By Raj Sidhu, Founder & CEO, inTech Consulting. Author of "Beyond the Prompt: A Business Owner's Guide to Understanding AI." Published August 2026. Last reviewed September 15, 2026.

CMMC certification is still available even though the Department of War paused the certification mandate. The Cyber AB confirmed on July 15, 2026 that C3PAO assessments, CAICO training, exams, and Registered Practitioner services all continue to run. Contractors are still booking assessments. No contract can require the certificate right now. Nothing stops a contractor from earning it anyway, and many primes want them to.

What does the current guidance actually say?

As of September 3, 2026, the governing instrument is DARS Class Deviation 2026-O0025 Revision 3, not a memorandum. Revision 3 superseded Revision 2 from July 16 and moved the suspension out of enforcement-discretion language and into DFARS Part 240 text. Under it, CMMC Level 1 and Level 2 can be satisfied by self-assessment, and contracting officers are directed to remove or revise CMMC requirements in new and existing solicitations.

The earlier USD(A&S) Memorandum 26-P-1023 spelled out the same restriction in more detail than the July 13 press release did: program managers could designate only CMMC Level 1 (Self) or Level 2 (Self), with Level 2 (C3PAO) and Level 3 (DIBCAC) designations off the table and no waivers available to bring them back early. Revision 3 carries that restriction forward in regulatory text. Read the memorandum as history and Revision 3 as the current rule.

That is a contracting restriction, not a program shutdown. Here is what stays fully operational, according to the Cyber AB's official statement:

1. C3PAO Level 2 certification assessments continue for contractors who want one.
2. CAICO training and professional exams run on the normal schedule.
3. Registered Practitioner services remain available to help contractors prepare.
4. DIBCAC's assessment of C3PAOs continues, keeping the assessor pipeline intact.

The Cyber AB said it was surprised by the pause but remains confident in the program, and that it will cooperate fully with the Reform Task Force review.

Why would a contractor get certified when no contract requires it?

Three reasons keep coming up with our clients, and none of them depend on federal timing.

Primes ask for it anyway. A prime contractor's own flow-down requirements are not bound by the federal restriction. Primes are setting CMMC expectations on their own timeline, ahead of any specific contract requirement. L3Harris set a July 30, 2026 Level 2 deadline for its suppliers under its own contract authority and never withdrew it. If your prime wants Level 2 certification to keep you in its supply chain, a class deviation does not change their leverage.

False Claims Act exposure does not pause. Every SPRS score is a legal representation to the federal government. Third-party validation is the strongest evidence that the number is accurate. Without it you rely entirely on your own documentation if that score is ever challenged. DCMA also retains authority to run a Medium or High assessment on any covered system at any time, and that result overrides the score you posted yourself.

The queue will not stay short. Roughly 100,000 companies in the Defense Industrial Base need a Level 2 assessment. Fewer than 100 authorized C3PAOs can perform them. If third-party assessment returns to solicitations, contractors who scheduled during the lull move ahead of everyone who waited. The CyberSheath 2026 State of the DIB report, covering 302 contractors, found self-reported scores at a multi-year high while confidence in those scores sat at the lowest level ever recorded. That gap is what a third-party assessment closes.

Not sure if certifying now fits your contract mix? Our CMMC Readiness Checklist breaks down what a gap assessment should cover before you schedule a C3PAO review during the pause. Download the checklist.

What is the FAR CUI Rule, and does the CMMC pause affect it?

It does not. The FAR CUI Rule, FAR Case 2017-016, is a government-wide rulemaking covering how contractors handle controlled unclassified information across all federal contracts, not just defense. Public comments closed July 23, 2026, and as drafted the rule applies regardless of what happens to CMMC.

Contractors sometimes treat "CMMC" and "CUI handling requirements" as the same conversation. They are not. CMMC is the certification mechanism for verifying compliance. The FAR CUI Rule is a separate legal requirement for protecting CUI across the federal government. Pausing one says nothing about the other.

What does this look like for a Pacific Northwest supplier?

The following is an illustrative example, built from patterns we see across PNW aerospace suppliers. It is not a specific client engagement.

Picture a 60-person precision machining shop in Spokane, Washington, supplying a Tier 1 aerospace prime. Its contract requires only Level 2 self-assessment today, so it meets the current bar on paper. The prime updated its own supplier security requirements in June, and those requirements ask for third-party Level 2 certification to stay an approved vendor by early 2027.

Waiting carries a cost. Thousands of contractors may try to schedule a C3PAO assessment at once, against a pool of fewer than 100 authorized assessors. Starting while the queue is shorter protects both the prime relationship and the shop's own timeline.

What should contractors watch next?

• Around September 28, 2026. The CMMC Reform Task Force delivered its findings to the DoW CIO internally around September 13, 2026. The public report is expected around September 28. That report is the clearest signal on whether Level 2 (C3PAO) designations return, in what form, and on what timeline.
• The Federal Register and DoW CIO actions. No date has been set for third-party assessment returning to solicitations. Any change shows up here first, not on a calendar.
• Assessor availability, right now. C3PAO assessment slots remain open. Availability is a function of demand, and demand will move the moment the program's direction becomes clear.
• Your certification's clock. Conditional status is valid 180 days before converting to Final, which is valid 3 years. A certification earned during the pause still runs on that schedule.

What is the bottom line?

The Department of War paused its own mandate for third-party CMMC certification. The certification program itself never stopped. Your DFARS 252.204-7012 obligations never stopped. All 110 NIST SP 800-171 Rev 2 controls never stopped. The separate FAR CUI rulemaking keeps moving on its own schedule. Contractors who treat this pause as a reason to slow down carry real exposure: prime flow-down requirements, SPRS accuracy risk, and a shrinking window before the assessor queue fills back up.

inTech Consulting works with aerospace, defense supply chain, and manufacturing clients across Washington, Oregon, Idaho, and Montana on CMMC 2.0 and NIST SP 800-171 compliance consulting and the broader compliance and risk landscape tied to DFARS 252.204-7012. Our team supports aerospace and Department of Defense suppliers with gap assessments, SPRS score validation, and 24/7 monitoring built around NIST SP 800-171 Rev 2. inTech is not a C3PAO and does not perform assessments.

Weighing whether to schedule certification now or wait for the public Task Force report? Book a free 30-minute readiness call with Raj to talk through your contract requirements and timeline. Schedule your call. We serve defense contractors across Washington, Oregon, Idaho, and Montana.