On July 13, the Department of Defense announced the immediate suspension of CMMC Phase 2. Within hours, reaction flooded every corner of the defense supply chain. Some of the commentary declared the program dead. Some insisted nothing had changed at all. Neither take is accurate, and the gap between them is where contractors make expensive mistakes. If you hold DoD contracts in Northeast Wisconsin, this CMMC news deserves a careful read instead of a hot take. The suspension pauses the third-party assessments that would have become a condition of contract award this November. Even so, every self-assessment requirement that took effect last year remains fully enforceable. Because the announcement also launched a 60-day review of the program, smart contractors are treating this moment as a window, not a finish line.
Below, we’ll cover what the department announced, what it left untouched, and why momentum matters more right now than it did a month ago.
The Latest CMMC News: What DoD Announced on July 13
The official announcement went out under the department’s new Department of War branding, with a title about forging the arsenal of freedom. Behind the branding, the substance of this CMMC news is straightforward. The department immediately suspended CMMC Phase 2 requirements, which had an original effective date of November 10, 2026. Phase 2 would have made third-party assessments by accredited C3PAOs a condition of award for contracts involving controlled unclassified information.
Understanding what Phase 2 covered helps clarify what the pause actually removes. Under the original schedule, contractors handling sensitive unclassified data would have needed a passing assessment from an outside certifier before winning applicable awards. For thousands of small suppliers, that meant booking scarce assessors, paying five-figure assessment fees, and clearing the bar on the first try. Those obligations are what the department just took off the calendar.
The suspension goes further than one deadline, though. Along with Phase 2, the department paused all pending and future CMMC implementation milestones across its solicitations and contracts. The Department of Defense suspended CMMC Phase 2 on July 13, 2026, and launched a 60-day review of the entire certification program. In addition, the announcement stood up a CMMC Reform Task Force to recommend changes to the program’s structure and cost.
DoD Chief Information Officer Kirsten Davies framed the decision as a strike against bureaucracy rather than a retreat on security. In her words, “We are not reducing cybersecurity through this measure. We are reducing the red tape.” Alongside the suspension, the department published a request for information asking industry how to reform the program. Defense contractors can submit feedback on CMMC reform through the department’s request for information until August 14, 2026.
Announcements like this rarely arrive with instructions for a 40-person shop in Appleton or a supplier in Marinette’s shipbuilding chain. That’s where M2 Technology comes in. Because we track these developments as they happen, our contractor clients hear about changes from us, not from a prime’s procurement office.
What the CMMC Suspension Didn’t Change
Here’s the part the CMMC news cycle keeps burying. Phase 1 took effect in November 2025, and the department stated plainly that those self-assessment requirements remain in place. When a solicitation calls for a Level 1 or Level 2 self-assessment, you still need a current score in SPRS before award. CMMC Phase 1 self-assessment requirements remain in force even though the department suspended Phase 2 third-party assessments.
Beyond CMMC itself, the underlying security obligations never depended on the certification program. Since 2017, DFARS 252.204-7012 has required contractors handling controlled unclassified information to implement NIST SP 800-171. Those clauses still sit in your contracts today, and our guide to NIST 800-171 and DFARS requirements explains how the frameworks connect. NIST SP 800-171 implementation is a contractual requirement under DFARS 252.204-7012, independent of any CMMC assessment schedule.
Enforcement didn’t pause either. On June 18, the Department of Justice announced a settlement with an Alabama defense contractor over cybersecurity compliance. The company agreed to pay $507,144 to resolve False Claims Act allegations on two Navy contracts. Notably, the contractor had self-assessed a perfect 110 in SPRS, while a later government assessment scored it at negative 170. Since your SPRS affirmation is a federal representation, an inflated score is a legal liability, not a paperwork shortcut.
If you’ve been handling compliance internally without an IT partner, the suspension didn’t lower the bar. It only changed who verifies your work, and for now that’s still you. Without an outside assessor on the calendar, the honest self-review becomes the whole defense. For a first pass, focus on the fundamentals: access controls, multifactor authentication, encryption, and an incident response plan you’ve actually tested. Those controls anchor your score, and they’re also what auditors and attackers check first. M2 Technology helps contractors compare their claimed scores against their actual controls before the government runs that comparison for them.
Why This Reads as a Pause, Not a Cancellation
Look at what the department is actually reviewing. The task force has 60 days to recommend reforms, which points toward a revised program rather than an abandoned one. Notice that the announcement’s own language centers on lowering compliance costs and barriers for small businesses, not on retiring the security standard underneath. The CMMC review targets the cost and structure of certification, not the underlying requirement to protect federal data.
The Small Business Administration’s response supports the same reading. In a statement issued the same day, the SBA commended the suspension as relief from costly bureaucratic burdens on small contractors. Notice what’s missing from that statement: any suggestion that cybersecurity expectations should drop. The pressure that produced this pause came from assessment costs and assessor capacity shortages, not from doubts about the threat. In fact, the department’s own memo describes those burdens as the reason small businesses were opting out of defense work entirely.
