CMMC’s next rollout phase was paused, but that does not erase the requirements already protecting sensitive defense information. New reporting shows why the conversation about costs and certification is more complicated than it first appears.
Risk Level
Read Time
“Wait, didn’t DoD pause CMMC?”
Yes, but the biggest thing here is understanding what actually got paused.
On July 13, 2026, the Defense Department announced the suspension of Phase II of its Cybersecurity Maturity Model Certification (CMMC) program, which was scheduled to begin November 10th. The announcement also made something else clear: Phase I self-assessment requirements remain in place.
What this means is that CMMC has not simply disappeared. The rollout is under review, and organizations still need to understand the requirements that apply to their contracts.
“Then why is everyone questioning the pause?”
DoD raised concerns about compliance costs, assessment capacity, and the burden on smaller defense contractors. These are very real issues worth discussing, especially when an organization has limited time and resources.
However, an October 26 investigation by Federal News Network raised a different question - Are organizations struggling with the CMMC assessment itself, or with the cost of implementing cybersecurity requirements they have been required to meet for years?
According to the article, internal DoD summaries covered 997 responses to the RFI, including 509 from the defense industrial base (DIB). Respondents frequently pointed to software licensing, specialized systems, documentation, and uncertainty about what information needs to be protected.
Some respondents also identified third-party assessment costs as a concern. The important distinction is that the feedback described several different expenses, not one universal price tag for CMMC.
“Hold on. Aren’t CMMC and NIST 800-171 the same thing?”
Not exactly. The National Institute of Standards and Technology (NIST) publishes SP 800-171, which outlines cybersecurity requirements for protecting controlled unclassified information (CUI). These standards cover sensitive government information that requires protection even though it is not classified. CMMC is the program used to assess whether applicable requirements are being met.
Think of it this way: building and maintaining the security measures is one part of the work. Demonstrating that those measures are in place is another.
For defense contracts that include DFARS 252.204-7012, the safeguarding requirements tied to NIST SP 800-171 still matter. Pausing a future assessment phase does not automatically remove an existing contract obligation.
That is why the difference is so important - An organization can still have sensitive information to protect even while the assessment rollout is being reconsidered.
“So what could DoD actually change?”
The second Federal News Network article, published October 27, describes options outlined by a DoD task force after reviewing the RFI feedback.
Some ideas focus on making expectations clearer. This includes more consistent assessor guidance, better CUI marking, and clearer explanations of which systems actually need protection.
Other proposals could take longer. Suggestions include recognizing overlapping work under other cybersecurity frameworks, changing timelines for fixing certain gaps, and moving toward NIST SP 800-171 Revision 3.
The task force even discussed a possible narrower restart of Phase II. But these are recommendations and options, not approved changes or a new official deadline.
“What should an organization do while this gets sorted out?”
First, keep track of what your actual contractual obligations are. A headline about CMMC does not replace the language in a contract or a clarification from the contracting officer.
Next, take another look at where your CUI is stored, shared, and accessed. If the marking or scope is unclear, ask questions instead of making assumptions. Protecting the right information starts with knowing what that information is and where it is located.
Organizations should also keep their security documentation and self-assessments accurate. Access controls, incident response, and protecting sensitive files remain practical cybersecurity needs regardless of what happens to the rollout.
The goal is not to spend valuable resources blindly on a deadline that has not been announced; it is to make informed decisions based on existing obligations and the risk to the organization.
“So what’s the real takeaway?”
The CMMC pause has created uncertainty across the ecosystem, but it has also brought attention to challenges that have existed for years. Costs, confusing guidance, and inconsistent CUI marking deserve solutions that help defense contractors do their jobs as efficiently as possible.
At the same time, delaying how cybersecurity is verified does not make the information any less valuable to hackers.
The real takeaway? Keep protecting the information your organization is responsible for, follow the requirements that are still in effect, and watch for official changes instead of treating proposals as final decisions.
CMMC may be on pause. Cybersecurity is not.
Ready to find out where your organization stands?
Follow us - stay ahead.
