Yesterday was supposed to be the deadline. On November 10, 2026, CMMC Phase II requirements were scheduled to take effect, and small defense contractors handling Controlled Unclassified Information would have needed third-party certification to stay eligible for new contract awards. Instead, the requirement is on ice. The Department of War suspended Phase II back on July 13, 2026, after the Small Business Administration estimated that full third-party certification could cost a small firm roughly $593,800, against about $388,600 for firms eligible for the self-assessment path.
If you hold defense contracts or subcontract on them, this is not a stand-down order. It is a rebudgeting event. The assessment fee you were dreading is deferred, but every underlying security obligation is still enforceable, and the money you already spent still has to land in the right accounts. This post explains what was actually suspended, why the Pentagon hit pause, and how to handle your compliance budget so the pause saves you money instead of scrambling your books.
What Got Suspended, and What Did Not
The suspension targets one specific mechanism: the mandatory third-party assessment requirement under Phase II. Contractors handling CUI would have needed certification from a Certified Third-Party Assessment Organization, known as a C3PAO, to remain eligible for covered contracts. That certification gate is now paused pending a comprehensive program review, and no new date has been set.
Everything else kept running. Phase 1 self-assessment requirements remain fully in force, which means you still assess your own systems against NIST SP 800-171 Revision 2 and submit your scores through the Supplier Performance Risk System. DFARS clause 252.204-7012, the underlying contractual obligation to safeguard covered defense information, is unchanged and unaffected. If your contracts carry that clause, your duty to protect the information never blinked.
Think of it this way: the government paused the outside audit, not the homework. Your System Security Plan, your Plans of Action and Milestones for gaps you have not closed, your incident response readiness, and your current SPRS score all still matter. A contracting officer can still ask about them, and a prime contractor flowing requirements down to you can still demand evidence. The firms that treat the suspension as a vacation will be the ones scrambling hardest when the new timeline lands.
Why the Pentagon Hit Pause
Three factors drove the decision, based on the department's own public statements and industry reporting.
First, the cost burden. SBA analysis put total compliance costs at approximately $593,800 per certification for small firms requiring third-party assessment. That figure bundles remediation, documentation, tooling, and assessment fees, and for firms operating on defense-sector margins it was reportedly enough to push some out of the Defense Industrial Base entirely. The department's own narrower estimates tell the same story at smaller scale: roughly $105,000 over the three-year certification cycle for a small-entity Level 2 C3PAO assessment, and that covers the assessment alone rather than the security work behind it. Level 1 self-assessment runs about $6,000 a year, while a Level 2 self-assessment path totals roughly $37,000 over three years. With more than 100,000 small businesses in scope, the aggregate price tag looked like a barrier to entry for exactly the suppliers the Pentagon says it wants.
Second, assessor capacity. The number of accredited C3PAOs was not sufficient to process the volume of contractors needing certification ahead of the November deadline. A hard compliance date paired with too few assessors created a structural bottleneck the department could not resolve inside the existing timeline. Even contractors willing to pay could not be sure of getting assessed in time.
Third, policy alignment. The department's acquisition leadership has prioritized speed to capability and lower barriers to entry for small and non-traditional contractors. A multi-year, high-cost certification cycle was assessed as incompatible with that directive, so the suspension arrived alongside a comprehensive review run by a newly formed CMMC Reform Task Force. The public message was that cybersecurity itself is not being reduced, only the red tape around proving it.
None of these reasons suggest the requirement disappears. Cost pressure argues for a cheaper path, assessor shortages argue for a longer timeline, and acquisition reform argues for simpler mechanics. Every one of those outcomes still ends with you demonstrating compliance. Budget accordingly.
What This Means for Your Compliance Budget Right Now
Start by splitting your compliance budget into three buckets, because the suspension treats each one differently.
Bucket one is controls you already owe. Managed detection, log retention, multi-factor authentication, patching cadence, backup testing, security awareness training, and the documentation proving all of it: none of this was suspended. DFARS 252.204-7012 still requires it, Phase 1 self-assessment still scores it, and your SPRS score still advertises it. Keep funding this bucket at full strength. Cuts here do not save money; they manufacture findings for the eventual assessment and weaken your position in every bid that asks about your security posture.
Bucket two is the deferred certification fee. If you had a C3PAO assessment deposit scheduled or a readiness assessment scoped for the fall, that spend moves, it does not vanish. Do not reabsorb it into general funds and hope the rescheduled date brings its own budget. Park it visibly as a reserved amount so the future assessment does not arrive as a surprise. If you already paid a deposit, that payment is a prepaid asset, not an expense, and your books should say so until the assessment actually happens.
Bucket three is evidence hygiene that compounds either way. Gap remediation against NIST SP 800-171, POA&M maintenance, evidence collection routines, and subcontractor flow-down tracking all get cheaper the earlier you build them and more expensive the longer you defer them. This is the highest-return place to redirect any freed-up assessment money. A contractor with clean evidence can move fast when the new timeline appears; a contractor with a stale System Security Plan pays rush rates for the same work.
