CMMC News: What Defense Contractors Should Verify

For a defense supplier, a change in program policy does not by itself tell you what an active solicitation or signed contract now requires. Treating an announcement as a clause amendment can create avoidable uncertainty for bids, delivery teams, and compliance owners.

Request a discussion about CMMC contract and evidence planning.

The practical first step is to separate the Department's announcement from the procurement documents governing each opportunity, then identify which contract terms and evidence records need review.

What Changed in CMMC News, and What Remains in Force?

The Department of War's July 13, 2026 announcement suspended CMMC Phase II. Which had been scheduled to begin on November 10, 2026, while a comprehensive review of the program proceeds. The announcement also established a CMMC Reform Task Force and expressly kept Phase I self-assessment requirements in force. For contractors, the practical distinction is material: the Phase II suspension is not a declaration that every CMMC obligation has stopped.

The official July 13 DoW release describes the suspension and review. The DoW's CMMC program page reiterates that Phase I self-assessment requirements remain in place. It also says that, during the interim period, DoW will enforce NIST SP 800-171 Revision 2 compliance through self-assessments and selected government-led assessments. Those statements establish the current public program position; they do not supply a blanket waiver for a contractor's specific award, solicitation, or data-handling obligations.

The July 13 implementation memo adds important boundaries. It limits the designations agencies may make during the suspension to Level 1 Self or Level 2 Self. And says agencies may not designate Level 2 C3PAO or Level 3 DIBCAC assessments during this period. It also directs contracting officers to amend active solicitations that contain the specified Phase II assessment requirements and to remove those requirements from existing contracts through modification on the stated schedule. Those are official instructions for contracting actions, not evidence that every affected document has already been changed. Contractors should check the actual solicitation or contract and its amendments rather than assume the update rewrote their terms automatically.

That is the useful frame for current CMMC news: identify which phase and assessment designation the announcement addresses, then separate program-wide statements from contract-specific records. Do not treat the word "suspension" as proof that Phase I has paused, or that Phase II requirements remain unchanged in every procurement. When a published clause, solicitation, or amendment appears inconsistent, seek clarification from the contracting officer and appropriate counsel. Keep the source, date, affected requirement, and responsible owner together in your CMMC evidence governance so the next internal or customer review can trace what the team relied on. A CISO security decision framework can also help leaders assign the policy question to the right contract, compliance, and security owners without turning an announcement into an unsupported operational assumption.

The review and task force signal that policy evaluation is underway; they do not, by themselves, announce a replacement schedule or a final set of reforms. Until DoW publishes further direction, preserve Phase I self-assessment obligations and verify Phase II-related changes against applicable official guidance and contract amendments.

How Should Contractors Read the September Deviation Signals?

Contractors should treat the September references as separate documents and verify any contract change against an official notice or the contracting officer. The July 13 Department of War announcement suspended CMMC Phase II, and its implementation memo set directions for solicitations and contracts. A separate September 3 Revision 3 document addresses a broad FAR Part 40 and DFARS Part 240 deviation. Its stated scope does not, by itself, establish the CMMC-specific implementation described in later commentary.

The July implementation memo is the primary reference for the suspension's operational directions. It says agencies may designate Level 1 Self or Level 2 Self during the interim period, and may not designate Level 2 C3PAO or Level 3 DIBCAC assessments. It also directs contracting officers to amend active solicitations containing those assessment requirements and to remove the requirements from existing contracts through modification. According to the memo's stated timing. These instructions are distinct from the public announcement of the suspension itself. Read the July 13 implementation memo.

Do not read the September 3 Rev. 3 title as evidence that this broad deviation is the CMMC-specific instrument. The official PDF identifies a FAR Part 40 and DFARS Part 240 revision, effective immediately. That scope is relevant to procurement, but the document should not be presented as proof that particular CMMC clauses changed. Review the official Revision 3 deviation and compare its text with the applicable solicitation and contract.

A September 22 Smith Currie article reports a separate CMMC Phase II class deviation and describes possible treatment of solicitations and awarded contracts. That is secondary legal commentary, not a substitute for the official deviation or a contract amendment. Where its account bears on a live procurement, ask the contracting officer for the applicable notice, amendment, or modification, and consult counsel before changing performance or compliance assumptions. The article's reported scenarios should not be generalized to every contract.

