The July 13, 2026 suspension of CMMC Phase II did not erase your compliance obligations. It removed a November 10, 2026 condition-of-award deadline that many defense suppliers had already baked into their msp contract and vendor agreements. That distinction matters. No Federal Register rule has amended 32 C.F.R. Part 170, and no DFARS class deviation has been published. Phase I self-assessment and annual SPRS affirmation duties remain firmly in place, and existing clauses such as DFARS 252.204-7021 remain enforceable unless modified.
Now is the time to reassess, not retreat. This how-to guide walks through what the July 13 suspension actually changed, what still applies, why cancelling compliance spend is the wrong move, and how to gather the paper trail before reopening contracts. You will learn how to audit MSP and vendor contracts for bundled certification work, separate surviving duties from suspended milestones, re-scope spend around what still counts, amend MSP agreements with specific language, and document the deliberate business decision. With the right guardrails, a pause in enforcement becomes a focused contract review, not a compliance gap. The goal is to reassess the contract, not the obligation.
What the July 13 Suspension Actually Changed
On July 13, 2026, the Department of Defense (DoD) suspended CMMC Phase II, removing the November 10, 2026 C3PAO condition-of-award mandate and replacing it with a pause pending policy review. The suspension arrived as a memorandum, not a rule. No Federal Register document has issued, 32 C.F.R. Part 170 remains unamended, and no DFARS class deviation has been published.
Phases 3 and 4 and all future implementation milestones are frozen too, so the phased assessment calendar is on hold rather than cancelled in law. A CMMC Reform Task Force must report within 60 days, and the public RFI window closes August 14, 2026. Officials have declined to rule out ending the program entirely.
Because nothing in the Code of Federal Regulations or the DFARS changed, this is a deadline event, not a legal reset. That is precisely why invoice-level review matters more than headline reading.
What Still Applies After the Suspension
The DoD CIO states plainly that all Phase I self-assessment requirements remain firmly in place, and frames the review around lowering barriers for small and midsize businesses, not lowering obligations.
Annual SPRS affirmations remain required. The underlying statutory and regulatory duties did not move when the phased rollout stopped.
DFARS 252.204-7021 and prime flowdowns remain enforceable (see above). NIST SP 800-171 implementation, system security plan accuracy, and POA&M maintenance remain required compliance work under the surviving obligations.
Self-attestation risk increased, not decreased. DOJ’s Civil Cyber-Fraud Initiative continues to target false cybersecurity certifications. A paused deadline is not a safe harbor.
Why Cancelling Compliance Spend Is the Wrong Move
Nothing in the record supports dropping NIST SP 800-171 work or letting SPRS records go stale, and treating the memo as permission to stop would misread it.
The math argues the opposite. More than 100,000 companies still need assessments against roughly 100 authorized C3PAOs, so queue position and readiness do not vanish just because a deadline did. DoD CIO estimates place future CMMC phases above $7 billion annually for small and midsize businesses, which is the strongest argument for auditing that spend rather than freezing it.
Wholesale cancellation also destroys evidence continuity. If a prime, auditor, or contracting officer asks questions in 2027, you will need the system security plan, POA&M history, and assessment artifacts you were funding.
The defensible move is deliberate re-scoping: keep what survives, pause what does not, and document the business decision behind both.
Before You Reopen Contracts: Gather the Paper Trail
Re-scoping begins with documentation, not negotiation. Before you approach a vendor, assemble the record.
Pull every MSP, MSSP, and IT vendor agreement: master contracts, statements of work, amendments, order forms, and the renewal or termination notice windows buried in each. If you inherited a fragmented stack, benchmark your MSP against contracted deliverables before assuming you know what you own.
Collect the security assessment deliverables you already paid for: system security plan, POA&M, system boundary diagrams, and prior self-assessment results. Reconcile invoices line by line to surface anything labeled CMMC readiness, Level 2 preparation, or C3PAO preparation. Those entries reveal what was bundled and what it cost.
Export SPRS submission records and affirmation dates. You need to know exactly what you attested to and when the next annual affirmation falls due.
Finally, note named contacts, escalation paths, and any prepaid or banked hours. A structured IT infrastructure assessment often exposes gaps here, where scope was assumed rather than documented.
With that record in hand, the contract audit can begin.
Step 1: Audit MSP and Vendor Contracts for Bundled Certification Work
With the paper trail in hand, map each agreement to the specific compliance deliverable it funds, separating assessment preparation from general managed services so bundled costs become visible. Flag contract language such as “CMMC certification support,” “assessment readiness,” or “Level 2 preparation,” since each assumes a mandate that is now paused.
Next, compare those obligations against DFARS 252.204-7021 and any prime flowdown clause. That comparison shows what your contract actually requires of you, rather than what the vendor assumed. This mapping is also the foundation of genuine vendor alignment, where every scope and contract term points toward one operational outcome.
Build a simple MSP contract example worksheet with five columns: scope, deliverable, owner, cost, and trigger. Listing every compliance line item this way makes renegotiation concrete instead of theoretical.
Close the audit by asking each vendor for written confirmation of which tasks remain tied to enforceable requirements and which are tied only to the suspended milestone.