One more budget fact in your favor: compliance costs are generally treated as allowable on defense contracts. The department has stated that costs of complying with DFARS 252.204-7012 are likely allowable and chargeable to indirect cost pools, and certification costs have been described as an allowable, reimbursable cost. Allowable does not mean automatic, and it does not mean profitable, but it does mean disciplined tracking converts compliance spend from pure overhead into a documented contract cost. That only works if your books can show exactly what you spent, on which requirement, and when.
Book the Pause Correctly: Keep Assessment Money Visible
The accounting mistake the suspension invites is blurring these buckets together. A deposit paid toward a now-deferred assessment gets expensed as if the assessment happened. Tooling subscriptions get booked to generic IT instead of the compliance effort they support. Remediation contractor invoices pile into one account with no link to the control families they addressed. Six months later, nobody can reconstruct what the program cost or which dollars belong in an indirect pool.
Fix it with separate accounts from the start: assessment fees, security tooling, and remediation labor each get their own expense account, and any payment for work not yet performed sits in a prepaid asset until delivery. Here is the pattern for a small contractor that paid a readiness deposit in June, kept its detection tooling running through the suspension, and accrued a July remediation sprint against two NIST control families:
2026-01-01 open Assets:Cash:Operating USD
2026-01-01 open Assets:Prepaid:Compliance USD
2026-01-01 open Expenses:Compliance:Assessment-Fees USD
2026-01-01 open Expenses:Compliance:Security-Tooling USD
2026-01-01 open Expenses:Compliance:Remediation USD
2026-01-01 open Liabilities:Accrued:Compliance USD
2026-06-15 * "C3PAO" "Readiness deposit ahead of November Phase 2 deadline"
Assets:Prepaid:Compliance 15000.00 USD
Assets:Cash:Operating -15000.00 USD
2026-07-31 * "MSSP" "July managed detection and log retention"
Expenses:Compliance:Security-Tooling 1200.00 USD
Assets:Cash:Operating -1200.00 USD
2026-07-31 * "Contractor" "NIST 800-171 remediation sprint, access control and system protection families"
Expenses:Compliance:Remediation 8400.00 USD
Liabilities:Accrued:Compliance -8400.00 USD
2026-08-05 * "Contractor" "Pay July remediation invoice"
Liabilities:Accrued:Compliance 8400.00 USD
Assets:Cash:Operating -8400.00 USDNotice what the suspension changes in this ledger: nothing about the tooling or the remediation, which were always required, and nothing about the deposit, which stays right where it is. The $15,000 remains a prepaid asset because the assessment it pays for is deferred, not canceled. Expensing it now would overstate this year's compliance cost and then understate the assessment year's cost when the invoice arrives against a payment already forgotten. If you keep your books in plain text, the cost-tracking patterns in the docs extend naturally to a per-requirement compliance split like this one.
Name the requirement in every narration. When a future assessment, a DCAA inquiry, or your own close process asks what a charge was for, the narration is the answer. "Remediation sprint, access control and system protection families" survives scrutiny; "consulting" does not.
Four Mistakes That Turn a Pause Into a Penalty
The suspension is generous, but it punishes four specific behaviors.
First, going quiet on SPRS. Your self-assessment score is still your public security posture, and primes still check it before awarding subcontracts. A score that decays because you stopped updating it reads worse than a modest score you actively maintain. Keep the assessment current and keep closing POA&Ms on schedule.
Second, freezing remediation mid-stream. Half-migrated logging, a partially rolled-out privileged access tool, documentation that describes the old architecture: paused projects decay faster than steady-state operations. Either finish the control or formally re-scope it; do not leave it half-built until the new deadline forces a restart at rush rates.
Third, commingling compliance costs with general IT. The allowability treatment above depends on identification. If your detection platform, your assessor deposit, and your office laptops all flow through one IT account, you cannot demonstrate which dollars supported a contract requirement. Separate accounts cost nothing to maintain and are the difference between a documented indirect cost and an argument.
Fourth, letting subcontractor flow-down lapse. If you are a prime, your subs handling federal contract information or CUI still inherit obligations through your contracts regardless of the Phase II pause. If you are a sub, your prime's requirements did not get suspended by a department-level announcement. Review flow-down clauses now, while nobody is auditing, rather than discovering a gap during performance.
What to Watch Next
Three signals will tell you how the story ends. The Reform Task Force's recommendations were expected in the fall of 2026 and will sketch the replacement mechanics: possible reciprocity with other frameworks, tiered assessment paths, or a longer glide path for small firms. Watch for a new Phase II effective date, which resets every planning assumption in this post the day it is announced. And watch your own inbox from primes, because large contractors often impose their own supplier security requirements faster than the department moves, suspension or not.
Until then, the winning posture is boring: keep your Phase 1 house in order, keep your SPRS score honest, keep remediation funded, and keep every compliance dollar in an account that names the requirement it served. When the new timeline arrives, you want the only surprise to be how ready you already are. The last useful step is the smallest one: open your books this week and confirm your deferred assessment money is sitting in a prepaid asset, not buried in an expense account where next year's budget cannot find it.
