Blog · 2026-10-29 · Gardience Engineering

CMMC Phase 2 is paused: what defense suppliers still owe

The Department of War suspended CMMC Phase 2 in July 2026, so November 10 is no longer the date. NIST 800-171, your SPRS score, and 72-hour reporting still apply. What that means for your servers.

If you sell to the Department of War and handle controlled unclassified information (CUI), you probably had November 10, 2026 circled. That was the day CMMC Phase 2 was to start: contracts could require a Level 2 certification from an outside assessor (a C3PAO) instead of your own self-assessment.

That date is gone. On July 13, 2026, the Department of War suspended Phase 2 and the milestones after it, citing compliance cost and bureaucracy, and set up a 60-day CMMC Reform Task Force. Its report was due in September. As of late October, no recommendations or new date have been published.

It is tempting to read that as "CMMC is off." It is not. Most of what a small supplier has to do was never about Phase 2.

What still applies today#

• NIST SP 800-171. DFARS clause 252.204-7012 has required the 110 security requirements of NIST SP 800-171 on systems that hold CUI for years. Phase 2 was about who checks; the requirements themselves did not change.
• Your SPRS score. Contracts with the 7019 and 7020 clauses need a current self-assessed NIST 800-171 score in the Supplier Performance Risk System. It runs from -203 (nothing in place) to 110 (everything).
• Phase 1 self-assessments. Level 1 and Level 2 self-assessments and the yearly affirmation still apply where a contract calls for CMMC.
• 72-hour incident reporting. Cyber incidents affecting covered defense information still have to be reported within 72 hours.

The risk that did not pause: a score you cannot back up#

The expensive cases so far were not about certificates. They were about scores. In March 2025, MORSECORP agreed to pay $4.6 million under the False Claims Act. It had posted an SPRS score of 104, learned from an outside gap analysis that the real number was -142, with about 22% of the controls in place, and did not update SPRS for more than two years. The case was brought by the company's own security officer.

The lesson for a small supplier: the number in SPRS is a statement to the government. It has to match what is true on your machines, and you should be able to show why.

What 800-171 asks of your servers#

About half of the 110 requirements land on the machines themselves, where they are checked or set rather than written down. On Windows and Linux servers that means, among others:

• Patching on a schedule (3.14.1): finding and fixing flaws in a timely way, with a record of it.
• A secure baseline (3.4.1, 3.4.2): a defined configuration, applied and kept.
• Sign-in rules (3.1.8, 3.5.7, 3.5.8): account lockout after failed attempts, password complexity, and history.
• Encryption of CUI at rest (3.13.16): BitLocker on Windows, LUKS on Linux.
• Audit logging (3.3.1, 3.3.2): events recorded, kept, and tied to a person.
• Malware protection (3.14.2): anti-malware on every machine, kept up to date.
• Change control (3.4.3): changes requested, approved, and recorded.

The other half is people and paper: training, background checks, visitor logs, incident response tests, and the System Security Plan. Software cannot do those for you, though it can collect the proof from the people who keep it.

How to use the pause#

The pause is time, not a pass. A sensible order for a small supplier:

1. Re-score honestly. Walk the 110 requirements and post the score you can prove. A lower true score with a dated plan (a POA&M) is far safer than a high score you cannot back up.
2. Fix the machine side first. It is the part you can finish in days, and it moves the score the most per hour.
3. Keep evidence as you go. Per-machine results, change records, and a log nobody can quietly edit. If Phase 2 returns, or a prime asks, you hand it over instead of rebuilding it.

How Gardience fits#

Gardience checks and sets the machine-side requirements on Windows and Linux servers from one console, on your own server: patching, the baseline, sign-in rules, BitLocker and LUKS recovery keys, audit settings, and anti-malware. It writes the evidence and the System Security Plan statements from what it finds, and it never marks a requirement met that it cannot see. On a 50-machine test network it fixed the technical requirements in 35 minutes; with the policies and proof uploaded, the self-assessed score went from -203 to 110. See CMMC on gardience.com or start a free trial.

Questions#

Is CMMC canceled?#

No. Phase 2 (outside certification in contracts) is suspended while the Department of War reviews the program. Phase 1 self-assessments and the DFARS 7012 requirements still apply.

Do I still need an SPRS score?#

Yes, for contracts with the DFARS 7019 and 7020 clauses. Keep it current and keep the evidence behind it.

When will Phase 2 start?#

No new date has been announced. The task force's report was due to the DoD CIO in September 2026 and had not been published as of late October.

What happens if my SPRS score is wrong?#

A score you know is wrong can become a False Claims Act problem, as the MORSECORP settlement showed. Update it when you learn the real number, and keep a dated plan for the gaps.

Sources: Department of War announcement, WilmerHale, Crowell & Moring on the suspension, Crowell & Moring on MORSECORP.