Picture the quality manager at a 200-person machine shop that makes brackets and housings for two defense primes. Last spring she booked a third-party CMMC assessment for October, because the November 10, 2026 deadline was printed in every supplier letter she received. In July the deadline moved, and since then she has heard three versions of what that means: it is over, it is delayed, it never really applied to her. She is deciding whether to keep the assessment, cancel it, or quietly let the whole program slide.
This article is for her, and for every aerospace supplier sorting out the same question. We separate what is in force today, what was suspended, what was cancelled, and what is still a good idea with more time to do it. The short version: the third-party certification step was paused, nothing was cancelled, and the obligations that create most of the real risk never paused at all.
What Happened in July
On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase II requirements, which had been scheduled to take effect on November 10, 2026. Phase II was the stage at which many contracts would have required a Level 2 certification from an accredited third-party assessor, known as a C3PAO, rather than a self-assessment. The Department also suspended pending and future CMMC implementation milestones across its solicitations and contracts, and set up a CMMC Reform Task Force to review the program and report to the Department’s CIO within 60 days.
The same announcement was clear on two points that matter more than the headline. All Phase I self-assessment requirements remain in place. And contractors and subcontractors remain obligated to safeguard covered defense information under DFARS 252.204-7012, with the Department enforcing the NIST SP 800-171 Revision 2 standard through self-assessments and select government-led assessments during the review. Law firm summaries of the implementing guidance add that contracting officers are to remove third-party and DIBCAC assessment requirements from active solicitations and from existing contracts by modification, and that waivers are halted during the review.
What Is Still Required Today
The obligations that apply to a supplier handling controlled unclassified information did not change in July. Our reading of the primary sources, and of the prime contractor guidance we checked, is that these remain in force.
First, the safeguarding clause, DFARS 252.204-7012. It requires you to protect covered defense information using the 110 security requirements in NIST SP 800-171 Revision 2, and to report cyber incidents to the Department within 72 hours of discovery. Revision 3 of that standard exists, but the Department has not moved to it; the Department’s own announcement names Revision 2.
Second, a current self-assessment. Where a contract carries the CMMC clause, DFARS 252.204-7021, you need a current CMMC status in the Supplier Performance Risk System at the level the solicitation specifies, either Level 1 or Level 2 self-assessment, to be eligible for award. The rule that put Phase I into effect on November 10, 2025 also requires an affirming official to confirm continuing compliance at least annually.
Third, the assessment score itself. Contracts with the NIST assessment clauses require a current self-assessment score posted in that same system, and the government can still audit it. Fourth, for companies that only handle federal contract information, the basic safeguarding requirements in FAR 52.204-21 still apply.
And the primes are still checking. Lockheed Martin’s supplier notice of July 22, 2026 says prime contractors remain obligated to verify subcontractor compliance status in the Supplier Performance Risk System, and asks suppliers to keep their status current to stay eligible for its procurements.
What Was Suspended, and What Was Not Cancelled
What was suspended is the third-party verification step, Level 2 certification by a C3PAO and Level 3 assessment by the government’s DIBCAC team, along with the schedule that would have phased them in. That is a real change. For new Department awards during the review, the program can only ask for self-assessments.
What was cancelled is nothing.
What was cancelled is nothing. The CMMC rule in the Code of Federal Regulations and the DFARS clauses that implement it are still in place, and we found no Federal Register notice amending or withdrawing them as of late October. The suspension was carried into contract language through a class deviation, which is how the Department changes contract terms quickly without rulemaking; it is not a repeal. The task force report was due around mid-September. Press coverage in late October reported that it had not been released, and that the options under discussion included restarting third-party assessments for a narrower group of contractors, giving credit for other security certifications, and eventually moving to Revision 3. Those are reported options, not decisions, and the Department has not announced a new date.
Still a Good Idea, With More Time
Some things are no longer required on the old schedule but remain sensible, and the pause gives you room to do them well instead of in a rush. Here is our judgment on each.
