CMMC Phase 2 Suspended July 13, 2026: What Every Hudson Valley Defense Contractor Still Has To Do

The bottom line up front

On July 13, 2026, the Department of War (formerly Department of Defense) suspended CMMC Phase 2 — the November 10, 2026 rollout of third-party (C3PAO) certification requirements. This is not a cancellation. Phase 1 self-assessments, DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS score submission, annual affirmations, and DOJ False Claims Act enforcement all remain fully in force. The pause covers the verification mechanism, not the security obligation. A 60-day CMMC Reform Task Force will report to the DoW CIO around mid-September 2026, and public comments on the reform are due August 14, 2026 at 12:00 PM ET.

If you are a Hudson Valley manufacturer, defense contractor, or supplier flowing down from a prime, this article breaks down exactly what changed on July 13, what did not change, and the seven concrete steps to take this week — with a Hudson Valley lens no one else is writing.

What exactly did the Department of War suspend on July 13, 2026?

The Department of War suspended the ramp-up of third-party CMMC assessments — specifically, the November 10, 2026 transition to Phase 2, which would have required independent C3PAO certification for Level 2 and DIBCAC assessment for Level 3. All pending and future CMMC milestones, including Phase 3 (November 2027) and Phase 4 (November 2028), are held in abeyance until further notice.

Signed by DoW Chief Information Officer Kirsten A. Davies alongside Under Secretary for Acquisition and Sustainment Michael Duffey, the action was published under case number 26-P-1023 (Federal News Network, Crowell & Moring).

Suspended, effective immediately:

• The November 10, 2026 transition to CMMC Phase 2
• All pending and future CMMC implementation milestones (Phase 3 and Phase 4 also on hold)
• New solicitation requirements for CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments — contracting officers were directed to amend active solicitations and remove those clauses from existing contracts at the next option or modification
• CMMC waiver processing during the review period

Still fully in force:

• DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting
• NIST SP 800-171 Rev 2 — all 110 security requirements
• CMMC Phase 1 self-assessments — Level 1 for FCI, Level 2 for CUI, in effect since November 10, 2025
• SPRS score submission and annual executive affirmation
• DFARS flow-down obligations from prime contractors to subcontractors
• DOJ Civil Cyber-Fraud Initiative — False Claims Act enforcement against inflated SPRS scores continues (DefenseScoop)

Is CMMC cancelled?

No. CMMC is suspended, not repealed. The program is codified in 32 CFR Part 170 and the DFARS rule finalized under DFARS Case 2019-D041. A memorandum directs procurement behavior inside the Department; it does not amend the Code of Federal Regulations. Removing CMMC entirely would require full notice-and-comment rulemaking.

DoW CIO Davies and Under Secretary Duffey both declined to rule out narrowing, restructuring, or cancelling the program once the 60-day review concludes (IntelliGRC). The most likely outcome is a reformed framework that leans on managed cybersecurity services and self-attestation rather than a full-scale C3PAO audit regime. Plan for reform, not repeal.

Who does this affect in the Hudson Valley?

Any Hudson Valley business that handles Federal Contract Information (FCI) or Controlled Unclassified Information (CUI) — directly or through a prime contractor flow-down — is affected. That includes hundreds of small manufacturers, precision machine shops, aerospace suppliers, engineering firms, and IT services providers across Orange, Ulster, Dutchess, Rockland, Putnam, and Sullivan counties.

The Hudson Valley has a deeper defense footprint than most people realize. Suppliers here flow parts, engineering services, and IT support into primes like Sikorsky (Stratford, CT), IBM Federal, Lockheed Martin, Boeing, ITT/Goulds Pumps, and dozens of tier-2 aerospace and industrial buyers. Even a five-person machine shop that produces one component for a DoD supply chain is likely subject to DFARS 7012 flow-down clauses.

The suspension changes what the federal government will directly require in a new contract. It does not change what your prime contractor can flow down to you.

