DoW pauses C3PAO audits: what CMMC changes for contractors

At a glance

What this is: The DoD’s pause on mandatory C3PAO audits changes CMMC timing, but not the underlying access-control and reporting obligations contractors must still meet.

Why it matters: IAM, PAM and NHI teams supporting defence suppliers should treat the pause as a scheduling change, not a control relaxation, because evidence quality still drives contract readiness.

By the numbers:

• The CMMC pause still leaves the 110 security controls in NIST SP 800-171 Rev. 2 in force for contractors handling FCI or CUI.
• The 60-day review is meant to realign CMMC with the Secretary's Acquisition Transformation Strategy.

Context

The Department of Defense has paused one CMMC requirement, but the programme itself is still active. The change applies only to the mandatory C3PAO third-party assessment for Level 2 contracts, while self-assessments, DFARS reporting, and the underlying security obligations remain in place for contractors handling FCI or CUI.

For identity and access teams, the practical issue is not whether an audit is delayed but whether the organisation can still prove who can access what, under what conditions, and with what evidence. That makes the article primarily about access governance, contract assurance, and the durability of control evidence during a period of policy uncertainty.

This is a governance pause, not a security pause. Contractors that treat the change as relief from preparation risk creating a backlog of controls, evidence, and approvals that will still be required when external assessments return.

Key questions

Q: What breaks when CMMC Level 2 third-party audits are paused?

A: What breaks is the false assumption that compliance work can pause with the audit calendar. Contractors still need to control access to FCI and CUI, maintain self-assessment evidence, and keep DFARS reporting ready. The practical failure is letting control maturity slip while waiting for external verification to return.

Q: Why does the CMMC pause still matter for defence contractors?

A: Because the pause changes only the verification mechanism, not the security obligation. Contractors that handle FCI or CUI still need demonstrable access control, incident reporting, and accurate self-assessment scores. If those controls are weak, the delay simply postpones scrutiny rather than reducing risk.

Q: How should contractors measure whether CMMC readiness is real?

A: They should measure whether they can produce current SSPs, active POA&Ms, scoped inventories, access review records, and system boundary evidence without last-minute reconstruction. If the evidence only exists during audit preparation, readiness is not operational. Real readiness shows up as repeatable proof, not as a one-time document sprint.

Q: When should contractors keep remediation moving despite a compliance pause?

A: They should keep moving whenever the work affects access scope, evidence quality, or reporting accuracy, because those obligations remain in force. A pause in one assessment step does not reduce the cost of rebuilding controls later, and it can make the backlog harder to clear when scrutiny returns.

Technical breakdown

What the CMMC pause actually changes in contractor assurance

The DoD has suspended only one element of Phase II, the mandatory certified third-party assessment for CMMC Level 2. That does not remove the control set, the need for self-assessment, or the reporting obligations tied to DFARS. In practice, assurance shifts from a fixed external assessment cadence to a mixed model of self-attestation, selected government-led checks, and future revalidation. The security problem is therefore one of evidence continuity, not control elimination. Contractors still need demonstrable access control, incident reporting, and score accuracy even when the external audit is temporarily absent.

Practical implication: Treat the pause as an assurance-model change and preserve the evidence trail needed for later third-party validation.

Why access control remains the centre of CMMC readiness

CMMC and NIST SP 800-171 both focus heavily on who can reach sensitive information and how that access is constrained. That makes identity governance, least privilege, and session containment more important than the audit schedule itself. If users, devices, and contractors retain broad or unclear access paths, the organisation may still struggle to justify its SPRS score or defend a self-assessment. The core technical issue is not whether controls exist on paper, but whether access paths are narrow, monitored, and traceable enough to survive scrutiny under either self-assessment or a later C3PAO review.

Practical implication: Map every FCI and CUI access path to an owner, an approval basis, and an evidence source before the review cycle resumes.

How ZTNA supports the control evidence contractors need

Zero Trust Network Access is relevant here because it enforces access decisions at connection time rather than assuming broad network trust. Single packet authorization, identity-driven policy, MFA, and micro-segmentation all help reduce the attack surface and make access decisions easier to evidence. This matters for CMMC because assessors and self-assessments both need proof that access is limited, conditional, and revocable. ZTNA does not replace the CMMC control set, but it can make access boundaries more defensible across on-premises, cloud, and hybrid environments.