For each affected opportunity, maintain a dated record of the controlling solicitation or contract language. Any later written amendment, the source and date of the policy signal, and who confirmed its applicability. If the contract text, a standard clause page, and a deviation appear inconsistent, do not resolve the conflict from a news article alone. Request written clarification from the contracting officer and have counsel assess the contract-specific effect. Teams managing evidence alongside shifting procurement language can review CMMC evidence governance and the Vault Agentics compliance posture for related context.

What Does the CMMC Pause Mean for Solicitations and Existing Contracts?

The July 13 implementation memo gives contracting officers specific directions for solicitations and contracts that include Phase II third-party assessment requirements. It directs agencies to amend active solicitations with Level 2 C3PAO or Level 3 DIBCAC requirements. Contracting officers must remove them from existing contracts by modification before the next option period or at the next scheduled administrative modification. That is a procurement instruction, not evidence that every affected document has already changed.

For a proposal still under evaluation, inspect the solicitation and every amendment in the official procurement record. The July memo calls for an amendment when an active solicitation contains the specified assessment requirements. Until the contracting officer issues one, do not treat a policy announcement or a news report as a substitute for the solicitation's written terms. Confirm which version governs the submission and ask the contracting officer to resolve any discrepancy.

For an awarded contract, identify the clauses and CMMC assessment level stated in the signed instrument, then track formal modifications. The memo describes a modification process and timing tied to the next option period or scheduled administrative modification. It does not say that a contractor may unilaterally disregard existing text. Keep the current contract, modifications, and correspondence together so contracts, compliance, and security teams make decisions from the same record. Strong CMMC evidence governance helps preserve the basis for those decisions.

September coverage adds a separate reported development, but it should be read as commentary until teams verify the primary deviation and its applicability. On September 22, Smith Currie reported a separate class deviation directing officers to revise Phase II third-party assessment requirements. The report describes amendments for proposals under evaluation and modifications for awarded contracts. Do not conflate that report with the July memo or the broad September 3 FAR Part 40/DFARS Part 240 deviation. Check the actual procurement record and seek written confirmation from the contracting officer and counsel.

Use Acquisition.gov as a reference for the current published text of DFARS 252.204-7021 and DFARS 252.204-7025, not as a replacement for checking the clause version incorporated into a specific solicitation or contract. Published clause pages may not reflect a deviation applicable to a procurement. Have counsel and the contracting officer verify the controlling language before changing proposal assumptions, compliance plans, or delivery commitments. Teams that need to align contract interpretation with security work can review their cybersecurity advisory and implementation needs. This is operational context, not legal advice.

What Should Executives Verify in Their CMMC Evidence Now?

Executives should reconcile each active CMMC obligation against the contract record, the affected information system, and the latest government direction before changing a readiness plan. The Department of War's July 13 implementation memo directs specific changes to solicitations and contracts containing Level 2 C3PAO or Level 3 DIBCAC assessment requirements. While Phase I self-assessment requirements remain in place. That is a reason to verify the record, not to assume a clause has changed without an amendment or modification.

Start with the executed contract or active solicitation, then compare its CMMC clauses and required level with every subsequent amendment, modification, or written direction from the contracting officer. Keep the date and source for each version. The current public texts of DFARS 252.204-7021 and DFARS 252.204-7025 can inform that review, but check the terms actually incorporated into the procurement and confirm discrepancies with the contracting officer and counsel.

Next, map the contract requirement to the system boundary and the CUI it covers. Record which business units, environments, services, and subcontractor connections fall within that boundary, and identify the evidence supporting the scope decision. A status statement without a traceable system scope can leave executives unable to tell whether the assessment record represents the environment supporting the contract.

For each applicable status or assessment record, identify the accountable owner, the source system, the date last verified, and the underlying evidence. Confirm whether a self-assessment, status entry, or affirmation applies to the specific contract and required level; do not treat every status field as universally applicable. The implementation memo permits Level 1 Self or Level 2 Self designations during the interim period. It also directs amendments to active solicitations with specified third-party assessment requirements and contract modifications under stated conditions. Preserve the official record and written contract action that support your interpretation.

• Contract: What clause and CMMC level apply, and is there a later written amendment or modification?
• Scope: Which information system and CUI flows support the contract, and who approved that boundary?
• Status: Which assessment, SPRS representation, or affirmation is applicable, and what dated record substantiates it?
• Ownership: Who maintains each item, where is its source, and when will it be reviewed again?

This evidence register is an internal control recommendation, not a new CMMC requirement. Link each conclusion to its source and retain prior versions so policy changes do not erase the decision trail. Strong CMMC evidence governance helps leadership distinguish an official requirement from an internal readiness action. Where the evidence itself needs structured review, use the Trust Center route to request compliance evidence for Vault Agentics' own materials; it is not a substitute for contract-specific evidence or government records.

