CMMC Phase 2 Is Paused. Here’s What Orange County Defense Contractors Should Do Now

On July 13, 2026, the Department of Defense paused the next phase of the Cybersecurity Maturity Model Certification program — the step that would have made third-party certification the default for contracts with controlled unclassified information (CUI). If you make parts, run a machine shop or distribute components for the defense supply chain in Orange County, it’s tempting to read that as “CMMC is off.” It isn’t. Here’s what changed, what didn’t, and what to do over the next 90 days.

Updated October 24, 2026. This is a fast-moving story. We’ll update this page when DoD releases the Reform Task Force report or announces a new Phase 2 date.

What changed: the July 13 Phase 2 suspension

CMMC Phase 1 began on November 10, 2025, when the DFARS rule took effect. It required Level 1 and Level 2 self-assessments, with scores and affirmations entered in the Supplier Performance Risk System (SPRS). Phase 2 was scheduled for November 10, 2026, when Level 2 certification by an independent assessor (a C3PAO) would have become the default for contracts involving CUI.

On July 13, 2026, the Department’s Chief Information Officer suspended the move to Phase 2 and put the third-party assessment milestones — Level 2 C3PAO certification and Level 3 DIBCAC assessments — on hold. Contracting officers were told not to designate those requirements in new solicitations unless DoD issues further direction. A newly formed CMMC Reform Task Force was given 60 days for a top-to-bottom review of the program.

On September 3, 2026, Class Deviation 2026-O0025, Revision 3 carried the pause into DFARS contract language. The task force’s review ended in mid-September; as of late October 2026 its report hadn’t been published, and no date has been set for Phase 2 to resume.

What did not change

The suspension paused who checks your security. It didn’t change what you have to do. These still apply to contracts that involve CUI:

• DFARS 252.204-7012 — safeguard covered defense information and report cyber incidents to DoD within 72 hours.
• NIST SP 800-171 (Rev. 2) — the 110 security requirements your systems must meet.
• Your SPRS score and annual affirmation — Level 1 and Level 2 self-assessments are still posted and affirmed in SPRS.
• Flow-downs — primes still pass these clauses to their subcontractors, and many primes set their own, stricter deadlines.

As one law firm put it after the announcement, contractors “should not treat the suspension as a compliance pass.”

Why “paused” isn’t “optional”

The Honeywell settlement in plain English

On September 1, 2026, the Justice Department announced that a Honeywell business unit agreed to pay $2,042,518 to resolve allegations that one of its networks didn’t meet NIST SP 800-171 as its contracts required, from April 2020 through December 2023. The claims are allegations only, and there was no determination of liability. But the lesson for suppliers is direct: your SPRS score and affirmation are statements to the government, and enforcement doesn’t wait for CMMC certification.

When your prime still asks for Level 2

Primes carry the risk for their supply chain, and some still require proof of Level 2 certification on their own schedule. Read your purchase orders and supplier agreements, and ask your prime’s supply chain team directly what they expect and by when. A prime’s flow-down can require more than the government does.

Where CUI hides in a manufacturer’s systems

Most gaps we find at Orange County manufacturers aren’t exotic. They’re about not knowing where CUI actually lives. Drawings, specifications and technical data travel further than most people expect:

• The ERP. NetSuite, SAP, Sage, Made2Manage and QuickBooks Enterprise often hold part numbers, drawing attachments, routings and customer program details. If CUI is attached to an item or job, the ERP is in scope.
• File shares and Microsoft 365. Engineering folders, SharePoint sites and Teams chats where drawings get shared “just this once.”
• Email. RFQs with drawings attached arrive in sales and purchasing inboxes long before an order exists.
• The shop floor. CNC programming PCs, CAM workstations and USB drives that move files to machines.
• Suppliers and outside processors. Platers, heat treaters and machine shops you send drawings to are part of your CUI story too.

Shrinking where CUI lives — an enclave, or a clearly scoped part of your Microsoft 365 tenant — is usually the fastest and least expensive way to make NIST SP 800-171 achievable.

A 30/60/90-day plan for Orange County defense suppliers

First 30 days: confirm your position

• Pull your current SPRS score and affirmation date, and check that they still match reality.
• List every contract and purchase order with DFARS 7012 or CMMC language, and note what each prime is asking for.
• Map where CUI enters, is stored and leaves — the ERP, file shares, email and the shop floor.

Days 31–60: close the gaps that matter most

• Multi-factor authentication on every account that can reach CUI, including remote access and admin accounts.
• Central logging, with someone actually watching it 24×7, and endpoint detection and response on every device.
• Update your System Security Plan and your plan of action and milestones (POA&M) with owners and dates.

Days 61–90: prove it

• Re-score yourself against all 110 requirements and update SPRS if your score changed.
• Test your incident response: who reports to DoD within 72 hours, and who calls your prime?
• Decide whether you’ll pursue C3PAO certification ahead of Phase 2 because a prime requires it, or keep self-assessing until DoD sets a date.

What it costs to get ready

Most of the work is security you should run anyway: MFA, 24×7 monitoring, logging, endpoint protection, backups and documented policies. CAL IT Group’s Managed Care includes that security stack in one published per-user price, and our CMMC compliance service adds the scoping, gap assessment, SSP and POA&M work on a fixed-fee quote. See what managed IT costs in Orange County for side-by-side numbers.

What to watch next

• The Reform Task Force report — it may change how Level 2 assessments work and when Phase 2 starts.
• A new Phase 2 date — when one is announced, expect primes to move their supplier deadlines with it.
• NIST SP 800-171 Rev. 3 — DFARS contracts still point to Rev. 2, but Rev. 3 (published by NIST in May 2024) is where the requirements are heading. Plan your improvements so they hold up under both.

How CAL IT Group helps

Over 40% of our clients are manufacturers and distributors, and we work in the ERP systems they run every day. We’re SOC 2 Type II audited across all five Trust Services Criteria, so the team handling your CUI has had its own controls independently tested. We can scope your CUI, score you against NIST SP 800-171, and run the controls that keep you there — 24×7 managed detection and response, MFA and logging — with vCISO guidance on the decisions only leadership can make. Learn more about our work with aerospace and defense suppliers and manufacturers and distributors.

Estimate your SPRS score free Talk to a CMMC engineer

Sources: Faegre Drinker, “DoD Suspends CMMC Phase II Third-Party Audit Requirements” (July 17, 2026); U.S. Department of Justice press release (September 1, 2026); Covington & Burling, Inside Government Contracts, “DoW Issues Revision 3 of its Class Deviation on Security Requirements” (September 14, 2026); ISI Defense CMMC status (updated October 19, 2026). This article is general information, not legal advice; check your own contracts with your contracting officer or counsel.