If your company makes parts, writes software, or provides services anywhere in the Department of Defense supply chain, the Cybersecurity Maturity Model Certification (CMMC) program decides whether you can keep winning that work.
For two years, November 10, 2026 was the date everyone planned around. That was when third-party CMMC Level 2 certification was set to become a condition of contract award. In July, that date went away. Many contractors read the news as a reprieve. It isn't, and the companies that treat it as one will be scrambling later.
Where CMMC Stands Right Now
CMMC rolls out in four phases. Phase 1 started on November 10, 2025, putting Level 1 and Level 2 self-assessment requirements into new DoD solicitations and contracts. Phase 2 was supposed to follow a year later and require an independent assessment by a CMMC Third-Party Assessment Organization (C3PAO) for most contracts involving Controlled Unclassified Information (CUI).
On July 13, 2026, the Department of War suspended the move to Phase 2 and launched a 60-day CMMC Reform Task Force review. The department stated that all Phase 1 self-assessment requirements remain in place. On September 3, a formal class deviation made the pause binding on contracting officers. As of mid-October, the task force's recommendations have not been published, and no new Phase 2 date has been announced.
Here is what the pause did, and did not, change.
Paused for now
- Level 2 (C3PAO) certification as a condition of award
- Level 3 (government-led DIBCAC) assessment requirements
- Later CMMC rollout milestones
- CMMC waivers, during the review
Still fully in force
- DFARS 252.204-7012 and the 110 security requirements of NIST SP 800-171
- Level 1 and Level 2 self-assessments, with scores posted in SPRS
- Annual affirmations of continued compliance by a senior official
- Reporting cyber incidents to DoD within 72 hours
- Passing these requirements down to subcontractors that handle CUI
Bottom line: the pause removed a future requirement. It did not remove the cybersecurity obligations already written into your contracts.
What CMMC Level 2 Actually Requires
Level 2 is built on NIST SP 800-171, which spells out 110 security requirements across 14 families. The families include access control, identification and authentication, audit and accountability, configuration management, incident response, and system and communications protection. To meet it, you need four things:
- A defined scope. You have to know exactly where CUI lives, which systems touch it, and which people can reach it.
- A System Security Plan (SSP). This describes how each requirement is met in the environment you actually run, not the one you plan to run someday.
- A Plan of Action and Milestones (POA&M). Every gap needs an owner, a fix, and a date.
- A defensible score. Your self-assessment score goes into the Supplier Performance Risk System (SPRS), and a senior official affirms it.
When third-party certification returns, the regulation's scoring rules will matter:
- Conditional certification requires a score of at least 88 out of 110.
- Only certain lower-weighted items can be left open on a POA&M.
- Open items must be closed within 180 days, or the conditional status expires.
- Certification repeats every three years, with an affirmation every year in between.
Why the Pause Is the Time to Act
Your SPRS score is a legal statement. A self-assessment score you cannot back up is a liability. The Justice Department has continued to settle False Claims Act cases with defense suppliers over alleged gaps in NIST SP 800-171 safeguards. One example is a $507,144 settlement with an Alabama contractor in June 2026. An honest, well-documented score protects you.
Your primes have not changed their expectations. Prime contractors carry their own risk. Many will keep asking subcontractors for SPRS scores, SSPs, and evidence of readiness. Some will prefer partners who hold a voluntary C3PAO certification. The Cyber AB, which accredits CMMC assessors, has confirmed that C3PAO assessments remain available during the suspension.
Compliance takes longer than most companies expect. Scoping, remediation, documentation, and evidence collection typically take many months, not weeks. When certification returns, assessor calendars will fill quickly. Companies that already have a clean, current environment will be first in line.
How XOR Services Helps You Achieve Compliance
Most compliance projects stall for the same reason most technology projects do: no one agreed up front on what "done" looks like. XOR Services runs every engagement through our four-phase CADD process, with your team signing off at each critical step. Applied to CMMC, it works like this.
- Collect. We inventory your environment and map where CUI and Federal Contract Information enter, live, and leave. We also review the contracts and clauses passed down from your primes that define what you owe. Getting scope right early is the biggest lever on cost.
- Analyze. We assess your current state against all 110 NIST SP 800-171 requirements and their assessment objectives. Then we produce an honest score and a gap list prioritized by point value, risk, and effort.
- Design. We design the fixes. These can include network segmentation or a dedicated CUI enclave, multi-factor authentication, centralized logging, endpoint protection, secure configurations, and encryption. We also draft or update your SSP and POA&M. You review and sign off on the design before we build anything.
- Deliver. We implement the fixes and test each control against the success criteria you approved. We also organize the evidence an assessor will ask for. The result is a readiness package you can use for your SPRS affirmation or a C3PAO assessment.
Because you sign off on the design before work begins, we can scope and price the engagement accurately, with no change-order creep. That is how XOR delivers at a fraction of what larger firms charge.
How XOR Services Helps You Maintain It
Passing an assessment is a milestone. Staying compliant is a daily discipline, and your senior official has to affirm it every year. Controls drift as people join and leave, systems change, and patches pile up. Through our Managed IT services, XOR keeps your environment compliant:
- Continuous monitoring and patching, so vulnerabilities do not quietly erode your score.
- Access and account reviews, to make sure only the right people can reach CUI.
- Log review and incident response support, including help meeting the 72-hour DoD reporting requirement.
- Change control, so new systems, cloud services, and offices are scoped before they touch CUI.
- Living documentation. We update your SSP and POA&M as your environment changes, and keep evidence current for affirmations and future assessments.
- Secure hosting options through our Data Center Hosting practice, with security controls mapped to your compliance requirements.
A note on roles: XOR Services prepares your organization for CMMC and helps you stay compliant. Formal Level 2 certification assessments are performed by an authorized C3PAO, and we can help you get ready for that assessment.
Use the Window Wisely
The Phase 2 pause is real, and it gives defense contractors breathing room. But NIST SP 800-171, DFARS 7012, SPRS scores, and annual affirmations have not moved. The contractors in the strongest position next year will be the ones who used this window to turn their self-assessment into something they can prove.
If you are not sure where your score really stands, or you want a plan your leadership can sign off on, call XOR Services at (980) 785-1999, email info@xorservices.com, or request a consultation.
Sources
- Department of War, Department of War Suspends CMMC Phase II Requirements, July 13, 2026
- Crowell & Moring, Department of War Immediately Suspends CMMC Phase II Requirements
- Latham & Watkins, What Defense Contractors Should Know About DOD's Suspension of CMMC Phase 2
- Inside Government Contracts, CMMC Reform Task Force Updates, September 2026
- eCFR, 32 CFR 170.17 and 32 CFR 170.21
- Acquisition.gov, DFARS 252.204-7012
- U.S. Department of Justice, Alabama defense contractor settlement, June 18, 2026
- Cyber AB, Statement on the suspension of CMMC Phase II requirements, July 15, 2026