The short version
On July 13, 2026, the Department of War suspended CMMC Phase II, the phase that would have required defense contractors to pass a third-party assessment by a C3PAO for Cybersecurity Maturity Model Certification Level 2. It also stood up a CMMC Reform Task Force to deliver recommendations within 60 days.
The audit mandate is paused. The security obligation is not. Phase 1 self-assessment and the NIST SP 800-171 and DFARS 252.204-7012 requirements that protect Controlled Unclassified Information (CUI) still apply. If you handle CUI, you still have to protect it. What changed is how that gets verified, not whether it is required.
What changed, and what did not
| Before July 2026 | After the suspension | |
|---|---|---|
| Third-party C3PAO certification | Mandatory for Level 2 from November 10, 2026 | Suspended, under review |
| Phase 1 self-assessment | Required | Still required |
| NIST 800-171 controls | Required | Still required |
| Protecting CUI under DFARS | Required | Still required |
| SPRS score submission | Required | Still required |
| Program structure | CMMC 2.0 phased rollout | 60-day reform review |
The suspension removes a bottleneck, it does not remove the standard.
Why it happened
The math did not work. There were on the order of 100 accredited assessors for a defense industrial base of more than 100,000 companies. Small and mid-sized suppliers could not realistically book, pay for, and pass a certification before the deadline, and the Small Business Administration had flagged that compliance costs were pushing capable firms out of defense work. Suspending Phase II buys time to design something that scales.
Where the focus is moving: OT and the basics
The reform points at fundamentals that scale. The clearest signal is the Department of War CIO program Brilliant at the Basics, which now publishes a dedicated OT Top 10 for operational technology. That matters for manufacturers, because the assets that are hardest to certify, the PLCs, HMIs, CNCs, and SCADA servers on the shop floor, are the ones it is built around.
Those OT basics are familiar: identity and access control, a validated asset inventory, strict network segmentation, controlled remote access, and continuous monitoring. They are the same controls a Level 2 program asks for, stated plainly and without the certification overhead.
Where manufacturers still get stuck
CMMC Level 2 maps to the 110 controls in NIST SP 800-171 Rev 2, and the suspension did not change one of them. On an OT-heavy site, three families cause most of the gaps:
| Family | Control | What it looks like on the shop floor |
|---|---|---|
| Access Control | AC.L2-3.1.3, flow of CUI | Segmentation that enforces a boundary, not VLANs on a flat network |
| Access Control | AC.L2-3.1.5, least privilege | Shared operator accounts on legacy HMIs |
| Access Control | AC.L2-3.1.12, remote access | Vendor sessions to PLCs and SCADA that nobody monitors or logs (how to control them) |
| System and Communications Protection | SC.L2-3.13.1, boundary protection | One firewall rule, or none, between the corporate network and the plant |
| System and Communications Protection | SC.L2-3.13.6, deny by default | OT networks left allow-by-default as the integrator shipped them |
| Audit and Accountability | AU.L2-3.3.1 and 3.3.2, logs and traceability | Controllers that log nothing, and shared logins that hide who did what |
The reasons are the same everywhere: PLCs and CNCs cannot run agents, operations will not accept a reboot, and the plant network was built for uptime, not isolation. These gaps close around the equipment, at the network, rather than on it. For the machine-by-machine documentation, see CMMC requirements for OT and IoT specialized assets.
A readiness sequence that survives the reform
The deadline is on hold, but the order of work is the same whatever the reform decides:
- Scope. Draw the CUI boundary: every system, network and site that stores, processes or transmits CUI, including the OT inside it. A CUI enclave keeps that boundary small.
- Gap assessment. Score yourself against all 110 controls and rank the gaps. AC, SC and AU failures on OT take the longest, so they go first.
- Implementation. Segment IT from OT, put least-privilege access and MFA on every remote and privileged path, and collect logs from IT and OT in one place.
- Evidence. Document each control with configurations, policies and log samples, and run an internal test against the CMMC assessment guide. What a C3PAO looks for in an OT environment lists what an assessor will ask to see.
- Affirmation. Complete the self-assessment and affirm the score in SPRS today. When third-party assessment returns, the same evidence package is what the C3PAO reviews, with open items limited to the POA&M allowance.
A misstated SPRS score carries the same False Claims Act exposure it did before the suspension, so the affirmation needs evidence behind it.
What to do now
Do not stand down. The organizations that treat the suspension as a pause button will be the ones scrambling when the reformed program lands. The ones that keep implementing will already be ready, and they get a more secure plant in the meantime.
The practical move is to cover the OT Top 10 on the equipment that cannot host a security agent. An agentless, network-layer approach enforces identity-bound access, microsegmentation, remote access, and tamper-evident audit in front of the asset, so the PLC never changes and production never stops. That is how Access Gate covers eight of the ten OT basics out of the box, and contributes to the other two.
If you are earlier in the journey, start with what CMMC compliance requires and the CMMC solution for defense manufacturers with legacy OT. The destination has not moved. Only the paperwork did.