future is now a predictability problem more than a compliance problem.

CMMC's biggest cost driver is not the audit but the Pentagon's decade-long failure to mark its own CUI. Two inspector general reports say the contractors are right.

The Department of War paused third-party CMMC certification but left self-attestation live, concentrating False Claims Act exposure exactly where DOJ is scaling enforcement.