Solution Builders team
Jump to a section
- The pause is narrow. It covers the outside audit, not the security work underneath it. All 110 NIST SP 800-171 controls still apply today.
- With assessments on hold, the signed affirmation is the main enforcement. A false one is a False Claims Act problem with triple damages.
- About 80,000 companies need Level 2 and under 100 assessors exist. With a 6 to 12 month runway, the line matters more than the date.
- Five moves fit the pause: rescore truthfully, make the SPRS score true, fix the paper trail, ask your primes, and keep building toward Level 2.
The CMMC Phase 2 pause, explained for Minnesota defense contractors
If you run a machine shop in the metro or a plant in Greater Minnesota that supplies a defense prime, the last year has been a calendar exercise. November 10, 2026 was circled as the day third party certification became a condition of award. Then the date moved, and the questions started: do we stop the project, do we keep paying for the enclave, and what does the prime expect now?
Here is the sequence, as of October 2026, for Minnesota defense contractors trying to make sense of the CMMC Phase 2 pause.
- November 10, 2025: Phase 1 beginsSelf assessment requirements start appearing in defense solicitations and contracts.
- July 13, 2026: Phase 2 is suspendedTwo Department of War memoranda pause mandatory third party certification and launch a 60 day review of the program by a Reform Task Force.
- September 3, 2026: the pause enters contract rulesContracting officers are directed to remove third party assessment requirements from solicitations.
- September 11, 2026: the review closesThe task force delivers its recommendations. As of October, the report has not been made public.
- November 10, 2026: the original Phase 2 dateOn hold. No replacement date has been announced.
Paused. Not over.
The suspension is narrow. It covers the outside audit, not the security work underneath it. Nothing in the memoranda changed the contract clauses that require you to protect controlled unclassified information today, and no new timeline has been published. Treat anything you hear about new dates as rumor until it appears in a rule.
CMMC paused: what still applies to your contracts
Read the memoranda as two lists. One is what the government stopped asking for. The other is everything it never stopped asking for, which is longer and carries the real exposure.
What paused
- Mandatory third party certification as a condition of award
- Government led Level 3 assessments
- The November 10, 2026 start date
- CMMC waivers during the review
What did not pause
- Phase 1 self assessments
- A current, accurate SPRS score
- An annual affirmation signed by a senior official
- All 110 NIST SP 800-171 controls under DFARS 7012
- Reporting a cyber incident within 72 hours
- Whatever your prime contractors still require
In other words, the audit got postponed. The homework did not. The DFARS 7012 clause that has been in your contracts for years still requires NIST SP 800-171, still requires 72 hour incident reporting, and still flows down to every subcontractor handling controlled unclassified information. Phase 1 self assessments and the score you post in SPRS continue exactly as before the pause.
One more wrinkle. Program managers can still require a third party assessment on a specific contract, and some primes have kept their own supplier deadlines in place, pause or no pause. Ask before you cancel anything. If the answer is "we have not decided," that is still an answer, and it argues for keeping the program moving. Regulatory compliance support from Solution Builders treats CMMC paused the same way it treats CMMC live, because the controls are identical.
SPRS score, affirmation and the False Claims Act
A quick question for anyone with a defense contract. Who signed your CMMC affirmation this year, and would they bet their name on your SPRS score? Because that is exactly what they did.
With third party assessments on hold, the annual affirmation is now the main way CMMC gets enforced. A senior official certifies that the score you reported in SPRS is real. If it is not, that can become a False Claims Act problem, which allows for triple damages. The pause removed the auditor from the room. It did not remove the signature, and the signature is what the government can act on.
The scoring math matters here. A NIST 800-171 self assessment scores each of the 110 controls, and 88 of 110 is the minimum for conditional Level 2 status with a plan of action for the rest. A score of 110 with a dozen controls quietly unfinished is not a strong position. It is a liability with a date on it.
- Rescore yourself against all 110 controls, using what is in place today rather than what is planned.
- Document what is done, and write a real plan of action with owners and dates for what is not.
- Make sure the person signing the affirmation has read the score and the plan, and knows what the signature means.
