From the TIKC Advisory Team · Federal Contracting News
CMMC Is Paused, Not Gone: The August 14 Window to Shape It — and What You Must Keep Doing
CMMC Phase 2 is suspended pending a task-force review, with an RFI due August 14. But Phase 1 self-assessments, SPRS scores, and FCA risk all…
Published 2026 | TIKC NewsWire
When the Department of War suspended CMMC Phase 2 on July 13, 2026, a lot of small defense contractors heard “CMMC is over.” It isn’t. What’s paused is the third-party (C3PAO) certification tier; the underlying security obligations are fully intact — and there’s a short window to influence what comes next.
The Window: Comments Due August 14
A new CMMC Reform Task Force is conducting a top-to-bottom review and must report to the DoW CIO within 60 days — putting its recommendations in the mid-September 2026 timeframe. The Department opened a public Request for Information, with responses due 12:00 p.m. ET on August 14, 2026. DoD’s own CIO cited SBA data suggesting future CMMC phases could cost small and midsize firms more than $7 billion annually, against an assessor shortage — roughly 100 authorized C3PAOs for 100,000-plus companies. If the burden has hit you, this is the moment to say so.
What Has NOT Changed — Keep Doing It
- Phase 1 self-assessments remain in force — Level 1 or Level 2 (Self), scored against NIST SP 800-171.
- Your SPRS score and annual affirmation are still required, and DFARS 252.204-7012 safeguarding obligations continue without interruption.
- False Claims Act exposure is arguably higher now, not lower — with no external assessor, your self-attestation carries the legal weight, and DOJ’s Civil Cyber-Fraud Initiative is still active.
What to Do Now
Keep your Phase 1 self-assessment current and your SPRS submission accurate and defensible. Ask your primes whether they’re amending Phase 2 flow-downs. Keep your scoping, system security plan, and evidence work moving — none of it becomes wasted effort. A pause is not a pass. Brick by brick.
FAQ
Is CMMC being cancelled?
Not as of now. Only Phase 2 (and later phases) are suspended pending review; officials haven’t ruled out changes, but the program rule and DFARS obligations remain on the books.
Should I stop my compliance spending?
No. Self-assessment, SPRS scoring, and DFARS 7012 safeguarding are all still live — and your existing contract clauses still bind you until formally modified.
Sources
Holland & Knight. (2026, July). DoW suspends CMMC Phase II requirements.
A-LIGN. (2026). What the CMMC Phase II suspension means for defense contractors.
About the Author
Melanie Patterson
Founder & CEO of Team Integrity Knowledge Center and creator of GovCon iSource. Former nurse turned entrepreneur with over 10 years guiding small, women-owned, and minority-owned businesses to over $10 million in government awards. Build, grow, scale — brick by brick. Contact
Your next step
Talk it through with a TIKC advisor
Continue reading
Related stories
One Faked Test Cost a Navy Supplier $10.9 Million
A company that makes steel for Navy ships let a tester change results so weak steel looked like it passed. It is paying about $10.9…
When Competitors Become Co-Conspirators: Bid Rigging and Collusion
A quiet word with a competitor about who wins which job feels like cooperation. It is a federal antitrust crime. Bid rigging and collusion carry…
The Set-Aside That Was Performed by the Wrong Company. A $4.8 Million Lesson.
A federal IT contractor and its owner agreed to pay $4.8 million after allegedly paying fees to 8(a) firms to win set-aside work, then doing…
The Cover-Up That Is Worse Than the Problem: Obstruction and Altering Records
When an audit or investigation looms, the instinct to clean up a file is a catastrophic one. Deleting an email or backdating a document can…
The Official Who Approved His Own Payday. A Conflict-of-Interest Indictment.
A government contracting official was charged after allegedly approving invoices that funneled money back to a side business he profited from, aided by a contractor…
The Case You Never See Coming: The FCA Seal, First-to-File, and the Disclosure Bar
A whistleblower suit can sit under court seal for years while the government investigates you in secret. Understanding the seal, the first-to-file rule, and the…
Winning on a Promise You Cannot Keep: Fraud in the Inducement
Overstate your staff, your experience, or your capabilities to win the award, and you can poison the entire contract. Fraud in the inducement means the…
The Loyalty You Owe: Honest Services Fraud and the Hidden Conflict
You can commit a federal crime without stealing a dollar. Honest services fraud punishes the person who secretly sells out the loyalty they owe, through…
$377 Million for the Costs It Should Not Have Billed. A Mischarging Lesson.
A major contractor agreed to pay $377 million, one of the largest procurement fraud settlements ever, over how it billed indirect costs to the government…
The Chip That Was Not Real: Counterfeit Electronic Parts and Your Duty to Catch Them
A single counterfeit microchip in a defense system can cost lives and end a company. For many contractors, the law does not just punish knowingly…
Signing for Your Code: The Secure Software Development Self-Attestation
If you sell software to the government, a senior executive now has to personally attest that it was built following secure development practices. That signature…
The NDA Clause That Can Void Your Contract: The Anti-Gag Rule
That confidentiality agreement your employees sign may quietly break federal law. The anti-gag rule bars contractors from using NDAs that stop employees from reporting fraud…