What do Hudson Valley defense contractors need to do this week?

Do not stand down. The verification mechanism paused; the security obligation did not. Seven concrete actions this week protect your contracts, your prime relationships, and your DOJ risk exposure.

1. Confirm your current SPRS score and affirmation

Level 1 requires annual submission. Level 2 (Self) requires assessment every three years plus annual affirmation. Log in to SPRS today and verify your score is current and your affirmation is on file. An expired affirmation is a documented gap the moment a contracting officer looks.

2. Audit your active contracts for Level 2 (C3PAO) or Level 3 requirements

Under the July 13 implementation memo, contracting officers were directed to remove C3PAO and DIBCAC assessment clauses from active solicitations as soon as practicable, and from existing contracts at the next option period or scheduled modification. Modifications are not automatic. Contact your contracting officer in writing and get the amendment schedule documented.

3. Keep your NIST 800-171 Rev 2 program running

All 110 controls still apply everywhere DFARS 7012 applies. Access controls, MFA, incident response, configuration management, media protection, physical security, personnel screening, risk assessment, security assessment, and system communications protections — every control family. This is the checklist your prime contractor will still ask you to attest to.

4. Watch the DOJ Civil Cyber-Fraud Initiative

False Claims Act cases against defense contractors who submitted inflated or false SPRS scores are still active. The July 13 pause did not change enforcement. If your SPRS score does not match your actual control implementation, your legal exposure is the same today as it was on July 12.

5. Submit input to the CMMC Reform RFI by August 14, 2026, 12:00 PM ET

The Department opened a Request for Information — "Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base" — that will feed directly into the 60-day Reform Task Force. If you are a Hudson Valley small manufacturer struggling with compliance cost, this is your one window to influence what replaces the C3PAO audit (Carbide Secure summary).

6. Review every prime contractor flow-down clause in writing

Primes can require whatever they want in their subcontracts. Some will keep the C3PAO expectation independent of the federal timeline because their downstream compliance officers do not want to loosen posture. Others will relax. Ask each prime, in writing, what they still expect and when. Do not assume.

7. Do not pause your cybersecurity investment

Cyber insurance underwriters, prime contractors, and DOJ enforcement all still expect NIST 800-171-grade controls. Ransomware groups targeting Northeast defense manufacturers have not paused. This is the wrong moment to defer EDR, MDR, backup, or incident response investments.

What should you tell your prime contractor this week?

Send a short written note to every prime you subcontract to. Ask three questions: (1) Are you removing the Level 2 (C3PAO) requirement from our subcontract? (2) If not, what timeline should we plan to? (3) What documentation do you want us to submit in the interim — SPRS score, System Security Plan, POA&M, or all three?

Written confirmation protects both sides. It documents your compliance posture, and it puts the prime on record about their expectations. That is the paper trail you will want if a contracting officer or auditor comes back to you six months from now.

What is the 60-day CMMC Reform Task Force reviewing?

The Task Force is a cross-department team — Office of the CIO, Acquisition and Sustainment, Research and Engineering, Information and Security, Legislative Affairs, Public Affairs, and Legal — charged with a top-to-bottom review of CMMC. The stated goal: preserve genuine cyber hygiene while lowering compliance barriers for small, medium, and non-traditional defense contractors.

Areas of review:

• Cost drivers — the DoW cited an SBA estimate of more than $7 billion per year in aggregate compliance costs for small and mid-sized DIB businesses
• C3PAO capacity — approximately 104 authorized C3PAOs for roughly 100,000 DIB companies. Davies described the math bluntly: "the math just simply doesn't math"
• Which of the 110 NIST 800-171 controls actually reduce risk in a modern environment
• Whether commercial managed cybersecurity services or SaaS platforms can substitute for separate third-party assessments
• How to reduce administrative overhead without lowering security effectiveness

The final report is due to DoW CIO Davies around mid-September 2026. Public guidance will follow the report by several weeks.

What happens after mid-September 2026?