How Can Suppliers Sequence Readiness While Policy Is Reviewed?

Suppliers should preserve verified security controls and evidence while tying new readiness work to the requirements that actually govern their contracts. The Department of War's July 13 announcement suspended the transition to Phase II and said Phase I self-assessment requirements remain in place. It also described a comprehensive review of CMMC. That announcement is a reason to recheck assumptions, not to abandon security work or treat every possible future change as settled. Read the Department's announcement and record what it does and does not say.

Start with the contract-specific baseline. Contracts, solicitations, prime-contractor flow-downs, and the systems that handle contract information can differ. Identify the clauses and requirements cited in each relevant document. The current status or affirmation associated with the in-scope system, and any written amendment or direction received from the contracting officer. Keep the source and date with each conclusion. Where the language conflicts or its effect is unclear, ask the contracting officer and appropriate counsel rather than substituting an industry interpretation for a formal instruction.

Keep operational safeguards moving while policy is reviewed. Maintain controls already in service, remediate known weaknesses according to their security impact. And preserve evidence that shows who owns a control, how it operates, and when it was last checked. Keep system boundaries and data flows current enough to explain which environments and suppliers handle Federal Contract Information or Controlled Unclassified Information. This work remains useful for security operations and contract decisions even when a future assessment path is uncertain. Do not recast a readiness record as proof of a status that has not been formally established.

Sequence spending around confirmed exposure and commitments. Address a documented contract obligation, an active security gap, or an approaching customer decision before investing in work based only on an assumed future rule. Break larger architecture changes into reviewable stages, identify dependencies, and note which decisions can wait for a formal update. A staged plan preserves momentum without making the opposite mistake of buying against a requirement that has not been verified. CMMC evidence governance helps teams make ownership and substantiation part of this process.

Schedule a discussion about contract-aligned CMMC readiness planning.

Assign an owner to monitor official notices and contract communications, then revisit the plan when a new solicitation, written modification, or authoritative program update changes the facts. Keep prior decisions and their sources in the record so teams can distinguish what was required at the time from what changed later. For support connecting assessment, architecture, and implementation priorities, explore Vault Agentics' cybersecurity advisory and implementation services. This approach keeps preparation bounded by verified obligations while sustaining the security work that protects the business.

How Do MSSPs and Subcontractors Manage Flow-Down Uncertainty?

MSSPs, prime contractors, and subcontractors should manage CMMC flow-downs from the actual solicitation, subcontract, and written amendments, not from headlines alone. The Department of War describes CMMC as addressing protection of information flowed down to subcontractors. Contractors and subcontractors entrusted with FCI or CUI may have a specified CMMC level as a condition of award. That program-level direction does not, by itself. Identify the exact terms in any particular commercial subcontract or resolve how an existing contract is affected by a later policy announcement. Review the DoW program description alongside the governing contract documents.

Each party should map the requirement to its role and data flow. A prime may pass down specific security or assessment terms, while an MSSP may support systems, evidence, or services without becoming the prime's compliance owner. The relevant contract language, statement of work, CUI handling, and amendments determine the responsibilities the parties have agreed to. Do not substitute a general description of CMMC or a vendor's standard security policy for that review.

Separate binding contract language from policy direction in the change process. A public announcement signals a government position; it is not a substitute for a written contract change between the parties. When a prime or customer interprets a CMMC update as changing a flow-down, ask which solicitation clause, contract provision, or written amendment supports that interpretation. Record the response and route any material disagreement through the responsible contracts and legal teams. This is an operational control, not legal advice.

Upstream communication prevents suppliers from acting on different versions of the same requirement. The prime should identify affected suppliers, communicate the current requirement and source document, and state whether a change is proposed, pending, or formally incorporated. Subcontractors and MSSPs should confirm receipt, flag conflicting language promptly, and avoid representing that a requirement has been removed until their contract owner confirms the change in writing. Keep dated copies of the relevant clause and amendment with the decision record.

Evidence responsibilities also need explicit owners. Agree who maintains system boundary descriptions, security artifacts, incident contacts, and evidence requests; specify how updates are shared and who approves material changes. A vendor can provide evidence about its own controls, but that evidence does not automatically establish the prime's or another supplier's status. Clear scope and escalation paths reduce duplicated requests and gaps when a customer asks for support. For a broader framework for evaluating third-party exposure, see enterprise vendor risk management.

