Topic starter
30/07/2026 10:50 pm
TL;DR: The Department of Defense has paused the mandatory C3PAO third-party assessment for CMMC Level 2 contracts while keeping Phase I requirements, self-assessments, NIST SP 800-171 controls, DFARS reporting, and enforcement in place, according to AppGate. The governance problem has shifted from audit timing to proving defensible access control, because compliance obligations did not disappear with the paused assessment requirement.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “CMMC Phase II Is Paused: Why Defense Contractors Cannot Afford to Stop Preparing”.
By the numbers:
- The CMMC pause still leaves the 110 security controls in NIST SP 800-171 Rev. 2 in force for contractors handling FCI or CUI.
- The 60-day review is meant to realign CMMC with the Secretary's Acquisition Transformation Strategy.
Key questions
Q: What breaks when CMMC Level 2 third-party audits are paused?
A: What breaks is the false assumption that compliance work can pause with the audit calendar.
Q: Why does the CMMC pause still matter for defence contractors?
A: Because the pause changes only the verification mechanism, not the security obligation.
Q: How should contractors measure whether CMMC readiness is real?
A: They should measure whether they can produce current SSPs, active POA&Ms, scoped inventories, access review records, and system boundary evidence without last-minute reconstruction.
Practitioner guidance
- Preserve CMMC control evidence now Keep screenshots, policy records, approvals, SPRS inputs, and revocation logs current so the paused audit requirement does not create a later evidence gap.
- Re-baseline access to FCI and CUI Review who can reach Federal Contract Information and Controlled Unclassified Information, then tighten role scope so access decisions can be defended during self-assessment or later review.
- Tie ZTNA policy to contract data boundaries Use identity-driven policy and micro-segmentation to keep protected resources invisible except to explicitly authorised users and devices.
Bottom line: The CMMC pause affects one assessment requirement, not the underlying obligation to protect defence information and prove control maturity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:57 pm
Assessment delays do not change the underlying access-governance burden. The DoD has paused one verification mechanism, not the need to control access to FCI and CUI. That means the governance challenge has shifted from proving readiness to an assessor on a fixed date to sustaining defensible controls continuously. For practitioners, the important conclusion is that assurance timing has changed, but the control expectation has not.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should contractors keep remediation moving despite a compliance pause?
A: They should keep moving whenever the work affects access scope, evidence quality, or reporting accuracy, because those obligations remain in force. A pause in one assessment step does not reduce the cost of rebuilding controls later, and it can make the backlog harder to clear when scrutiny returns.
👉 Read our full editorial: DoW pauses C3PAO audits: what CMMC changes for contractors