DoD Paused CMMC Third-Party Audits. The Compliance Obligation Didn't Pause With It
October 27, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
The Department of War suspended mandatory third-party CMMC Level 2 assessments on July 13, 2026, pending a program review. That pause applies only to the Certified Third-Party Assessor Organization requirement. The underlying obligation to implement NIST SP 800-171, score yourself honestly in SPRS, and sign an annual affirmation never stopped, and the Department of Justice is enforcing that obligation through the False Claims Act regardless of where the certification rollout stands.
What Did the DoD Actually Pause?
The Department of War paused Phase 2 of the CMMC rollout, the phase that would have made third-party certification by an accredited assessor mandatory for most contractors handling Controlled Unclassified Information. Phase 1 remains in effect, meaning Level 1 and Level 2 self-assessment requirements still apply to new DoD solicitations and contracts, and there is currently no confirmed date for when third-party certification resumes.
That timing matters because the whole program only started moving recently. The 48 CFR acquisition rule took effect November 10, 2025, which is what let the DoD begin writing CMMC self-assessment requirements into new contracts in the first place. Phase 2, the mandatory third-party audit layer, was supposed to follow roughly a year later. It got suspended instead, not cancelled.
The reason the suspension exists at all is an assessor capacity problem, not a policy retreat. By late 2025, the accreditation body for the CMMC ecosystem reported 83 accredited C3PAOs and around 567 certified assessors against a defense industrial base where more than 80,000 companies are expected to eventually need Level 2 certification. Even with the assessor pool roughly tripling over the following year, the math never worked cleanly, and the Cyber AB itself has acknowledged the ecosystem was growing unevenly relative to certification throughput. Pausing the third-party requirement bought the program time. It did not buy contractors time on the parts of the obligation that were never tied to assessor availability in the first place.
Does the Pause Reduce Your Legal Exposure?
No. The self-assessment and SPRS scoring requirement predates CMMC entirely, and the Department of Justice has made clear that liability under the False Claims Act attaches to the claim for payment, not to whether a third-party certifier ever signed off. Every cybersecurity-related FCA settlement to date has been built on the existing DFARS 7012 and self-assessment framework, independent of how far the CMMC rollout has progressed.
The enforcement numbers back that up. The DOJ's Civil Cyber-Fraud Initiative has produced a steady climb in settlements, and cybersecurity-specific False Claims Act recoveries jumped 233 percent in fiscal year 2025 compared to the year before. Separately, the DOJ settled seven cybersecurity-related cases in 2025, including an $11.25 million settlement with a managed care provider over misrepresented compliance. None of those cases waited for a C3PAO assessment to exist. They were built on contractors signing something that did not match reality.
That is the part worth sitting with as an executive, not just a compliance detail. Every CMMC annual affirmation, and every SPRS score behind it, is a legal certification made to the federal government. A whistleblower provision in the False Claims Act lets a current or former employee file suit on your company's behalf and collect a share of whatever the government recovers, which means the person most likely to catch a sloppy self-assessment is someone already on your payroll. Record-breaking FCA enforcement activity in the government contracting space is not a one-year spike. Deputy Assistant Attorney General Brenna Jenny described the growth in cybersecurity-related recoveries as a sustained upward trend, not a blip tied to any single enforcement push.
Who Should Be Signing Your SPRS Score?
This is the staffing question the pause actually surfaces. If a third-party assessor is not coming to check your work anytime soon, the accuracy of your self-assessment rests entirely on whoever inside your company scored it and whoever signed the affirmation. That person needs to understand the full 110-control structure of NIST SP 800-171 well enough to defend the score in a deposition, not just well enough to fill out a spreadsheet.
A defensible self-assessment, the kind that survives a DOJ inquiry or a competitor's bid protest, generally requires someone who can do all of the following without outside help:
- Map each of the 110 NIST SP 800-171 controls to actual technical evidence, not policy language borrowed from a template
- Distinguish between a control that is implemented, partially implemented, and planned, and score rather than optimistically
- Document a Plan of Action and Milestones that a future assessor, or a DOJ attorney, would find credible rather than performative
- Explain, in writing, why the score reflects the system's current state and not its state eighteen months ago
That is a governance, risk, and compliance skill set, and it is exactly what ISC2's CGRC certification is built to validate: the ability to authorize and maintain federal information systems against a defined control baseline, which is the same discipline NIST 800-171 self-assessment demands. Companies that have historically outsourced this work to a consultant brought in once a year for the affirmation are now carrying more risk than they did when Phase 2 looked imminent, because the external check that was supposed to catch errors is the part that got paused.
If your compliance function currently consists of one person who inherited the SPRS login and a folder of old assessments, that is worth fixing before a contracting officer or a whistleblower finds the gap for you. You can start training a compliance lead now, while the third-party requirement is dormant, so the internal self-assessment is actually defensible rather than aspirational. Forge University's resources page has curriculum breakdowns that make it easier to see exactly which control domains a CGRC track covers before you commit a budget line to it.
What This Means for the Procurement Conversation
Executives sitting on the buy side of defense contracting, prime contractors evaluating subcontractors, should treat the Phase 2 pause as a reason to ask harder questions, not fewer. A subcontractor telling you "CMMC isn't required yet" is technically correct and substantively evasive. The question that matters is whether their NIST 800-171 self-assessment was built by someone who understands the control set, and whether they can produce a Plan of Action and Milestones that would hold up if the DOJ ever asked to see it.
| Requirement | Status as of the Phase 2 pause | Still legally binding |
|---|---|---|
| NIST SP 800-171 implementation | Required under DFARS 7012 | Yes |
| Annual SPRS self-assessment score | Required, self-attested | Yes |
| Third-party C3PAO certification | Suspended, no confirmed resume date | No, currently |
| False Claims Act exposure for false attestation | Unaffected by CMMC rollout phase | Yes |
The pause changes who checks your work. It does not change what you owe. Contractors that use this window to build internal capability, rather than internal complacency, will be the ones who clear Phase 2 quickly whenever it resumes, and who are not the next name on a DOJ settlement list in the meantime.
For a prime contractor building a vendor qualification process, that means the staffing line on a subcontractor's capability statement deserves the same scrutiny as their SPRS score itself. A company with a credentialed GRC lead on staff is making a different bet than one relying on a template someone downloaded two years ago, and the difference only becomes visible when something goes wrong.