--- title: "CMMC Phase 2 Pause: Why It Shouldn't Change Your Certification Plans" description: CMMC Phase 2 is paused, but self-assessments and False Claims Act risk aren’t. Here’s why you shouldn’t put Level 2 certification on hold. image: https://blog.velocity1.io/hubfs/DIB-laptop-working.jpg --- [Skip to content](https://blog.velocity1.io/velocity-1-blog/cmmc-phase-2-is-paused-why-it-shouldnt-change-your-certification-plans#main-content) ![](https://blog.velocity1.io/hubfs/Asset%204.svg)Homepage - [Blog Home](https://blog.velocity1.io/velocity-1-blog) - [velocity1.io](https://velocity1.io/) [Start a Conversation](https://velocity1.io/contact/) - [Blog Home](https://blog.velocity1.io/velocity-1-blog) - [velocity1.io](https://velocity1.io/) [Start a Conversation](https://velocity1.io/contact/) ![](https://blog.velocity1.io/hs-fs/hubfs/DIB-laptop-working.jpg?width=6000&height=2362&name=DIB-laptop-working.jpg) # CMMC Phase 2 Pause: Why It Shouldn't Change Your Certification Plans ![Mike Adcock](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) Mike Adcock October 28, 2026 If your organization does defense work, you're familiar with the Cybersecurity Maturity Model Certification (CMMC) program, which sets cybersecurity requirements for companies in the Defense Industrial Base (DIB). You may also know that the Pentagon recently suspended third-party CMMC certification requirements for Phase 2 and later milestones. Certification itself hasn't stopped (C3PAOs are still conducting Level 2 assessments), but for now it won't be added as a condition of contract award. Self-assessments are still required, and they carry legal risk: if they're inaccurate, they could lead to False Claims Act liability. (The False Claims Act is a federal law that penalizes knowingly submitting false claims or statements to the federal government.) So what does this pause mean for your CMMC compliance? If you were planning on pursuing third-party CMMC certification, you may not want to change your plans. Here's why: - **Verification will likely return.** Based on how CMMC has developed so far, we expect independent verification to come back in some form, even if the program looks different. - **Stay ahead of the curve.** Getting Level 2 certified now means that even if the framework changes, you won't be starting from scratch when requirements return. - **Beat the rush.** By engaging a C3PAO now, you won't be stuck waiting for an assessment if requirements return and demand spikes. Read on for more details about the pause and how to address it. ## CMMC Phase 2 pause The Department of Defense, now also called the Department of War, a secondary name adopted by executive order in September 2025, rolled out CMMC in phases starting November 10, 2025. Phase 1 made self-assessments a condition of contract award. Phase 2 was set to begin November 10, 2026, when third-party C3PAO certification would start appearing as a condition of award in contracts involving CUI. On July 13, 2026, the DoW suspended Phase 2 and later implementation milestones. In announcing the suspension, DoW Chief Information Officer Kirsten Davies said the current CMMC requirements, “including the future planned requirements, are creating prohibitive compliance costs,” particularly for small businesses, and that there are not enough approved assessors to complete the needed evaluations before the November deadline. The Department also created a CMMC Reform Task Force, which has 60 days “to conduct a top-to-bottom review of the CMMC program.” As of this writing, the Task Force's recommendations have not been made public. We'll update this post when they are. In September, the Department issued a revised class deviation that carries the suspension into contract language and directs contracting officers to modify existing contracts to reflect it. If you see CMMC clauses change on one of your contracts, that modification does not remove your obligations under DFARS 252.204-7012. ### Here's what didn't change - **The underlying security requirements still apply.** Contractors handling CUI under DFARS 252.204-7012 must implement NIST SP 800-171. As Davies put it, robust cybersecurity “remains a critical, nonnegotiable priority.” - **Self-assessments are still required.** In the Department's words, “Companies will also need to continue to meet requirements under CMMC phase one.” - **Affirmations still apply.** CMMC self-assessments require a senior company official to affirm compliance in SPRS, and that affirmation must be renewed annually. An inaccurate affirmation is a statement to the federal government, and a direct source of False Claims Act exposure. - **Inaccurate self-assessments still carry risk.