CMMC Phase II Pause: What Changed and What Contractors Should Do Now

By Dr. Abner Mendoza
Published November 4, 2026

The July pause on third party assessments should not pause readiness work. Defense contractors should use the CMMC Phase II pause to correct weaknesses that would matter under any credible assessment model. Your immediate priorities are to establish what your current contracts require, verify that your safeguards operate, and make self-assessment results defensible. Waiting for another program announcement does none of those things. Contractors are all still legally accountable for safeguarding FCI and CUI and having all the required CMMC controls in place.

Status as of November 2026: November 10th, 2026 was the original scheduled date for the Phase II transition. Unless you have been under a rock, we all know about the pause on that November date. That pause remains in effect until the task force report is released and a directive is officially announced. What’s happened since then? The task force collected responses through the RFI, and we are all still waiting for the outcome. There was also one significant procurement document released post-pause, and that’s Class Deviation 2026-O0025, Revision 3, dated September 3, 2026. It carries forward instructions to remove or revise affected CMMC requirements in solicitations and contracts. Current deviation index, Revision 3 memorandum, pages 1–4

What changed after the July pause announcement?

The July 13 announcement suspended the Phase II transition and retained Phase I self-assessments. Despite a common misunderstanding we hear everyday, CMMC was NOT paused. What was paused was the transition to Phase II of the CMMC mandate for third party C3PAO assessments. Those were to come into effect this month, November 10th 2026. September’s class deviation is useful context because it makes the procurement actions explicit in implementing that pause on independent C3PAO assessments. There’s no longer a scramble to get assessments done, and many C3PAO’s now have availability on their calendar. Official July announcement

The September memorandum directs contracting officers to work with requiring activities to revise affected requirements. It permits Level 1 (Self) and Level 2 (Self), retains the stated NIST SP 800-171 Revision 2 baseline under DFARS 252.204-7012, and addresses solicitation amendments and changes to existing contracts before the next option exercise or at the next scheduled administrative modification. The practical consequence is a contract-file review.

As a contractor, what do you do? Ask your contracts lead to identify the latest issued version for each active opportunity and agreement. Record the required assessment route, the information involved, relevant amendments, and unresolved inconsistencies. If an old third-party assessment requirement remains in the file, obtain clarification through the contracting officer or prime contractor. Preserve the response and any resulting modification.

Questions to ask

A program announcement, an issued contract requirement and an operating security control answer different questions. Confusing them leads either to unnecessary spending or to an unsupported decision to stop work on cybersecurity readiness.

This distinction matters to executives approving a budget. A revised assessment route may change when an independent assessment is needed. It does not configure access restrictions, remove unauthorized accounts, test recovery or resolve an inaccurate system description. Those activities need their own owners and business justification. The work of protecting information doesn’t stop. Here’s what we recommend for ongoing readiness…

1. Reconcile the contract and the operating scope

Start with the work rather than the certificate. Identify the information received or created, the people who use it, and the systems and providers through which it moves. Compare that flow with the scope used in the existing system security plan and self-assessment.

Did anything change in your environment since it was last documented? Consider a manufacturer that added a supplier portal after completing its earlier documentation. The new portal may change access, storage and support arrangements even though the original assessment spreadsheet has not changed. The pause offers time to investigate that discrepancy. It does not make the old boundary accurate.

Assign each uncertainty to a person who can resolve it. A contracts specialist may establish the information-handling obligation; a system administrator may establish the actual storage location. Neither answer should substitute for the other. GAVII Cybersecurity’s compliance services address this connection between obligations, scope and implementation.

2. Treat self-assessment as a finding that needs evidence

A self-assessment is still an assessment. A result should be reproducible from the applicable objectives, scope and evidence, rather than copied from a prior score. For Level 2 self-assessment, the program rule specifies the assessment procedure and submission of results to SPRS. A separate affirmation requirement addresses continuing compliance. 32 CFR 170.16, 32 CFR 170.22

Select a small set of consequential findings and trace them completely. Can the owner explain the safeguard? Does the configuration support that explanation? Do operating records cover the relevant systems and accounts? What changed after the evidence was collected?

If the answer is uncertain, record an unresolved finding and investigate it. Do not preserve an attractive score by redefining missing evidence as completed work. Give the executive responsible for affirmation a clear account of limitations and corrective actions before asking for approval. False Claims Acts are still being pursued. Just recently in September 2026, Honeywell Aerospace settled with DOJ for $2 Million+ over false cybersecurity claims under self-attestation.

3. Fund work that remains useful across plausible outcomes

Separate near-term work into three groups: obligations already applicable, improvements justified by operational risk, and expenditures dependent on a future assessment decision. This creates a better spending discussion than a single line labeled “CMMC project.”

Work in the first two groups can include correcting access rights, validating backups, documenting provider responsibilities, improving incident reporting and maintaining an accurate inventory. Select work according to actual findings. An organization with reliable backups but uncontrolled administrator access should not repeat a familiar backup project merely because it is easy to describe.

For a purchase tied mainly to a future assessment route, record the trigger for reconsideration. That trigger could be an issued contract amendment, a new official requirement or a documented business need for voluntary assessment. Avoid treating a vendor’s prediction as the trigger itself. Review cancellation, renewal and migration terms before committing to technology that would be difficult to change.

4. Prove recovery and response before relying on them

An organization can have approved incident procedures and still lack a workable escalation path outside business hours. It can receive successful backup notifications without having demonstrated a usable restoration. These gaps deserve attention regardless of how the certification program evolves.

At GAVII Cybersecurity, we help run controlled exercises for our clients using synthetic information and an approved restoration destination. Ask who can authorize containment, contact the provider, preserve relevant records and determine reporting obligations. Where DFARS 252.204-7012 applies, include its incident-reporting responsibilities in the exercise design. Do not wait for a full forensic conclusion before evaluating a reporting trigger. DFARS 252.204-7012

Capture decisions that could not be made, credentials or access that were unavailable, and dependencies on absent staff. Assign corrective actions with verification criteria. It’s more than just running the exercise, you must also be able to prove it. A calendar invitation and attendance list establish that people met; they do not establish that the response capability worked.

5. Use a short management cycle, with clear outputs

GAVII Cybersecurity recommends a short review cycle to prevent uncertainty from becoming inactivity. The following sequence is an illustrative management plan, not a government timetable or a promise of readiness within a fixed period.

First, reconcile contract requirements and scope. Next, identify the findings with the greatest operational or contractual consequence. Then authorize a manageable set of implementation and evidence tasks. Close the cycle by reviewing completed work, remaining dependencies and any official changes that affect the next decision.

Each task should have an owner, an expected result and a way to verify completion. “Improve documentation” is too broad. “Update the remote-access description after verifying the provider’s configured connection and approval process” gives the reviewer something concrete to inspect.

What should trigger a change in strategy?

Monitor the official CMMC site, the current deviation index and the documents issued for your work. Distinguish a public proposal, a task-force recommendation, an effective instruction and an executed contract change. A review deadline or industry forecast is not a replacement implementation date.

Maintain a decision log with the source, its date, the affected contract or system, and the resulting action. If future guidance changes the assessment model, this record will help the organization adjust without discarding valid security work.

The practical measure of progress during the pause is whether management can explain the boundary, demonstrate its safeguards and support its representations. Our Phase II pause checklist can help provide guidance. The work now is to reconcile that direction with your contract obligations and turn unresolved findings into verified improvements.