The Department of Defense (DoD) has announced a pause on the rollout of CMMC Phase II, which was scheduled to require third-party assessments for many contractors handling Controlled Unclassified Information.
What does this mean?
✅ The requirement for CMMC Level 2 third-party certifications is currently on hold.
❌ It does NOT mean cybersecurity compliance is going away.
During this pause, contractors are still expected to comply with existing cybersecurity requirements, including:
• CMMC Level 1 self-assessments for organizations handling FCI
• CMMC Level 2 self-assessments aligned with NIST SP 800-171 for organizations handling CUI
Existing DFARS cybersecurity requirements remain in effect. The biggest mistake a contractor can make right now is assuming this pause means they can wait. Cybersecurity requirements are still contractual obligations, and organizations should continue building and maintaining compliance programs.
If you’re unsure where your organization stands, now is the perfect time to establish your baseline. Start by contacting C Three Business Consultants for a penetration test or vulnerability assessment. Understanding your current security posture is the first step toward identifying gaps, reducing risk, and preparing for future CMMC requirements.
Don’t use this pause as a reason to stop. Use it as an opportunity to get ahead!