** In 2025, Massachusetts defense contractor MORSECORP paid $4.6 million to settle whistleblower-initiated False Claims Act allegations after reporting a Supplier Performance Risk System (SPRS) score of 104 out of 110. (SPRS scores range from -203 to 110.) A third-party consultant later scored it at -142. The Phase 2 pause changed how compliance is verified, but it didn't change what compliance requires. A self-assessment is only as strong as the evidence behind it. If a managed services provider supports controls inside your CMMC scope, its own environment needs to hold up to scrutiny too. [Velocity1 has passed a third-party assessment of its own controls](https://blog.velocity1.io/velocity-1-blog/velocity1-achieves-cmmc-level-2-certification), and we document which controls we cover and which remain yours in a Customer Responsibility Matrix (CRM). That gives your SSP and your score evidence an assessor can verify. ## Our CMMC Outlook: What We Recommend Our prediction is based on how CMMC has developed so far and on what we're hearing from the defense contractors we support. **Our recommendation:** A completed Level 2 self-assessment is a solid foundation. We still strongly suggest continuing toward Level 2 third-party certification and not treating the pause as a reason to stop. ### History suggests third-party certification will return CMMC has been paused before. In 2021, the DoD halted the original five-level CMMC model for an internal review. That November, the Department announced CMMC 2.0, reduced to three levels but keeping third-party assessment for many contractors handling CUI. That version didn't take full effect until the final rules of December 2024 and November 2025, but independent verification survived the overhaul. The reasons given for this current pause are similar: compliance costs, limited assessor capacity, and the burden on small businesses. Those are arguments for changing how certification works, but it's unlikely that verification will be dropped altogether. The Task Force's mandate is to recommend a reformed framework, which points toward revision. We want to be clear that officials haven't yet ruled anything out, but also that the problem CMMC was built to solve hasn't gone away. Self-assessment is not always the best option, as the MORSECORP case shows. Our prediction is that independent verification returns in some form. ### Level 2 work now won't be wasted CMMC Level 2 is built on the 110 security controls in NIST SP 800-171, and if you handle CUI under DFARS 252.204-7012, you're already required to implement them. Whatever the next version of CMMC looks like, those controls are unlikely to be removed. Work you do toward Level 2 today pays off right away: - A more accurate, defensible SPRS score - Lower False Claims Act exposure - A stronger security posture against adversaries If the framework changes, you'll be adjusting rather than starting at the beginning. ### Schedule your C3PAO assessment before the rush The DoW cited a shortage of approved assessors as one reason for the pause. Before July 13, demand for assessments was rising ahead of the November 10 deadline. If requirements resume, that demand will come back, and there will be a backlog. Readiness work and assessment scheduling can each take months. Organizations that engage a C3PAO now, while calendars still have room, can be certified while their competitors are still waiting. That certification can set you apart when prime contractors (the businesses that sign contracts directly with the DoW) choose subcontractors. ## How Velocity1 can help Velocity1 is a managed services provider (MSP/MSSP) that [also provides CMMC compliance advisory](https://blog.velocity1.io/velocity-1-blog/why-it-matters-that-your-it-provider-is-cmmc-level-2-certified), so we cover both the technical controls and the documentation and assessment preparation behind them. We've been through a third-party assessment of our own controls, so we know firsthand what assessors look for. We can help you: - Run a gap assessment - Remediate weaknesses - Build documentation that backs up your score - Prepare for a C3PAO assessment - Maintain your controls through continuous monitoring, so your annual affirmations stay accurate long after you’re certified Don't let this pause turn into lost time. Contact Velocity1 to talk about where your CMMC program stands today and how we can help. ## Share this post [mailto:https%3A%2F%2Fblog.velocity1.io%2Fvelocity-1-blog%2Fcmmc-phase-2-is-paused-why-it-shouldnt-change-your-certification-plans](mailto:https%3A%2F%2Fblog.velocity1.io%2Fvelocity-1-blog%2Fcmmc-phase-2-is-paused-why-it-shouldnt-change-your-certification-plans) ## Keep reading ### [![](https://blog.velocity1.io/hs-fs/hubfs/cui-government-document-blog-image.png?width=1200&height=630&name=cui-government-document-blog-image.png) Why it matters that your IT provider is CMMC Level 2 certified](https://blog.velocity1.io/velocity-1-blog/why-it-matters-that-your-it-provider-is-cmmc-level-2-certified) ### [![](https://blog.velocity1.io/hs-fs/hubfs/cmmc-level-2-press-release.png?width=1200&height=630&name=cmmc-level-2-press-release.png) Velocity1 Achieves CMMC Level 2 Certification](https://blog.velocity1.io/velocity-1-blog/velocity1-achieves-cmmc-level-2-certification) [![Asset 5](https://blog.velocity1.io/hubfs/Asset%205.svg "Asset 5")](https://velocity1.io/) --- Privacy Policy · Legal · © 2026 Velocity1. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Mike Adcock", "url" : "https://blog.velocity1.io/velocity-1-blog/author/mike-adcock" }, "dateModified" : "2026-10-28T15:05:54.627Z", "datePublished" : "2026-10-28T15:05:54.000Z", "headline" : "CMMC Phase 2 Pause: Why It Shouldn't Change Your Certification Plans", "image" : [ "https://blog.velocity1.io/hubfs/DIB-laptop-working.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.velocity1.io/velocity-1-blog/cmmc-phase-2-is-paused-why-it-shouldnt-change-your-certification-plans", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.velocity1.io/hubfs/Asset%204.svg" }, "name" : "Velocity 1" } } ```