Productivity
Improve Your Workplace Productivity With Microsoft Word: 11 Tips To Make the Most of This Program
Microsoft Word is an indispensable part of most business environments. It has numerous features that
February 28, 2022
On July 13, 2026, the Department of War announced that it was suspending the upcoming Phase 2 requirements of the Cybersecurity Maturity Model Certification program, commonly called CMMC.
This announcement does not eliminate CMMC. It does not eliminate cybersecurity requirements for defense contractors. It primarily pauses the expansion of mandatory third-party CMMC Level 2 certifications while the Department reviews and potentially restructures the program.
The simplest explanation is: Companies may no longer need a third-party CMMC Level 2 certification during the suspension, but companies handling Controlled Unclassified Information must still implement the required security controls and complete the applicable self-assessment.
The Department suspended the transition to CMMC Phase 2, which had been scheduled to begin November 10, 2026. During Phase 2, an increasing number of contracts involving Controlled Unclassified Information, or CUI, were expected to require a formal CMMC Level 2 assessment performed by an authorized Certified Third-Party Assessment Organization, known as a C3PAO.
During the suspension:
The Department has also paused future CMMC implementation milestones while it conducts a comprehensive review.
No. There is an important difference between being compliant and being certified.
Level 2 is based on the security requirements in NIST Special Publication 800-171 Revision 2. These requirements address areas such as:
Organizations that handle CUI are still expected to protect it according to the applicable contract requirements, including DFARS 252.204-7012.
Certification means that a C3PAO examines the organization and independently verifies that the requirements have been implemented. The current suspension removes the Level 2 C3PAO assessment requirement from Department solicitations and contracts during the review period. It does not remove the underlying security obligations. The Department’s implementation instructions specifically state that DFARS 252.204-7012 remains in effect and that baseline NIST SP 800-171 compliance will continue to be enforced through Level 2 self-assessments and selected government-led assessments.
Yes. The Department clearly stated that all Phase 1 self-assessment requirements remain in place. During the suspension, contracts may require:
This generally applies when a contractor handles Federal Contract Information, or FCI, but does not handle CUI. Level 1 is based on the basic safeguarding requirements in FAR 52.204-21.
This may apply when a contractor handles CUI. Level 2 self-assessment is aligned with the 110 security requirements in NIST SP 800-171 Revision 2. The organization must assess its environment using the required assessment methodology and submit the results in the Supplier Performance Risk System, known as SPRS.
The Level 2 self-assessment rules also require:
The Department also retains the authority to conduct a government assessment. If a DCMA DIBCAC assessment finds that the organization’s self-reported status is inaccurate, the government’s findings take precedence.
No. The third-party certification expansion is paused. The cybersecurity baseline is not.
Contractors must still pay attention to:
The Department’s memorandum states that all other contractual cybersecurity clauses remain intact.
Organizations should not stop their compliance work. A reasonable approach is to continue building and maintaining the same security foundation that would support a successful Level 2 certification.
Do not assume that every defense contractor has the same requirement.
Review:
The information you receive and process determines whether Level 1 or Level 2 applies.
Organizations handling CUI should confirm that their NIST SP 800-171 assessment is current, accurate, properly scoped, and submitted in SPRS. A score entered several years ago may no longer accurately describe the environment.
A self-assessment is still a formal representation to the federal government. The assessment should reflect the organization’s actual implementation, not its future plans or the security features it has merely purchased. A tool, license, policy template, or managed service does not automatically mean a security requirement has been met.
The System Security Plan, or SSP, should explain:
Organizations should continue working through legitimate Plans of Action and Milestones. The pause should be used as additional preparation time, not as permission to delay necessary security improvements.
CUI protection does not stop with the prime contractor. Review whether subcontractors, cloud providers, managed service providers, consultants, and other external organizations can access or support systems containing CUI. Cloud services used to process, store, or transmit CUI may need to meet FedRAMP Moderate authorization or equivalency requirements. External service-provider responsibilities must also be properly documented and included within the appropriate assessment scope.
Maintain evidence showing that security practices are operating effectively.
Examples may include:
A future assessor will normally look for evidence that controls are consistently practiced, not merely documented.
Yes. The Department described the action as a suspension and announced a review of the program. It did not repeal the CMMC regulations or state that independent verification would never return. The Department established a CMMC Reform Task Force and announced a 60-day review focused on reducing cost, lowering barriers for smaller businesses, improving scalability, and maintaining cybersecurity resilience.
Several outcomes are possible:
At this point, no one outside the decision-making process can state with certainty which outcome will occur.
It is reasonable to expect that some form of independent verification will eventually return, particularly for organizations handling sensitive or high-risk CUI. That is an informed assessment, not an official prediction. The government has repeatedly expressed concern that organizations may claim compliance without fully implementing NIST SP 800-171. CMMC was created largely to add verification to requirements that contractors were already expected to follow. The current announcement criticizes the cost and structure of the program, but it also emphasizes that strong cybersecurity and operational resilience remain critical.
Our practical assessment is:
An existing certification still provides value. It demonstrates that the organization completed an independent assessment under the current framework. It may also provide a competitive advantage when working with prime contractors or customers that continue to prefer independently validated suppliers.
However, organizations should monitor future Department guidance concerning:
The suspension announcement does not automatically invalidate previously issued certifications.
Prime contractors should not tell subcontractors that CMMC or NIST SP 800-171 no longer applies.
Prime contractors should instead:
The pause may reduce immediate assessment costs, but it does not remove responsibility for protecting government information throughout the supply chain.
The July 2026 announcement is a pause in the expansion of mandatory third-party certification, not the end of CMMC and not the end of defense-contractor cybersecurity compliance.
Organizations handling FCI or CUI should continue to:
Stopping compliance work now could create contractual risk, cybersecurity risk, and a costly rush if independent certification requirements are reinstated. The safest approach is to remain compliant and assessment-ready while avoiding unnecessary spending that depends solely on the suspended November 2026 certification deadline.
This article is provided for general educational purposes and is not legal advice. Contract requirements may vary. Contractors should review their specific contracts, solicitations, data flows, and legal obligations before making compliance decisions.
Microsoft Word is an indispensable part of most business environments. It has numerous features that
Your business can benefit a lot from working with an IT provider. However, you need
Making the most of your Microsoft 365 apps requires you to adopt appropriate security measures.
You may have state-of-the-art servers, but their efficiency can diminish over time. Managing them is