CMMC Phase 2 Is Paused. Your NIST 800-171 Score Still Counts.

On November 10, 2026, CMMC Phase 2 was supposed to start requiring third-party certification for defense contractors that handle Controlled Unclassified Information (CUI). That date is no longer coming. The Department of War suspended Phase 2 in July and is still deciding what CMMC looks like next.

Plenty of small and mid-sized manufacturers heard "paused" and pulled back. That is the wrong reading. DFARS 252.204-7012 still requires NIST SP 800-171. Your self-assessment score still sits in the Supplier Performance Risk System (SPRS). And the Justice Department has kept settling False Claims Act cases with contractors whose scores did not match reality.

This brief is for owners, CFOs, and contracts leads at defense suppliers. It covers what the pause changed, what it did not, and a firewall flaw that should be patched before Monday.

Executive takeaway

• What paused: The planned expansion of mandatory third-party (C3PAO) CMMC Level 2 assessments, which had been set to start on November 10, 2026. (WilmerHale)
• What did not pause: DFARS 252.204-7012, NIST SP 800-171 Rev. 2, Phase 1 self-assessments, annual affirmations, and posting your score in SPRS. The Department says it will enforce through self-assessments and selected government-led assessments.
• The legal exposure: In June, LOGZONE agreed to pay $507,144 after a DCMA assessment scored it -170 on a scale that runs from -203 to 110. In September, Honeywell Aerospace agreed to pay $2,042,518. Both resolved allegations only. (DOJ)
• This weekend: CISA added Cisco firewall flaw CVE-2026-76418 to its exploited list on October 29, with a November 1 deadline for federal agencies. (CISA)

What did the CMMC Phase 2 pause actually change?

On July 13, 2026, the Department of War suspended Phase 2 and paused pending CMMC milestones while a reform task force reviewed the program. Phase 2 would have required Level 2 certification assessments by accredited third-party assessors (C3PAOs) for contractors handling CUI. For contracts that already include Phase 2 or Phase 3 requirements, contracting officers are directed to remove them by modification.

The Department's CIO memo says solicitations may only require CMMC Level 1 (Self) or Level 2 (Self) status during the suspension. (DoW CIO memo, PDF)

In plain terms, the government paused the outside auditor. It did not pause the rules the auditor would have checked.

What does the government say comes next?

Federal News Network obtained a summary of the task force's findings. One option is to restart Phase 2 within 90 days for a narrower group of contractors. Others include extending plan of action and milestones (POA&M) deadlines to 270 days, which would need rulemaking, and moving to NIST SP 800-171 Revision 3. (Federal News Network)

More than 2,300 companies already hold Level 2 certification. Nobody yet knows exactly what the next version of the program will require. Planning around "it might go away" is a bet, and the people who lose that bet are the ones who stopped working on controls.

Why does your SPRS score still matter during the pause?

Your SPRS score is a statement your company makes to the government about its security. If you bill on a contract that requires NIST SP 800-171, and the score or the representations behind it are not accurate, that is the kind of gap the False Claims Act reaches.

Eric Crusius, a partner at the law firm Hunton, put it plainly to Federal News Network: "a lot of companies are conflating the pause of third-party assessments with the lack of a need to comply with the underlying security controls." He added that NIST 800-171 remains a requirement, with risks from the False Claims Act, contract cancellations, and poor performance ratings.

What do recent False Claims Act settlements show?

• LOGZONE (June 18, 2026): The Huntsville, Alabama contractor agreed to pay $507,144 to resolve allegations tied to two Navy contracts. From May 2021 to March 2025 it allegedly failed to implement certain NIST SP 800-171 controls. A DCMA assessment produced a score of -170, near the bottom of the -203 to 110 range. (DOJ)
• Honeywell Aerospace (September 1, 2026): The company agreed to pay $2,042,518 to resolve allegations that a business unit failed to meet NIST SP 800-171 requirements on one network from April 2020 through December 2023. The case began as a whistleblower suit by a former employee, who will receive $375,823. (DOJ)

Both settlements resolve allegations only, with no determination of liability. The pattern is still clear. The government checks scores, and employees can bring cases.

Which firewall flaw should defense suppliers patch this weekend?

CVE-2026-76418 affects the Remote Access SSL VPN on Cisco ASA and Firepower Threat Defense devices. An unauthenticated attacker can force the device to reload when secondary authentication is configured on a tunnel group. Cisco says it was exploited in October, and there is no workaround, though disabling secondary authentication mitigates it. Shadowserver counted more than 51,000 exposed devices. (BleepingComputer)

A firewall that keeps rebooting is a production problem for a shop floor and a remote workforce. It is also a compliance problem. NIST SP 800-171 requirement 3.14.1 covers identifying and correcting system flaws in a timely way, and 3.13.1 covers monitoring and protecting the network boundary. (NIST SP 800-171 Rev. 2)

Does an outage count as a security incident?

