Nearly four months after the Department of War paused CMMC Phase 2, the program is still waiting on a decision, but a good deal has happened around it. Here is a short status check for small and mid-size defense suppliers, current to 1 November 2026.
CMMC: options on paper, no decision yet
Phase 2, which would have required C3PAO certification in solicitations from 10 November 2026, remains suspended under the 13 July memo, and DFARS Class Deviation 2026-O0025 (Revision 3, 3 September) limits new solicitations to Level 1 (Self) or Level 2 (Self). The CMMC Reform Task Force's recommendations have not been published.
On 27 October Federal News Network reported on a task force summary of the industry responses to DoW's July request for information. The options it describes include restarting Phase 2 within 90 days for a narrower set of contractors, extending POA&M eligibility to 270 days through rulemaking, implementing NIST SP 800-171 Revision 3, giving credit for comparable ISO 27001 controls, and publishing templates and free tools if funding allows. None has been approved, and DoW declined to comment.
At the Cyber AB's October town hall, its chief executive said he had heard secondhand that decisions could be announced in November. In September, DoW CIO Kirsten Davies described compliance as a point-in-time check and cybersecurity as an ongoing process, and said the department had heard from more than 1,100 respondents through its request for information and other outreach.
Brilliant at the Basics
On 1 October the DoW CIO launched Brilliant at the Basics for Cybersecurity Awareness Month. It builds on the IT Top 10 and OT Top 10 practices published in July and points suppliers to low-cost and no-cost support programs. It is a campaign, not a requirement. Our plain-language guide covers all 20 practices and where to start.
Enforcement did not pause
On 1 September the Justice Department announced that Honeywell Aerospace agreed to pay $2,042,518 to resolve False Claims Act allegations that one of its networks did not meet NIST SP 800-171 between April 2020 and December 2023. The claims are allegations only, with no determination of liability. The lesson for smaller suppliers is the same as before the pause: an SPRS score has to match what your environment can show.
The FAR CUI rule could reach beyond DoW
On 23 June the FAR Council re-proposed its rule for controlled unclassified information as part of the Revolutionary FAR Overhaul (FAR Case 2026-001). It would apply NIST SP 800-171 Revision 3 to contractors handling CUI across federal agencies, not just DoW, require incident reporting within 72 hours, and use a new standard form to identify the CUI in each contract. Comments closed on 23 July, and the FAR Council has said it expects to finalize the overhaul rules, including the CUI requirements, before the end of 2026.
The NDAA is still pending
The House passed its FY2027 NDAA (H.R. 8800) on 22 July. The Senate version (S. 4784) would create a grant program to help small businesses pay for CMMC Level 2 assessments, to be set up by 1 July 2027 if enacted. As of the Congressional Research Service's 1 September status update, no FY2027 NDAA had been enacted, so the grant program is not law.
What to do now
- Keep your SPRS score honest and your POA&M moving.
- Work the Brilliant at the Basics practices that cut real risk first: phishing-resistant MFA, inventory, known vulnerabilities and remote access.
- If you handle CUI, start a NIST SP 800-171 Revision 3 gap view; both the FAR rule and the task force options point that way.
- Ask your primes what they will require. Primes set supplier expectations of their own.
- Use the free programs DoW points to, such as Project Spectrum, NSA's Cybersecurity Collaboration Center and DC3's DCISE.
We track CMMC developments on our CMMC status tracker and update it when DoW publishes a change.
Not sure where to start?
Run the free First Article Check against the KEV catalog, or book a free consultation with VIS.
Run the Free CheckSources
- Department of War: Department of War suspends CMMC Phase II requirements (13 July 2026)
- Federal News Network: RFI offers path forward for DoD with CMMC (27 October 2026)
- CMMC.com: October 2026 Cyber AB town hall recap (28 October 2026)
- GovCIO Media: DOW CIO says there is 'work to do' on CMMC (9 September 2026)
- DoW CIO: Brilliant at the Basics
- U.S. Department of War: Department of War Champions 'Brilliant at the Basics' for Cybersecurity Awareness Month (October 2026)
- U.S. Department of Justice: Honeywell Aerospace agrees to pay over $2M to settle False Claims Act allegations (1 September 2026)
- Hunton Andrews Kurth: FAR Council releases updated CUI proposed rule as part of the Revolutionary FAR Overhaul
- Federal News Network: Senate NDAA proposes CMMC grant program (June 2026)
- Congressional Research Service: FY2027 NDAA, status of legislative activity
This article summarizes public information for general guidance. It is not legal advice or a compliance determination about any company. VIS provides readiness and internal-audit support, not certification or third-party attestation, and is not a C3PAO. CISA, the KEV catalog and the DoW CIO's Brilliant at the Basics campaign are referenced for context and do not endorse VIS.