CMMC Phase 2 Is Paused (For Now). Here’s What Defense Supply Chain Managers Should Do Next.
File in the “Wait, What?” folder. The Department of War’s recent decision to suspend the planned rollout of CMMC Phase 2 has generated plenty of discussion across the defense industrial base. For many manufacturers, the immediate reaction was simple: Does this mean CMMC is going away?
But we know better, and the the short answer is no.
The suspension delays when third-party CMMC Level 2 certification will become mandatory for many contracts. It does not eliminate the underlying responsibility to protect Controlled Unclassified Information (CUI), nor does it remove existing cybersecurity obligations under DFARS 252.204-7012 or NIST SP 800-171.
But it does removed some of the stress that was clear on the supply chain. We’ve invested (a lot) and are proud of the accomplishments it has delivered for us. We’re stronger, we’re better, and we’re ready, but we also understand the investment it took.
so, while we know that we can deliver, the question most important for defense supply chain managers is what changed? How should supplier qualification change while these requirements are under review?
What Actually Changed?
The Department suspended the planned November 2026 transition into Phase 2 while conducting a broader review of the CMMC implementation strategy.
During this pause:
- Mandatory C3PAO Level 2 assessments are temporarily suspended for new Phase 2 solicitations, but self assessment and system inputs into Supplier Performance Risk System (SPRS) are still required.
- Existing solicitations requiring those assessments are expected to be amended.
- Existing contracts will be updated through normal contract administration.
- Suppliers may continue using the applicable self-assessment requirements where permitted.
What didn’t change is equally important.
Organizations handling Controlled Unclassified Information must still safeguard that information using the security requirements defined by NIST SP 800-171, along with any cybersecurity obligations included in their contracts.
For buyers, cybersecurity expectations have not disappeared—they’ve simply become less dependent on one qualification milestone.
What This Means for Small Defense Suppliers
For many small manufacturers, the suspension provides welcome breathing room.
Third-party certification requires significant investments in cybersecurity, documentation, employee training, and independent assessment. Delaying that requirement reduces immediate financial and administrative pressure while the Department evaluates the program. And while those that have invested the time, effort, and resources are smarting a bit, we do understand.
That said, the suspension should not be interpreted as a reason to pause cybersecurity improvements.
Suppliers that continue strengthening their security programs will be better positioned when future requirements are finalized and will likely be more attractive partners for defense customers today.
What This Means for Defense Supply Chain Managers
This is where the biggest change occurs.
Previously, many buyers expected CMMC Level 2 certification to become a straightforward qualification requirement.
During the suspension, supplier evaluation becomes more nuanced.
Rather than asking only whether a supplier holds a third-party certification, buyers should develop a broader understanding of a supplier’s cybersecurity maturity.
Questions worth asking include:
- Does the supplier currently handle Controlled Unclassified Information?
- What cybersecurity framework supports their operations?
- Have they completed a Level 2 self-assessment or an independent C3PAO assessment? Can they show you in the Supplier Performance Risk System (SPRS) system?
- How is access to technical data and CUI controlled?
- Are cybersecurity processes integrated into daily operations or simply documented?
Certification remains valuable, but it becomes one indicator of supplier readiness rather than the only indicator.
What We’ve Learned
Cybersecurity maturity isn’t built when a contract requires it.
It’s built over time through documented processes, employee training, controlled access to sensitive information, and continuous improvement.
Organizations that invested early in cybersecurity are generally better prepared to adapt as government requirements evolve because the underlying systems are already part of their daily operations.
At Borg Design, our investment in CMMC Level 2 certification was never about meeting a single implementation date. It was about establishing disciplined processes that support customers handling sensitive defense information today and preparing for the future requirements of the defense industrial base.
Five Questions Every Supply Chain Manager Should Ask
As supplier qualification evolves, these questions can provide valuable insight:
- How does the supplier identify and protect Controlled Unclassified Information?
- What cybersecurity framework governs their security program?
- Have they completed a CMMC Level 2 self-assessment or independent certification?
- How are technical drawings and sensitive customer information controlled throughout production?
- If third-party certification requirements return, is the supplier already prepared?
These conversations often reveal more about operational readiness than certifications alone.
So, What’s the Bottom Line Here?
The CMMC Phase 2 suspension changes the implementation timeline. It does not change the responsibility to protect sensitive defense information.
For defense supply chain managers, this is an opportunity to look beyond certification status and evaluate the maturity of a supplier’s cybersecurity program, quality system, and operational discipline.
Suppliers that continue investing in secure processes today will be better positioned regardless of how the Department ultimately revises the CMMC rollout.
Questions to Discuss with Your Team
Before your next supplier qualification meeting, consider asking:
- Which suppliers currently handle Controlled Unclassified Information?
- Which suppliers have independent cybersecurity validation?
- Are our qualification criteria aligned with current Department guidance?
- If CMMC Phase 2 resumes, which suppliers are already prepared?
- Are we evaluating cybersecurity as part of operational readiness, not just compliance?
Related Resources
Defense Industry CNC Machining
CMMC Level 2 Certified Machine Shop
ITAR vs. CMMC: What Defense Buyers Need from Suppliers
Defense Supplier Readiness Guide