- If the number on file is higher than reality, fix the number or fix the gap. Then affirm it.
An honest 92 beats a hopeful 110
An honest score with a real plan beats a hopeful perfect score every time. Primes can work with a supplier that has a credible path. Nobody can work with a supplier whose affirmation turns out to be a false claim, and the pause has made that signature the whole ballgame.
The line is long and most suppliers are staying in it
The strongest argument for keeping your program moving is arithmetic, not regulation. The certification gap existed before the pause, and the pause did nothing to close it.
Put those together. Tens of thousands of companies, fewer than a hundred organizations that can certify them, and a readiness runway of six months to a year. Only about 1,000 companies had been certified before the pause. When dates return, the line will be long, and the suppliers who kept moving will be at the front of it.
The Redspin survey found something else worth noting: 77% of subcontractors have heard nothing from their prime about the pause. Silence is not a policy change. Most primes have not decided what they will require, which means the requirement you built toward in June is the safest planning assumption for Minnesota defense suppliers today.
The manufacturers who keep building now will be ready whenever the new dates land. The ones who stop will be starting from zero, in line behind everyone else.The CMMC Pause Brief
Five smart moves to make during the pause
A quiet audit calendar is a gift if you use it. These five moves are ordered so each one makes the next one easier, and all five are things a CMMC compliance team in Bloomington does with clients every week.
- Rescore yourself, truthfullyCheck all 110 controls against what is really in place today, not what is planned. Use the NIST 800-171 self assessment methodology and keep the evidence next to each score.
- Make your SPRS score trueIf the number on file is higher than reality, fix the number or fix the gap. Then affirm it, with the senior official fully briefed.
- Get the paper trail in orderA current System Security Plan and a real plan of action and milestones are your best protection. Living documents, not boilerplate from a template.
- Ask your primes what they expectMost subcontractors have heard nothing. Do not assume silence means the requirement is gone. Get the answer in writing.
- Keep building toward Level 2The runway is 6 to 12 months. The suppliers who keep moving will be first in line when dates return.
One decision the pause did not touch at all is the cloud question. Which Microsoft 365 environment your company runs on, Commercial, GCC or GCC High, decides whether controlled unclassified information is in scope correctly, and getting it wrong can mean rebuilding later. A Microsoft 365 implementation designed for CMMC settles that question once, and it is often the longest lead item on the whole list.
What to do next with a CMMC consultant in Minneapolis
You do not need a new program. You need to confirm the one you have is accurate, documented and still moving. This week:
- Pull your current SPRS score and the date it was posted, and name the official who affirmed it.
- Email every prime you supply and ask, in one sentence, what they require from subcontractors during the pause.
- Open the System Security Plan and check the last revision date. Older than six months means it needs a pass.
- List the controls scored as implemented that you could not demonstrate to an assessor tomorrow.
- Confirm which Microsoft 365 environment holds your controlled unclassified information today.
If any item on that list gets an "I am not sure," a CMMC consultant in Minneapolis can close it quickly. Solution Builders offers a free 30 minute CMMC Readiness Snapshot: we tell you plainly where you stand across the 110 controls and what to fix first, paused or live. Our own practice is SOC 2 Type II audited, so your auditors can see our controls too.
New to CMMC altogether? Start with The Manufacturer's CMMC Playbook. One note: we wrote it before Phase 2 was paused, so its timeline chapter shows the original dates. Everything about the controls, the cloud and choosing a partner still applies.
General information, not legal advice. Talk to counsel about your specific contracts.
CMMC readiness for Minnesota defense suppliers
Solution Builders supports defense suppliers across the Twin Cities and Greater Minnesota from our Bloomington headquarters: gap assessments against all 110 NIST SP 800-171 controls, GCC High design and migration, System Security Plan authoring and assessment support. Our own practice is SOC 2 Type II audited, and we serve manufacturers with 25 to 500 employees in Minneapolis, St. Paul and statewide. Related services: CMMC Compliance, Regulatory Compliance, Microsoft 365. Contact us or book a 30 minute call.
