09/13/2026
On September 3, the Department of War did something most companies in the defense supply chain haven't heard about yet: it wrote July's CMMC Phase 2 suspension into binding contract language. Contracting officers are now directed to strip third-party certification requirements out of solicitations outright, not just treat them as paused.
That's real, and it's good news. It's also an incomplete answer to the question we keep hearing from owners and executives right now: does this mean we can stop worrying about CMMC?
No.
DFARS 252.204-7012 never paused — safeguarding CUI and reporting incidents within 72 hours are still required. The NIST SP 800-171 baseline, all 110 requirements, is still the bar contractors are held to. And the annual affirmation a named officer at your company personally signs still carries False Claims Act exposure if it's inaccurate. One enforcement mechanism moved. Everything you were already on the hook for didn't.
💡That gap, between what changed and what didn't, is exactly what we built a free three-part executive briefing series to close: CMMC: Straight Answers.
▶️ Session 1, Where Things Actually Stand, is Thursday, September 24 — 45 minutes, no pitch, no compliance checklist, just what changed and what it means before your next bid.
▶️ Sessions 2 and 3 follow in October and November: what scoping actually costs, and who's allowed to do what in your compliance program.
✅ Register for each Session here: https://hubs.li/Q04xkfYl0
⁉️ If you hold a DFARS clause, handle FCI or CUI, or sit anywhere in a prime's supply chain, what's the one CMMC question you'd want answered first?