CMMC certification is still available even though DoD paused the certification mandate. The Cyber AB confirmed on July 15 that C3PAO assessments, CAICO training, exams, and Registered Practitioner services all continue to run. Contractors are booking assessments this month. No DoW contract can require the certificate right now. Nothing stops a contractor from earning it anyway, and many primes want them to.
A formal memorandum, USD(A&S) Memorandum 26-P-1023, spells out the pause in more detail than the July 13 press release. Program managers can only designate CMMC Level 1 (Self) or Level 2 (Self) in solicitations for now. Level 2 (C3PAO) and Level 3 (DIBCAC) designations are off the table. DoD will not grant waivers to bring them back early.
That’s a contracting restriction, not a program shutdown. Here’s what stays fully operational during the review, according to the Cyber AB’s official statement:
The Cyber AB said it was surprised by the pause but remains confident in the program. It will cooperate fully with the Reform Task Force review.
If DoD can’t require the certificate, why would anyone pay for one? Three reasons keep coming up with our clients.
Primes ask for it anyway. DoD can’t mandate C3PAO certification during the pause. A prime contractor’s own flow-down requirements aren’t bound by that restriction. If your prime wants Level 2 certification to stay in their supply chain, the pause doesn’t change their leverage.
False Claims Act exposure doesn’t pause. Every SPRS score is a legal representation to the federal government. Third-party validation is the strongest evidence that the number is accurate. Without it, you rely entirely on your own documentation if that score is ever challenged.
The queue won’t stay short. Roughly 100,000 companies in the Defense Industrial Base need a Level 2 assessment. Fewer than 100 authorized C3PAOs can perform them. If the Reform Task Force reinstates a third-party requirement after its mid-September report, contractors who scheduled assessments during the lull will move ahead of everyone who waited.
Not sure if certifying now fits your contract mix? Our CMMC Readiness Checklist breaks down what a gap assessment should cover before you schedule a C3PAO review during the pause. Download the checklist.
Attention has focused on Phase 2, but a related rule keeps advancing on its own track. The FAR CUI Rule, FAR Case 2017-016, is a government-wide rulemaking covering how contractors handle controlled unclassified information across all federal contracts, not just DoD. Public comments closed July 23, 2026. As drafted, the rule applies regardless of what happens to CMMC. You can review the proposed rule text on regulations.gov for the current status.
Contractors sometimes treat “CMMC” and “CUI handling requirements” as the same conversation. They aren’t. CMMC is DoD’s certification mechanism for verifying compliance. The FAR CUI Rule is a separate legal requirement for protecting CUI across the federal government. Pausing one says nothing about the other.
Picture a 60-person precision machining shop in Spokane that supplies a Tier 1 aerospace prime. Their DoW contract only requires Level 2 self-assessment today, so they meet the current bar on paper. Their prime updated its own supplier security requirements in June. Those requirements ask for third-party Level 2 certification to stay an approved vendor by early 2027.
Waiting for DoD’s post-September decision carries a cost. Thousands of contractors may try to schedule a C3PAO assessment at the same time, against a pool of fewer than 100 authorized assessors. Starting now, while the queue is shorter, protects both the prime relationship and the shop’s own timeline.
This is a representative scenario built from patterns we see across PNW aerospace suppliers. It isn’t a specific client engagement.
DoD paused its own mandate for third-party CMMC certification. The certification program itself never stopped. Your DFARS 252.204-7012 obligations never stopped. The separate FAR CUI rulemaking keeps moving on its own schedule. Contractors who treat this pause as a reason to slow down carry real exposure: prime flow-down requirements, SPRS accuracy risk, and a shrinking window before the assessor queue fills back up.
inTech Consulting works with aerospace, DoD supply chain, and manufacturing clients across Washington, Oregon, and Idaho on CMMC compliance and the broader compliance and risk landscape tied to DFARS 252.204-7012. Our team supports aerospace and Department of Defense suppliers with gap assessments, SPRS score validation, and 24/7 SOC monitoring built around NIST 800-171 Rev 2.
Weighing whether to schedule certification now or wait for the Task Force report? Book a free 30-minute readiness call with Raj to talk through your contract requirements and timeline. Schedule your call. We serve defense contractors across Washington, Oregon, and Idaho.