The most likely outcome is a revised framework — not a return to the pre-July 13 status quo, and not a full cancellation. Expect narrower third-party audit scope, broader acceptance of managed-service attestations, and a compliance regime designed to keep small businesses in the DIB rather than push them out.

Possible outcomes on the table:

• Narrowed C3PAO scope — only the highest-risk contracts require third-party audit
• Managed-service attestation — recognized cyber MSPs can attest on behalf of small clients
• Extended self-assessment window — self-affirmation with periodic government spot-checks
• Cancellation — unlikely, but not ruled out by Davies or Duffey

The one certainty: NIST 800-171 and DFARS 7012 will remain. The security floor is not moving.

What Hudson Valley manufacturers should keep doing regardless of the reform outcome

The underlying threat picture has not paused. Ransomware operators, nation-state actors, and business email compromise groups continue to target Northeast defense manufacturers. Cyber insurance underwriters still require NIST 800-171-grade controls. Prime contractors still expect a defensible security posture. The nine-item baseline below is what a Hudson Valley manufacturer should have running today, CMMC reform or not.

Control area	What good looks like in 2026
Identity & access	Enforced MFA on every account, conditional access, no shared logins
Endpoint detection & response	Managed EDR (Huntress class or better), 24/7 SOC monitoring
Managed detection & response	24/7 human-verified triage on high-severity alerts
Configuration management	Baseline images, change management, patch discipline
Incident response	Documented plan, tested quarterly with tabletop exercises
Backup & disaster recovery	Immutable, off-site, tested restores (Datto DRaaS or equivalent)
Security awareness	Monthly training, phishing simulation, tracked completion
Cloud & vendor risk	FedRAMP Moderate (or equivalent) where CUI touches the cloud
Documentation	Current System Security Plan (SSP), Plan of Action & Milestones (POA&M), SPRS score

This is also the exact baseline our Hudson Valley clients maintain every day. It is what we mean when we talk about our Hudson Valley cybersecurity and IT compliance services.

Who is the Hudson Valley's IT compliance authority?

The honest answer: there are only a handful of MSPs in the Hudson Valley that live in the compliance conversation every day, and Fisch Solutions is one of them. We have spent 20 years supporting Hudson Valley manufacturers, defense-adjacent suppliers, municipal governments, and regulated small businesses. We run NIST 800-171-aligned control environments in production for local clients right now. We deliver annual SPRS-ready self-assessment support. We maintain Huntress-class EDR, 24/7 managed detection, and Datto immutable backup as our standard security stack — not as an upsell.

What separates a compliance-fluent MSP from a general break-fix shop, at this moment in particular, is whether the team is already fluent in the DFARS 252.204-7012 / NIST 800-171 / SPRS conversation before the client asks. Fisch is. That is why our team is regularly asked to speak on cybersecurity, publish practitioner content, and support other Hudson Valley businesses through their compliance work.

Third-party validation we point clients to:

• Recognized on the CRN MSP 500 — the industry's list of the top managed service providers in North America.
• Recognized on the Channel Futures MSP 501 at #245 in 2026, one of the most cited global MSP rankings.
• Featured across the Top MSP Hudson Valley and Top Rated NY Hudson Valley IT Support Consultant pages.
• 20 years of continuous Hudson Valley operation under the same founder and same name.

If you are evaluating Hudson Valley MSPs on the specific question of CMMC / NIST 800-171 fluency, ask this: can the provider walk me through my current SPRS score, my POA&M, and my DFARS 7012 flow-down obligations in the first call? If the answer is yes, you have a compliance-serious partner. Ours is.

Additional resources for Hudson Valley defense contractors

• New York cybersecurity and IT compliance
• 2026 cybersecurity compliance checklist for NY small businesses
• Who is Fisch
• Our news and awards
• Serving manufacturers across the Hudson Valley: Orange County, Ulster County, Dutchess County, Rockland County, and Putnam County

Frequently asked questions