A third-party assessment. If you already hold a C3PAO certification, keep it and keep it current; it is evidence that will matter whatever form the program takes. If you are close to ready and a prime has asked for certification, the assessment is still worth doing. If you were going to scramble to meet November, the better move is to finish the work, then decide once the task force’s direction is public. Before cancelling a booked assessment, ask each prime you supply, in writing, whether its own requirements changed. Some primes announced their own supplier deadlines before July, and a prime’s purchase terms can be stricter than the Department’s.
A smaller footprint. The cheapest controls are the ones you no longer need, because the information is no longer there. Mapping exactly where controlled information enters, lives, and leaves your business, and fencing it into the smallest possible environment, lowers your cost under any version of the program. It is also the step most companies rush when a deadline looms.
A move toward Revision 3. It is not required, and the timing is unknown. Reading the differences now, and designing new systems with them in mind, will cost less than retrofitting later.
The Part That Never Paused
The risk most suppliers underestimate has nothing to do with the suspension. When a company tells the government it meets NIST SP 800-171 and does not, the Justice Department can treat the claims for payment as false. On September 1, 2026, six weeks after the suspension, Honeywell Aerospace agreed to pay $2,042,518 to resolve allegations that a business unit failed to meet NIST SP 800-171 on one of its networks from 2020 to 2023. The case began with a whistleblower, a former employee, who received $375,823 of the settlement. The department said it will continue to investigate potential violations of these requirements.
It is not the only case. In 2025, the defense contractor MORSECORP paid $4.6 million to resolve allegations that included reporting a self-assessment score of 104 when an outside consultant had scored it at negative 142, and Aero Turbine and its private equity owner paid $1.75 million in a case the companies had disclosed themselves. All of these are settlements of allegations, with no finding of liability, and the facts differ from case to case. The pattern is still plain: the exposure comes from an overstated score and an unsupported affirmation, and a self-assessment regime puts more weight on both, not less.
What We Would Do With the Time
Our suggestions are a judgment, not legal advice, and they assume a mid-market aerospace supplier that handles some controlled information for one or more primes.
Make your score true before you make it high. Rerun your self-assessment against the Department’s methodology with someone who will be honest about it, and post a number you can defend line by line. A modest, accurate score with a credible plan is far safer than a perfect score you cannot support.
A modest, accurate score with a credible plan is far safer than a perfect score you cannot support.
Get each customer’s position in writing. Ask every prime what it requires from you now, and what it expects when the program resumes. Keep the answers.
Keep the evidence folder. The same discipline we described in our 90-day pathway for AI governance audits applies here: a system security plan that matches reality, a list of where controlled information lives, the affirmation and who signed it, and a record of the incident drill you ran. Whatever the reformed program looks like, it will ask for records, and building them now is cheaper than rebuilding them later.
Use the pause to shrink, not to stop. The suppliers who will be glad of this pause are the ones who spent it reducing what they have to protect and proving they protect it. As we argued in Aerospace in 2040, compliance has long been a moat in this industry. A pause lowers the water for a while; it does not drain it.
A pause lowers the water for a while; it does not drain it.
What This Will Not Do
This is not legal advice, and it reflects the public record as of October 30, 2026. The program is under active review, and any part of it could change with a task force decision, a new class deviation, or a rule change; check the Department’s CIO site and your contracting officer before relying on any of this. Some of what we report, including the task force’s status and the options under discussion, comes from press coverage and law firm summaries rather than government documents, and we have labeled it that way. Contract clauses are being renumbered as part of the broader overhaul of federal acquisition rules, so the clause in your next contract may carry a different number for the same obligation. And whether a specific contract of yours requires a given level is a question for that contract and your counsel, not for an article.
Where to Start
Start with your score and your footprint: rerun the self-assessment with a skeptical eye, and map where controlled information actually lives. If you would like an outside view, our independent assessment covers exactly that ground, and our aerospace practice includes former technology leaders who have run these programs inside aerospace and defense suppliers. If you would rather talk it through first, you can reach us through the contact form on our About page.