Contract and security leaders can use a short review record to align the chain.

• Identify the controlling solicitation, subcontract clauses, and latest signed amendment.
• Assign an owner for each flow-down, evidence item, and upstream clarification.
• Log policy updates separately from changes incorporated into contract language.
• Set a review trigger when the prime issues a formal amendment or new direction.

How Should a CMMC News Brief Become an Action Log?

Keep the review focused on the sources and contract changes that matter to each opportunity.

Reference summary.

A dated CMMC news action log turns a policy signal into a controlled review of the solicitations, contracts, and internal evidence it may affect. Treat the log as an internal governance template, not a government-prescribed form or a substitute for direction from the contracting officer and counsel. Its purpose is to preserve what the organization knew, what it verified, and what decision remains open.

Create an entry for each meaningful announcement, deviation, solicitation amendment, or contract modification. A news report can prompt review, but does not establish that a particular contract has changed. Use this sequence for each entry.

1. Record the source, date, and status. Capture the document title, issuing authority or publisher, publication or signature date, URL, and the date your team reviewed it. Mark its status in plain language, such as official announcement, official deviation, secondary commentary, or contract-specific amendment received. If the source is commentary, label it as such and identify the primary document still needed.
2. Identify affected solicitations and contracts. List the opportunity or contract number, customer or prime, relevant period, and the specific solicitation or contract version checked. Note whether the matter is an active proposal, awarded contract, subcontract, or only a potential pipeline item. Do not mark an item affected solely because a headline discusses CMMC.
3. Write the delta. Quote or reference the prior clause or requirement, then describe the exact change shown in the verified notice or amendment. Separate confirmed text from interpretation. If no contract-specific amendment has arrived, record "no written change received" rather than treating a reported policy shift as an effective contract edit.
4. Name an accountable owner. Assign one person to coordinate the contract review, with supporting contacts from contracts, security, and compliance as needed. Record who must obtain clarification from the contracting officer and who can approve an internal response. Avoid vague assignments to a department or shared mailbox.
5. Attach the evidence and task. Link the source, relevant solicitation or contract version, correspondence, and the internal review task. Preserve the date and version of each artifact so another reviewer can reconstruct the decision. A consistent approach to CMMC evidence governance keeps ownership and evidence lineage visible without implying that every news item changes a control.
6. Set the next review date. Choose a date or event that will prompt reassessment, such as receipt of a formal amendment, a contracting-officer response, or a scheduled proposal or option decision. The owner should update the status, record what changed, and close the task only when the open question has a documented disposition.

Keep the log concise enough for contracts and security leaders to use together. A useful entry makes uncertainty explicit, routes the next question to a named owner, and prevents an unverified interpretation from becoming an operational assumption. Review the record when new official guidance or contract-specific text arrives, and retain the earlier entry rather than silently overwriting the history.

Frequently Asked Questions

Are Phase I self-assessment requirements still in force after the July suspension?

Yes. The Department of War's July 13 announcement suspended the transition to Phase II and expressly said Phase I self-assessment requirements remain in place. It did not announce a general suspension of CMMC or erase the need to verify the level and status required for a specific award. Read the Department's announcement.

Did the announcement automatically amend an existing contract's CMMC terms?

Do not treat the public announcement alone as a contract amendment. September 22 commentary from Smith Currie describes a separate September 3 class deviation and says formal modifications may be needed for existing awards. That is secondary reporting, not a substitute for the contract record. Ask the contracting officer for the applicable written modification and confirm its effect with contract counsel. Smith Currie's report

How should a supplier respond when an active solicitation still contains Phase II language?

Use the current solicitation as the operative document until the contracting officer issues an amendment or other written direction. Request clarification through the solicitation's designated channel, track any response and revised clause text, and assess proposal assumptions against the amended version. Do not infer that an announcement has changed a pending procurement's terms without the contracting office's written action.

Which source controls when a DFARS page appears inconsistent with a class deviation?

Compare the current solicitation or contract, the cited clause version, and the specific deviation or amendment identified by the contracting officer. Acquisition.gov's standard DFARS clause pages provide text, but a deviation may alter its application. If the documents conflict or the deviation's reach is unclear, request written contracting-officer guidance and have counsel interpret the controlling terms before changing performance or compliance decisions.

Turn CMMC Developments Into a Clearer Readiness Decision

Contract-specific review can connect current CMMC developments to the clauses, evidence, and open questions that matter for your organization. Contact Vault Agentics to discuss a contract-specific CMMC readiness and evidence review.