Practical implication: Use ZTNA to tighten access scope and generate auditable records that support CMMC and NIST SP 800-171 reviews.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Assessment delays do not change the underlying access-governance burden. The DoD has paused one verification mechanism, not the need to control access to FCI and CUI. That means the governance challenge has shifted from proving readiness to an assessor on a fixed date to sustaining defensible controls continuously. For practitioners, the important conclusion is that assurance timing has changed, but the control expectation has not.

Identity evidence now matters more than audit theatre. When external reviews are delayed, weakly governed access can hide in the gap between self-attestation and later inspection. Contractors that cannot show clear entitlement ownership, approval history, and revocation evidence will still face exposure, whether the review comes from a C3PAO, the government, or an enforcement action. The practical lesson is that evidence quality is the control, not a by-product of the control.

Access granularity is the decisive compliance variable. CMMC for defence contractors is really a test of whether access boundaries are precise enough to protect mission data under changing assessment models. If broad network trust remains the default, the programme becomes harder to defend as scrutiny shifts between self-assessment, spot checks, and formal audits. Practitioners should expect access scope, not audit cadence, to remain the most visible indicator of maturity.

Compliance backlog risk is now a programme-management problem. A pause can encourage drift, but the organisations that stop work will simply re-enter the queue later with more remediation debt and less time. That is especially true for contractors with mixed FCI and CUI environments, where access control, logging, and reporting must align across multiple systems. The field should read this as a test of operational discipline, not a reprieve.

Third-party verification is becoming a timing variable, not a governance substitute. The C3PAO pause shows that external assessment can move, but it cannot replace the contractor’s own access-control discipline. The longer-term pattern is toward evidence-driven assurance that must stand up both before and after formal audits. Practitioners should therefore build for continuous defensibility, not one-off certification events.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: IAM and IGA Basics

What this signals

The pause creates a timing change, not a governance reset. Contractors should expect audit evidence, access review discipline, and incident-reporting readiness to remain the deciding factors when CMMC scrutiny resumes.

Assessment-bypass backlog: when formal audits slow down, organisations that already struggle with evidence collection tend to defer remediation instead of reducing risk. That increases the chance that control gaps will reappear under greater time pressure later.

For contractors handling CUI, the useful metric is not whether the external assessor is delayed but whether access boundaries, revocation logs, and self-assessment records can still support a defensible posture across hybrid environments.

For practitioners

• Preserve CMMC control evidence now Keep screenshots, policy records, approvals, SPRS inputs, and revocation logs current so the paused audit requirement does not create a later evidence gap.
• Re-baseline access to FCI and CUI Review who can reach Federal Contract Information and Controlled Unclassified Information, then tighten role scope so access decisions can be defended during self-assessment or later review.
• Tie ZTNA policy to contract data boundaries Use identity-driven policy and micro-segmentation to keep protected resources invisible except to explicitly authorised users and devices.
• Track the 60-day policy review Monitor the CMMC Reform Task Force review and map any outcome against your current remediation backlog so delayed action does not become rework.

Key takeaways

• The CMMC pause affects one assessment requirement, not the underlying obligation to protect defence information and prove control maturity.
• Contractors still need to maintain access evidence, self-assessment scores, and DFARS-related reporting even while the C3PAO mandate is on hold.
• The organisations that keep tightening access governance now will face less rework when formal audits and broader federal CUI rules tighten again.

Key terms

• Cmmc Level 2: A defence-contract compliance target that requires a defined set of security practices and supporting evidence. It goes beyond implementing controls in principle and expects organisations to show that the practices are operating consistently and are backed by documentation.
• C3PAO: A C3PAO is a Certified Third-Party Assessor Organisation that evaluates whether an organisation meets CMMC requirements. Its role is to validate implementation through documentation, interviews, and testing, which means organisations must be able to demonstrate controls rather than simply describe them.
• Sprs Score: SPRS score is a DoD self-assessment result used to represent how fully NIST SP 800-171 requirements have been implemented. In readiness programmes, it serves as a directional indicator, but it only has value when the underlying control evidence and remediation status are current and defensible.
• Controlled Unclassified Information: Controlled Unclassified Information, or CUI, is sensitive federal information that must be protected according to defined handling rules outside federal systems. For practitioners, the key issue is not only storage security but also proving that every system, identity, and data path in scope preserves those rules.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.