History offers a pattern here too. Every major swing in CMMC news has followed the same arc: announcement, industry alarm, revision, and a program that returns leaner but still mandatory. CMMC 1.0 became CMMC 2.0 through exactly that process. Verification of contractor cybersecurity is likely to return in a revised form after the department completes its review. While nobody can promise what the task force recommends by mid-September, betting on a full repeal means betting against every signal in the record.
So what might a reformed program look like? The department’s request for information floats ideas such as accepting existing commercial certifications and trimming duplicative paperwork. Nothing on that list reads like retirement. Consequently, the most likely outcome is a cheaper, faster path to the same destination: verified proof that contractors protect the data they handle.
When contractors ask our team what to make of announcements like this, we give the answer we’d want ourselves. Read the primary sources first. Then plan for the most probable outcome instead of the most comfortable one.
What Wisconsin Defense Contractors Should Do Now
For shops across Northeast Wisconsin, from Marinette’s shipbuilding suppliers to Fox Valley manufacturers, the practical question is simple: keep spending on compliance or stop? Our answer is to keep moving, deliberately. Here’s what that looks like over the next 60 days.
Finish the Remediation You Started
Momentum is the most expensive thing to rebuild. When a remediation effort stops, staff lose context, documentation goes stale, and nearly closed gaps quietly reopen. Contractors who continue NIST SP 800-171 remediation during the suspension avoid the high cost of restarting a stalled compliance program later. Since the legal requirement to implement the controls never paused, this work was never optional anyway. Treat the review window as breathing room to finish properly instead of racing a deadline.
Keep Your SPRS Score Current and Honest
After the June enforcement settlement, an accurate score matters more than a high one. Review your self-assessment against the real state of your environment, and document the evidence behind every control you claim. An SPRS self-assessment score is a federal representation, and inflated scores can create False Claims Act liability for defense contractors. If your number wouldn’t survive a government audit, fix the controls or fix the number. Either move beats hoping nobody checks.
Put Your Experience on the Record
Before August 14, consider submitting a response to the department’s request for information. Small contractors rarely get a direct channel into program design, and this review exists partly because businesses your size spoke up about costs. Even a short, specific submission about assessment expenses carries weight. If the reformed program should look different for a 25-person machine shop than for a prime, now is the moment to say so.
Watch Mid-September, Not November
The 60-day review clock runs out around mid-September, and that’s when the next round of real CMMC news should arrive. Instead of circling the old November deadline, build your planning around what the task force recommends and when the department acts on it. Until then, assume the current rules hold, because they do. When the recommendations land, expect a transition period rather than an overnight switch. Also expect primes to move faster than regulators, since primes carry the flow-down risk.
If your current IT company hasn’t contacted you about the July 13 announcement, that silence is worth noticing. A partner who misses the biggest compliance development of the year will likely miss the next one too. M2 Technology briefs its DoD contractor clients whenever the rules move, because real CMMC compliance support means reading the memos, not just installing the tools.
The Real Cost of Standing Down
Consider what stopping actually buys you: a few months of deferred spending in exchange for three compounding risks. First, there’s the restart cost, because compliance programs decay quickly and rebuilding one costs more than maintaining it. Second, there’s contract exposure. Prime contractors continue to require CMMC readiness from subcontractors even while the Department of Defense reviews the program. Third, there’s enforcement, and the False Claims Act didn’t take a 60-day break.
Northeast Wisconsin sits deeper in the defense supply chain than most people realize. Between the shipyard work along the lakeshore and the precision manufacturers feeding larger primes, plenty of local businesses touch controlled unclassified information. Many of them never think of themselves as defense contractors at all. If that describes your shop, the review period is the right time to learn what your contracts actually require. For those companies, a prime’s flow-down requirement can arrive with the next purchase order, review or no review.
There’s a competitive angle as well. When verification returns in whatever form the task force designs, ready contractors bid immediately while stalled contractors wait in a crowded queue for consultants. What CMMC certification costs doesn’t shrink because you waited; the readiness work stays the same size either way. Defense contractors who maintain compliance momentum during the CMMC pause will hold a clear advantage when verification requirements return.
Cost concerns are legitimate, though, especially for smaller shops watching every dollar. That’s part of why M2 Technology bills support hours only for work actually performed, on top of a fixed monthly software and tools fee. During a review window like this one, your compliance spend can scale to exactly what the moment requires. No bloated flat-rate bundle, no unused hours hiding in a retainer.
Final Thoughts
The July 13 announcement moved the enforcement calendar, but it didn’t move the threat, the contract clauses, or the legal baseline underneath them. Contractors who confuse a suspended assessment with a suspended obligation will pay for that confusion twice. First in restart costs, then again in lost position when verification returns.
If you’re weighing what this pause means for your own compliance budget, that’s a conversation worth having now, while the review window is open. M2 Technology sits down with contractors across the region to map where their CMMC compliance posture actually stands. Together, we sort what’s worth continuing from what can wait for the task force’s report. Chat with an expert today and we’ll start with your situation, not a script. The CMMC news will keep coming through the fall, and we’ll keep reading it so you don’t have to.
Deadlines move. The standard behind them doesn’t.