Step 2: Separate Surviving Duties From Suspended Milestones
With the audit complete, sort every compliance line item into one of two columns. The surviving column holds Phase I self-assessment, annual SPRS affirmation, and NIST SP 800-171 implementation; these stay funded and scheduled because neither the duties nor enforcement attention moved. The suspended column holds C3PAO assessment scheduling and Level 2 certification, which become candidates for pause, deferral, or reallocation. Notify each vendor in writing and record the reasoning. A suspended C3PAO date is not license to let system security plan accuracy or POA&M evidence decay; that recordkeeping is the same discipline that makes an IT infrastructure modernization engagement pay off. Finally, share the map with whoever approves invoices. It is the single artifact that keeps spend visibly tied to an obligation.
Step 3: Re-Scope the Spend Around What Still Counts
Phase I self-assessments still apply. Move the money, not just the labels. Reallocate paused C3PAO budget toward system security plan accuracy, control evidence, POA&M upkeep, and a clean annual SPRS affirmation. Fund the NIST SP 800-171 controls that actually drive your self-assessment score, not certification theater with no deadline behind it. Pay for internal ownership and training too, so your team can defend its own attestation instead of forwarding the MSP’s answers.
Keep a modest readiness posture or retainer with your assessor or advisor; with roughly 100 authorized C3PAOs against more than 100,000 companies, capacity disappears fast if a deadline returns. Orloff Phillips can help structure that re-scoping for small and midsize defense suppliers in the mid-Atlantic region, where IT spend often sits in a single MSP relationship and every line item needs a named requirement behind it. Amend those agreements in writing next.
Step 4: Amend MSP Agreements With Specific Language
Once spend is re-scoped, lock it in writing. Use a signed amendment or change order, not a verbal understanding, so you are not still paying for suspended C3PAO deliverables.
Each amendment should state four things: the scope that stays (Phase I self-assessment, SPRS affirmation support, SSP and POA&M maintenance), the C3PAO work deferred, the effective date, and the condition that restores the obligation if DoD revives the mandate.
Then handle the money. Ask for credits, fee reductions, or banking of prepaid hours rather than forfeiture. Because the suspension rests on a memo that can be reversed quickly, build a restoration condition into the amendment.
Require deliverable-level reporting: completed control assessments, updated SSP sections, POA&M entries, each with dates and responsible owners. Status decks do not prove work.
Finally, set a review trigger tied to the Task Force report, the RFI outcome, or any new DFARS or Part 170 action, so the amendment ages well instead of quietly expiring.
Step 5: Document the Deliberate Business Decision
Once your amendments are signed, capture the reasoning behind them in a short internal memo. Record what remains enforceable (Phase I self-assessment, annual SPRS affirmation, DFARS 252.204-7021 flowdowns) and why each paused line item was paused, noting the July 13, 2026 suspension as the triggering event. Tie every retained expense to a named requirement so nothing stays funded by habit.
State explicitly that full abandonment was considered and rejected. Then list the conditions that would resume spending: a DFARS class deviation, a new rule, a Part 170 amendment, or a prime flowdown that reinstates a certification date.
File the memo with the contract documents. If a prime, auditor, or contracting officer asks why certification work stopped, the answer is dated and documented. Refresh it after the Task Force report and any new rulemaking so the rationale stays current.
Guardrails So a Pause Does Not Become a Compliance Gap
Once the memo is filed, lock in guardrails that keep the pause from becoming a gap.
- Verify status before acting, check whether a class deviation, final rule, or Task Force output has issued since the July 2026 memos.
- Keep SPRS records accurate. Annual affirmations remain due. Accuracy is the item most likely to draw scrutiny and the cheapest control to maintain.
- Treat prime flowdowns as live. Requirements stay binding until your prime modifies them in writing, regardless of what public guidance says.
- Reject both extremes. Wholesale cancellation and full funding of an unenforced mandate are equally indefensible.
- Calendar the decision dates. Revisit spend when the Task Force reports or any new DFARS or Part 170 action issues.
Next: reassess the contract, not the obligation.
Reassess the Contract, Not the Obligation
The next step moves from watching policy to editing contracts. Run the five-step review in order:
- Gather the paper trail.
- Audit bundled certification costs.
- Separate surviving duties from suspended milestones.
- Re-scope spend.
- Document the decision.
Get amendments in writing with credits or banked hours, deliverable-level reporting, and a review trigger tied to the Task Force report and RFI outcome. Keep a modest readiness posture so you can move within days if a deadline returns, and keep SPRS records accurate either way.
If you would rather have the review run with you, Orloff Phillips works with defense suppliers in the mid-Atlantic region to re-scope MSP spend around the obligations that still count.
Conclusion
The suspension is a deadline event, not a legal reset. Phase I self-assessment, SPRS accuracy, and NIST SP 800-171 work remain in force, and the steps above show how to right-size spend around them without abandoning compliance readiness. Ready to reassess your contracts with confidence? Contact Orloff Phillips to align MSP spend with the obligations that still count. Reassess the contract, not the obligation, and stay ready.
Leave a Reply