Treat it like one until you know otherwise. If your VPN reloads repeatedly, keep the logs, open a ticket, and check with counsel or your provider on whether DFARS 252.204-7012 incident reporting applies. That clause also requires preserving images of affected systems when a reportable incident occurs.

What should a defense supplier do in the next 30 days?

1. Patch or mitigate Cisco ASA and FTD. Apply Cisco's fixed release, or disable secondary authentication on affected tunnel groups until you can.
2. Re-check your SPRS score. Compare it line by line to your System Security Plan (SSP). If a control is marked implemented, someone should be able to show it working today.
3. Update your POA&M with dates and owners. Open items without owners read like intent to never fix them.
4. Confirm phishing-resistant MFA on email, VPN, and remote access. It is one of the 10 practices in the Department's "Brilliant at the Basics" campaign, alongside risk-based vulnerability management and resilient backup and recovery.
5. Map where CUI actually lives. Shrinking that footprint is often the cheapest compliance win.
6. Keep dated evidence. Patch tickets, MFA reports, and access reviews are what a government-led assessment, or a whistleblower's lawyer, will ask for.

What should we ask our IT provider in writing?

• What is our current SPRS score, and when was it last checked against the actual environment?
• Which NIST SP 800-171 requirements are on our POA&M, and when will each close?
• Are our Cisco firewalls patched for CVE-2026-76418, and where is the ticket?
• Is phishing-resistant MFA enforced for every remote connection into the CUI environment?
• If a DCMA assessor arrived next month, what evidence could we hand over the same day?

Standard IT vs. Defensible IT: what is the difference for a defense supplier?

Standard IT treats the pause as a break. Defensible IT treats it as time to close gaps before someone else measures them.

Standard IT asks whether CMMC is still happening. Defensible IT asks whether the score you posted would survive a DCMA review this month.

Standard IT looks like this:

• A self-assessment score entered once and not revisited.
• A System Security Plan written for a bid and never updated.
• Firewall updates applied during the next maintenance window, whenever that is.
• MFA on email but not on every VPN connection.
• Evidence gathered in a rush when someone asks for it.

Defensible IT looks like this:

• A score tied to the SSP and re-checked against the live environment.
• A POA&M with owners and dates that leadership reviews.
• Same-day critical updates for exploited firewall and VPN flaws, with dated tickets, as part of compliance-first managed IT services.
• Phishing-resistant MFA on every remote path into CUI.
• 24x7 managed detection and response, with evidence collected into an automatically updated compliance binder.

How does Emry Networks help defense suppliers in Jacksonville FL, Manchester NH, and nationwide?

Emry Networks provides managed IT, cybersecurity, and IT compliance for defense suppliers, manufacturers, and other regulated industries across the United States, from hubs in the Jacksonville, FL and Manchester, NH areas. We work on all-inclusive flat monthly pricing, so a new POA&M item does not come with a surprise invoice. Every engagement follows a 90-day blueprint:

• Phase 1 (Days 1-30): Scoping, a baseline gap assessment, and software deployment. We map where CUI lives, check your SPRS score against the actual environment, and deploy monitoring and endpoint protection.
• Phase 2 (Days 31-60): Tool implementation and policy authoring. We put patching, MFA, logging, and backup controls in place, and update your SSP and POA&M to match.
• Phase 3 (Days 61-90): Verification and a second gap assessment. We test the controls, re-score against NIST SP 800-171, and hand you before-and-after evidence.

Not sure your SPRS score would hold up? Book a 30-Minute Risk Assessment. We will review your score, your POA&M, and your perimeter, and tell you plainly where a DCMA assessor would push.

Next Steps for Your Company

• Take the free Compliance Readiness Assessment to see where you stand.
• Read our guide on which compliance framework applies to your business.
• Book a 30-Minute Risk Assessment with our team.

Frequently asked questions

Is CMMC canceled?

No. The Department of War suspended Phase 2 on July 13, 2026 and is reviewing the program. Phase 1 self-assessment requirements remain in place, and options under discussion include restarting Phase 2 for a narrower group of contractors.

Do we still have to comply with NIST SP 800-171 during the pause?

Yes. Contracts that include DFARS 252.204-7012 still require NIST SP 800-171 Rev. 2. The Department has said it will enforce compliance through self-assessments and selected government-led assessments during the suspension.

What happens if our SPRS score is wrong?

An inaccurate score can create False Claims Act exposure if you bill on contracts that require the controls. In June 2026, LOGZONE agreed to pay $507,144 after a DCMA assessment scored it -170. Settlements like this resolve allegations only.

What is CVE-2026-76418?

It is a flaw in the Remote Access SSL VPN on Cisco ASA and Firepower Threat Defense devices. An unauthenticated attacker can force the device to reload when secondary authentication is set on a tunnel group. Cisco says it was exploited in October 2026, and CISA set a November 1 federal deadline.

Should we still pursue a third-party CMMC assessment?

It depends on your contracts and customers. Some primes still ask for it, and Crusius noted that a third-party audit can make it harder to argue a company was reckless. Either way, the controls and an accurate score come first.