vCIO Insights is a thought leadership series from Mike Nazli, vCIO at i-Tech Support, sharing practical perspectives on AI, cybersecurity, compliance, and technology strategy for business leaders.
On July 13, 2026, the Department of War suspended CMMC Phase II and stood up a Reform Task Force to spend sixty days figuring out what the program should become. That review window closed on September 11, and as of mid-October the Task Force’s report had not been made public.
Within a day of the announcement, I’d seen countless articles and LinkedIn posts, almost all of them circling one question: should organizations stop preparing for CMMC, and do they still need a CMMC consultant at all?
I think both questions start in the wrong place.
The certification timeline changed. The responsibility to protect Controlled Unclassified Information (CUI) did not. Organizations handling CUI are still expected to safeguard it under DFARS 252.204-7012 and to keep implementing the controls in NIST SP 800-171 Rev. 2.
The pause gives organizations time to ask what they were trying to accomplish in the first place, and what the person or firm helping them should be doing.
Where the Conversation Usually Goes Wrong
CMMC projects usually start with conversations about protecting sensitive government information, but over time those conversations can change.
Leadership stops asking, “How do we better protect our information?” It becomes, “What’s the next milestone we need to complete to pass?”
That shift happens more often than people realize. I’ve watched organizations:
- Purchase Microsoft licensing and believe they were suddenly compliant
- Implement multi-factor authentication and assume the work was finished
- Buy SIEM platforms nobody had the resources to monitor
- Write policies employees never read
- Treat documentation as a one-time project instead of an ongoing business process
The objective slowly shifted from building a mature cybersecurity program to producing enough evidence to survive an assessment.
Those are two different projects, and only one of them makes you safer.
Pulling a client back toward the first one is the most useful thing a consultant does.
What NIST SP 800-171 Was Built to Protect
NIST SP 800-171 was written to protect Controlled Unclassified Information, and every control in it should be judged by whether it does that.
When Will CMMC Be Required Again?
Nobody outside the Reform Task Force knows the date yet, and anyone who tells you otherwise is guessing. What is knowable is that the pause only ever applied to one phase.
Under the Department of War’s suspension announcement, Phase I self-assessment requirements remain fully active, DFARS 252.204-7012 and NIST SP 800-171 compliance continue without interruption, and SPRS score postings and annual affirmations are still mandatory.
What’s paused is every assessment above a self-assessment. During the suspension, solicitations may require only Level 1 or Level 2 self-assessments, so third-party Level 2 certification and Level 3 assessments are both on hold. On September 3, the Department wrote this into contract guidance with DFARS Class Deviation 2026-O0025, Revision 3, which directs contracting officers to remove suspended Phase II requirements from new and existing solicitations and contracts.
The sixty-day review closed on September 11, and whatever it recommends, the Department still has to decide what to adopt and then write the rule. That takes time. Treating the gap as a stop-work order is the most expensive possible reading of it.
Who Needs to Act on CMMC Right Now?
If you handle CUI, you need to comply with NIST SP 800-171 today, even though certification itself is on hold.
The pause changes when you’ll be formally assessed. It doesn’t change whether DFARS 252.204-7012 and NIST SP 800-171 apply to your organization today. The obligation to protect that information has been continuous since long before CMMC existed and it did not lapse in July.
Many of the organizations affected are manufacturers, engineering firms, software developers, machine shops, and service providers, operating on limited budgets while doing important work.
The Department of War has openly acknowledged the compliance-cost problem for exactly these businesses, and that acknowledgment is the whole reason the review exists. The Small Business Administration publicly commended the suspension on the same grounds, citing the burden on small defense contractors.
The review exists because the cost of proving compliance had grown high enough to push capable small contractors out of the Defense Industrial Base. The practical response is to keep investing, in the order that reduces risk fastest.
Three Questions to Ask Before You Buy Another Tool
If you asked me what I hope organizations take from this pause, it’s this: spend less energy on passing an assessment and more on understanding your own information.
That work collapses into three questions. A real readiness assessment, or a Virtual CIO who already knows CMMC and NIST SP 800-171, should walk you through them in this order.
1. Identify What Qualifies as CUI
What information in your environment is genuinely Controlled Unclassified Information, where is it stored, and how is it processed and transmitted?
Most organizations discover their CUI lives in more places than anyone documented, including a few nobody wanted to admit to. You cannot protect a boundary you haven’t drawn.
2. Prove Who Can Reach It
Who has access, and are they logging in with unique accounts and multi-factor authentication? Is that access reviewed on a schedule? When someone leaves, how fast is it removed?
The gap between the policy answer and the real answer is where most findings live. It is also the cheapest gap to close, because it is usually a process problem rather than a purchase.
3. Govern Its Whole Life
How is that information retained, and how is it securely destroyed when it’s no longer needed?
Retention and destruction are the least exciting controls in the framework and the ones most often skipped entirely. They are also the ones that quietly expand your exposure every year you ignore them, because every file kept past its retention date is one more file that can be stolen.
No product purchase answers those three questions. They come down to understanding your own data.
Compliance Is an Operational Program
The biggest lesson from CMMC work is that cybersecurity isn’t only a technology project. Technology is one piece of it.
The harder work is operational, meaning policies, training and executive ownership, and it usually determines whether a security program survives past year one. Governance has to be built by the leadership team, with a consultant supporting the work. I made a similar case recently about AI governance, and the same principle applies here.
The Boardroom Question
Whether CMMC returns exactly as it was or comes back as something different, one thing won’t change. At your next leadership meeting, ask one question.
“Can we confidently explain how we’re protecting our Controlled Unclassified Information, without mentioning an assessment?”
If the room can’t answer it, don’t panic. Almost none of the organizations I meet with can answer it on the first try either.
The pause gives you time that most compliance programs never get, and a mature security program will produce compliance along the way.
Continue the Conversation
Protecting information has always been the goal. The assessment was simply one way of proving you were doing it.
If your organization handles CUI and the boardroom question above doesn’t have a clean answer, that’s worth closing before Phase II comes back rather than after.
i-Tech’s Cybersecurity & Compliance team works with Defense Industrial Base businesses on exactly this: finding where sensitive data lives, closing the real gaps, and building a program strong enough to pass an assessment on its merits.
