Most Recent News From the DoD Regarding CMMC: The Government Paused It. Your Prime Contract Didn't.

DoD's pause only stopped the federal government from designating Level 2 (C3PAO) or Level 3 (DIBCAC) in new solicitations. It did not touch what your prime contractor requires from you, and it did not touch the legal weight of the SPRS score you've already submitted. L3Harris set a July 30, 2026 deadline for suppliers to hold Level 2 certification, on its own authority, months before the pause, and never withdrew it. If your compliance plan assumes the federal pause covers your prime relationship, it doesn't.

What Actually Paused, and What Didn't

The July 13 memo restricts what DoD contracting officers can put in new solicitations. Program managers can only designate Level 1 (Self) or Level 2 (Self) for now. Contracting officers were told to remove Level 2 and Level 3 language from active solicitations, but existing contracts get modified at the next option period or scheduled administrative action, not automatically and not immediately.

None of that reaches your subcontract with a prime. Primes were enforcing their own supplier cybersecurity requirements before the federal rollout began, and several kept enforcing them straight through the pause.

• L3Harris required Level 2 certification from suppliers by July 30, 2026, a deadline it set in April under its own contract authority. The pause didn't move it.
• RTX issued a supplier survey in March 2026 requesting alignment with Level 2 (C3PAO) requirements.
• HII began flowing down Level 2 (C3PAO) requirements in the fourth quarter of 2025 and plans Level 3 (DIBCAC) by the fourth quarter of 2026, running roughly a year ahead of the government's original schedule.

A federal certification mechanism was never the only thing driving these deadlines. Whether a prime trusts you with their contract, and with their own compliance chain, was always part of the calculation.

Why Your SPRS Score Carries More Legal Weight Than the Pause Suggests

Here's the part that gets lost in "CMMC is paused" headlines. DFARS 252.204-7012 requires you to implement NIST SP 800-171 Rev 2 and submit an accurate score to the Supplier Performance Risk System. That score is a representation to the federal government. Submitting one you can't support is a False Claims Act problem, not a CMMC problem, and the FCA doesn't care whether a C3PAO ever reviewed your work.

The Framework We're Using With Clients Right Now

1. Treat your SPRS affirmation as a legal document, not a form. A signed score is evidence in any future FCA inquiry, contract dispute, or prime audit. Outdated or optimistic scoring creates exposure that a pause does nothing to shrink.
2. Separate your federal obligations from your prime obligations. Confirm in writing whether your specific prime's flow-down clause changed after July 13. Most haven't.
3. Keep your evidence current regardless of assessment status. System Security Plans, Plans of Action and Milestones, and control evidence matter whether a C3PAO ever sees them or not; they're what defends your SPRS score if it's ever challenged.
4. Watch the assessor market, not just the mandate. Third-party assessment firms are reporting contract cancellations and layoffs following the pause. If your prime still wants Level 2 certification and the C3PAO pipeline keeps shrinking, waiting could put you behind a supply squeeze that has nothing to do with DoD's timeline.

A Pacific Northwest Example

Consider a 70-person structural components supplier in Everett feeding a Tier 1 aerospace prime. Their DoW contract only requires Level 1 self-assessment today, so the federal side looks simple. Their prime's supplier portal, updated after the July pause, still lists Level 2 (C3PAO) certification as a requirement to remain an approved vendor going into 2027.

If this supplier waits for DoD's Reform Task Force before acting, they're not waiting on the requirement that actually governs their business relationship. They're also competing for a shrinking pool of C3PAO assessment slots against every other supplier who assumed the pause meant they had more time than they do.

This is a representative scenario built from patterns we see across PNW aerospace and manufacturing suppliers. It isn't a specific client engagement.

What to Watch Next

• Now: Confirm your prime's current flow-down language directly. Don't assume a federal pause changed a contractual requirement your prime controls.
• Mid-September 2026: The CMMC Reform Task Force delivers recommendations to the DoD CIO. This affects future federal designations, not existing prime contracts.
• Ongoing: Third-party assessment firms are already seeing reduced business, according to recent reporting from National Defense Magazine. If your prime still requires certification, a shrinking assessor market works against you the longer you wait.

The Bottom Line on CMMC and Prime Contractor Requirements

DoD paused its own certification mandate. Your prime's contract, your DFARS 252.204-7012 obligations, and the legal weight of your SPRS score all moved forward without it. Contractors who treat the federal pause as the end of the conversation are missing the half of this that was never up to DoD in the first place.

inTech Consulting works with aerospace, DoD supply chain, and manufacturing clients across Washington, Oregon, and Idaho on CMMC compliance and the broader compliance and risk requirements tied to DFARS 252.204-7012. Our team supports aerospace, Department of Defense, and manufacturing suppliers with gap assessments, SPRS score validation, and 24/7 SOC monitoring built around NIST 800-171 Rev 2.

Frequently Asked Questions

Does the CMMC pause change what my prime contractor requires from me?

No. The July 13, 2026 pause only restricts what the Department of War can designate in new federal solicitations. Prime contractors set their own supplier requirements under their own contract authority, and several, including L3Harris, RTX, and HII, have kept their Level 2 or Level 3 flow-down deadlines in place regardless of the federal pause.

Is my SPRS score still legally binding during the CMMC pause?

Yes. Your SPRS score is a representation to the federal government under DFARS 252.204-7012, and that requirement hasn't changed. An inaccurate or outdated score can create False Claims Act exposure whether or not a third-party assessor ever reviews it.

Can I still get CMMC Level 2 certification while Phase 2 is paused?

Yes. C3PAO assessments, CAICO training, exams, and Registered Practitioner services all remain available. The pause only stops DoD from requiring the certificate in new contracts; it doesn't stop the certification program itself.

When will the CMMC Reform Task Force issue its recommendations?

The Task Force is expected to report to the DoD CIO around mid-September 2026. Legal analysts caution that any binding regulatory change, such as a class deviation or DFARS amendment, likely won't follow until October 2026 or later.

Should I stop working toward CMMC compliance until the pause is resolved?

No. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 remain fully in force regardless of CMMC's certification timeline, and many prime contractors are enforcing their own deadlines independent of the federal schedule. Pausing your compliance work risks falling behind both your legal obligations and your prime's requirements.