--- title: "CMMC Phase 2 Suspended: What it Means for Defense Contractors" description: CMMC Phase 2 audits are suspended, but defense contractors must still prioritize compliance and security to protect federal data and avoid penalties. Read more. image: https://www.tmgcinc.com/hubfs/CMMC%20Phase%202%20Suspended.webp --- [Skip to the main content.](https://www.tmgcinc.com/blog/cmmc-phase-2-suspended#main-content) [![TMGC_Logo_Main_V1](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1.webp?width=130&height=112&name=TMGC_Logo_Main_V1.webp "TMGC_Logo_Main_V1")](https://www.tmgcinc.com/) [![TMGC_Logo_Main_V1](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1.webp?width=150&height=129&name=TMGC_Logo_Main_V1.webp "TMGC_Logo_Main_V1")](https://www.tmgcinc.com/) - [Fractional IT Services](https://www.tmgcinc.com/fractional-it-services) - What We Do - [Complete IT Management](https://www.tmgcinc.com/fractional-it-services) - [Cybersecurity](https://www.tmgcinc.com/managed-cybersecurity-services) - [Service Desk](https://www.tmgcinc.com/it-help-desk-services) - [Data Protection & Recovery](https://www.tmgcinc.com/data-backup-recovery) - [Cloud & Hosting](https://www.tmgcinc.com/managed-cloud-hosting-services) - [Compliance Management](https://www.tmgcinc.com/it-compliance-services) - [IT Infrastructure](https://www.tmgcinc.com/it-infrastructure-management) - [Licensing & Software Management](https://www.tmgcinc.com/it-licensing-management) - [Device Management](https://www.tmgcinc.com/it-device-management) - Industries - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [AEC](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Financial Services](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Defense Contractors](https://www.tmgcinc.com/it-support-defense-contractors) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) - Resources - [About Us](https://www.tmgcinc.com/about) - [Blog](https://www.tmgcinc.com/blog) - [Case Studies](https://www.tmgcinc.com/case-studies) - [Guide to CMMC Compliance](https://www.tmgcinc.com/cmmc-compliance-everything-defense-contractors-need-to-know-in-2026) - [Guide to Workplace AI Security](https://www.tmgcinc.com/workplace-ai-security-guide) - [AI Readiness Quiz](https://www.tmgcinc.com/ai-security-readiness-quiz-tmgc) [GET STARTED](https://www.tmgcinc.com/contact) Toggle Menu Toggle Menu [GET STARTED](https://www.tmgcinc.com/contact) - [Fractional IT Services](https://www.tmgcinc.com/fractional-it-services) - What We Do - [Complete IT Management](https://www.tmgcinc.com/fractional-it-services) - [Cybersecurity](https://www.tmgcinc.com/managed-cybersecurity-services) - [Service Desk](https://www.tmgcinc.com/it-help-desk-services) - [Data Protection & Recovery](https://www.tmgcinc.com/data-backup-recovery) - [Cloud & Hosting](https://www.tmgcinc.com/managed-cloud-hosting-services) - [Compliance Management](https://www.tmgcinc.com/it-compliance-services) - [IT Infrastructure](https://www.tmgcinc.com/it-infrastructure-management) - [Licensing & Software Management](https://www.tmgcinc.com/it-licensing-management) - [Device Management](https://www.tmgcinc.com/it-device-management) - Industries - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [AEC](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Financial Services](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Defense Contractors](https://www.tmgcinc.com/it-support-defense-contractors) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) - Resources - [About Us](https://www.tmgcinc.com/about) - [Blog](https://www.tmgcinc.com/blog) - [Case Studies](https://www.tmgcinc.com/case-studies) - [Guide to CMMC Compliance](https://www.tmgcinc.com/cmmc-compliance-everything-defense-contractors-need-to-know-in-2026) - [Guide to Workplace AI Security](https://www.tmgcinc.com/workplace-ai-security-guide) - [AI Readiness Quiz](https://www.tmgcinc.com/ai-security-readiness-quiz-tmgc) [Linkedin](https://www.linkedin.com/company/the-millennium-group-computing/) 3 min read # CMMC Phase 2 Suspended: What it Means for Defense Contractors [Tony DiDonato](https://www.tmgcinc.com/blog/author/tony-didonato) : Updated on July 28, 2026 [CMMC](https://www.tmgcinc.com/blog/tag/cmmc) ![CMMC Phase 2 Suspended: What it Means for Defense Contractors](https://www.tmgcinc.com/hubfs/CMMC%20Phase%202%20Suspended.webp) On July 13, the Department of War [suspended the CMMC Phase 2](https://www.war.gov/News/Releases/Release/Article/4542329/forging-the-arsenal-of-freedom-department-of-war-suspends-cmmc-phase-ii-require/) audit requirement. If you're a defense contractor, you've probably already heard, and you're probably asking the same question I've fielded from half our client list this week: does this mean the compliance work can wait? Short answer: not really. Here's what’s happened and my take on what it means for defense contractors moving forward.   ## Phase 2 Suspension Announcement The Department of War suspended the CMMC Phase 2 requirement, which was set to take effect November 10, 2026. That's the part of [CMMC](https://www.tmgcinc.com/cmmc-compliance-everything-defense-contractors-need-to-know-in-2026) that would have required companies handling Controlled Unclassified Information (CUI) to pass a third-party audit from a Certified Third-Party Assessor Organization, or C3PAO, before they could win or keep a contract. Phase 1 isn't affected. If your contract requires a [Level 1 or Level 2 self-assessment](https://www.tmgcinc.com/cmmc-level-1-vs-level-2)through SPRS, that requirement is still fully in place today. The Department also established a CMMC Reform Task Force to study the program for 60 days and report back on what comes next.   ## Why the Department Pulled the Plug This was a math problem. [DoD Chief Information Officer Kirsten Davies told reporters](https://thenextweb.com/news/pentagon-pauses-cmmc-cyber-audit-rule) that roughly 100 certified assessors exist to audit more than 100,000 businesses that needed third-party certification before the November deadline. In her words, "the math just simply doesn't math." Add to that the cost. A single Level 2 audit runs $30,000 to $50,000 for a small or mid-sized shop, on top of everything you've already spent getting ready. [Small Business Administration data](https://legis1.com/news/small-business-defense-contracts-plummet-despite) reportedly showed that requirement alone was pushing innovative companies out of the defense supply chain entirely, right when the Pentagon needs them the most. So the Department pulled the audit requirement. But we need to dig a little deeper to realize that it didn't pull the security standard behind it.   ## What Happens to Level 2 Now? During the review period, the Department says it will enforce compliance through self-assessments and select government-led reviews rather than mandatory third-party audits. In plain terms, Level 2 is very likely shifting to a self-attestation model for now, the same approach that's already covered Level 1 since last November. On one side of the coin, that's a real relief on cost. Now you’re not forced to pay $30,000+ for an audit. But it’s not a green light to stop your compliance and security program all together.   ## The Part I Need Everyone to Hear Suspending the audit doesn't suspend your legal obligation to protect federal data. Every defense contractor is still bound by [DFARS 252.204-7012](https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.), which requires you to safeguard covered defense information whether or not a C3PAO ever walks through your door. That means that many of the same [costs of CMMC non-compliance](https://www.tmgcinc.com/blog/cost-of-cmmc-non-compliance) still apply today. Self-attestation also isn't a free pass. If you sign your name to a claim of compliance you can't back up, [you're exposed to False Claims Act penalties](https://www.tmgcinc.com/blog/cost-of-cmmc-non-compliance), fines, and in serious cases, criminal charges. The Department of Justice's Civil Cyber-Fraud Initiative is still active and still pursuing companies that misrepresent their cybersecurity posture.   > *If anything, that risk grew a little, since there's no longer a third party checking your work before you certify it.*   I understand why this feels like a green light. I just don't want anyone caught off guard six months from now because they read it that way.   ## What I Think Happens Next My read: the Department moves toward spot-check audits on companies that win contracts, instead of universal audits across the entire industrial base. If you win the work and can't back up what you attested to, you risk losing it, and getting barred from bidding on the next one. That's a tougher spot to be in than a scheduled audit. A scheduled audit gives you time to prepare, but a spot-check after you've already won the contract is more of a make-or-break situation.   ## What Smart Contractors Should Do Right Now If you were budgeting for a C3PAO audit, that specific cost just came off the table. Great! Now put that money into closing your control gaps instead. Readiness is still what wins you the contract. It's just self-certified readiness for the moment instead of having the support and backing of a third-party verifying your claims. We're already helping clients work through the 110 controls in NIST SP 800-171 under this exact model: build the controls, document the evidence, self-attest with confidence instead of guesswork. At the end of the day, the audit got suspended but the standard didn't. The businesses that keep building toward Level 2 through this review period are the ones who'll be ready whenever the Department decides what comes next, and won't have to explain to a contracting officer why their attestation doesn't match reality. If you want a straight answer on where your business stands against these controls, I’m [happy to talk](https://www.tmgcinc.com/contact) or swing by your office.   [![Who Needs CMMC Certification? Industries That Are Caught Off Guard](https://www.tmgcinc.com/hubfs/Who%20Needs%20CMMC%20Certification.webp)](https://www.tmgcinc.com/blog/who-needs-cmmc-certification) 6 min read #### [Who Needs CMMC Certification? Industries That Are Caught Off Guard](https://www.tmgcinc.com/blog/who-needs-cmmc-certification) [Tony DiDonato](https://www.tmgcinc.com/blog/author/tony-didonato) : Apr 28, 2026, 5:11:31 PM Most companies that need CMMC certification don't find out until a prime contractor asks for documentation they don't have. By that point, a contract... [CMMC](https://www.tmgcinc.com/blog/tag/cmmc) [Read More](https://www.tmgcinc.com/blog/who-needs-cmmc-certification) [![CMMC 2.0 Explained: What Is CMMC Compliance?](https://www.tmgcinc.com/hubfs/What%20Is%20CMMC%20Compliance.webp)](https://www.tmgcinc.com/blog/what-is-cmmc-compliance-cmmc-2-explained) 6 min read #### [CMMC 2.0 Explained: What Is CMMC Compliance?](https://www.tmgcinc.com/blog/what-is-cmmc-compliance-cmmc-2-explained) [Tony DiDonato](https://www.tmgcinc.com/blog/author/tony-didonato) : Apr 8, 2026, 12:09:04 PM Most defense contractors don't think of themselves as cybersecurity companies. A machine shop thinks about tolerances and lead times. A small AEC... [CMMC](https://www.tmgcinc.com/blog/tag/cmmc) [Read More](https://www.tmgcinc.com/blog/what-is-cmmc-compliance-cmmc-2-explained) [![The Cost of CMMC Non-Compliance: What Defense Contractors Can Lose](https://www.tmgcinc.com/hubfs/Cost%20of%20CMMC%20Non-Compliance.webp)](https://www.tmgcinc.com/blog/cost-of-cmmc-non-compliance) 8 min read #### [The Cost of CMMC Non-Compliance: What Defense Contractors Can Lose](https://www.tmgcinc.com/blog/cost-of-cmmc-non-compliance) [Tony DiDonato](https://www.tmgcinc.com/blog/author/tony-didonato) : Apr 24, 2026, 11:56:09 AM You open an email from your prime contractor on a Tuesday morning and are presented with something you’ve been dreading for months, if not years. ... [CMMC](https://www.tmgcinc.com/blog/tag/cmmc) [Read More](https://www.tmgcinc.com/blog/cost-of-cmmc-non-compliance) Our Story Our Story Started in 1999, The Millennium Group Computing is a proud veteran-owned business that is a complete technology solution provider. We are 100% committed to making sure business owners have the most reliable and professional IT service in Denver Metro. Our team of talented IT professionals can solve your IT nightmares once and for all. ###### ![](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1%20(1).webp?width=125&height=108&name=TMGC_Logo_Main_V1%20(1).webp) Who We Serve Who We Serve - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [Engineering](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Defense & Govcon](https://www.tmgcinc.com/it-support-defense-contractors) - [Financial](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) Resources Resources - [TMGC Blog](https://www.tmgcinc.com/blog) - [About Us](https://www.tmgcinc.com/about) - [Contact Us](https://www.tmgcinc.com/contact) - [Support](https://www.tmgcinc.com/customer-support) - [Contact Us](https://www.tmgcinc.com/contact) - [Support](https://www.tmgcinc.com/customer-support) - [Privacy Policy](https://www.tmgcinc.com/privacy-policy) © 2026 The Millennium Group Computing - Denver's Leader In IT Tech Services [Linkedin](https://www.linkedin.com/company/the-millennium-group-computing/) *Designed by [Warden Strategy](https://www.wardenstrategy.com/)* Return to top ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Tony DiDonato", "url" : "https://www.tmgcinc.com/blog/author/tony-didonato" }, "dateModified" : "2026-07-28T15:06:29.097Z", "datePublished" : "2026-07-15T00:42:18.000Z", "headline" : "CMMC Phase 2 Suspended: What it Means for Defense Contractors", "image" : [ "https://www.tmgcinc.com/hubfs/CMMC%20Phase%202%20Suspended.webp" ], "mainEntityOfPage" : { "@id" : "https://www.tmgcinc.com/blog/cmmc-phase-2-suspended", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.tmgcinc.com/hubfs/TMGC_Logo_Main_V1.webp" } } } ```