The Certification Paused.
The Liability Did Not.

01   What has actually happened

Where this stands today, 11 September 2026. Third-party CMMC assessment is out of defense contracts. Self-assessment, NIST SP 800-171 and your SPRS score are all still in force. The operative instrument is DFARS Class Deviation 2026-O0025, Revision 3. Below is how it got there, because the sequence is what tells you how hard it would be to reverse.

13 July 2026. The Department of War Chief Information Officer issued a memorandum, Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements. This is the decision. Everything since has been the machinery of putting it into contracts.

16 July 2026. Class Deviation 2026-O0025, Revision 2 carried the CIO memo into contracting practice — the instrument that actually tells a contracting officer what to do.

3 September 2026. Revision 3 supersedes Revision 2 and is now the operative instrument. It does not change the CMMC instruction; it restates it and carries it forward while implementing several unrelated statutory items. If you are reading about a September CMMC change, this is what is being described — and the substance of it dates from July.

11 September 2026. The CMMC Reform Task Force’s final report is due to the Department of War CIO today. Whether any of it becomes public is at the CIO’s discretion.

02   What the deviation actually tells contracting officers to do

Four instructions, taken from the signed memorandum. They are worth reading literally, because the difference between them is where people are going wrong.

• Self-assessment stays. Requiring activities may still include CMMC Level 1 (Self) or Level 2 (Self) assessments in procurement requests and requirement documents. CMMC has not been removed from contracting — the third-party part of it has.
• NIST SP 800-171 Rev 2 is required. The memo names baseline compliance under DFARS 252.204-7012 explicitly. This is not softened anywhere in the document.
• New solicitations get amended. Program managers initiate the amendments; contracting officers issue them as soon as practicable.
• Existing contracts get modified. Where the requirements are already in a contract, the contracting officer must remove them by modification — before the next option is exercised, or at the next scheduled administrative modification.

The distinction that matters: third-party assessment is not prohibited and it is not illegal to pursue. It is being taken out of contract language. Nobody is going to require it of you, and a clause that used to demand it will disappear from your contract at the next modification. What you claim about yourself is unchanged, and so is who is on the hook for it.

03   What most people are taking from this, and why it is wrong

The reading going around small supplier networks is that CMMC is dead, or delayed long enough to stop worrying about. It is an understandable reading and it is a costly one.

What was suspended is the mechanism by which an outside party verifies your claim. Nothing was suspended about the claim itself, the standard behind it, or your contractual duty to meet it. If anything, removing the assessor concentrates risk rather than reducing it: the assessor was the step that would have caught an overstated score before it became a certification to the government.

04   What is still binding on you today

05   The case that should change how you think about your score

In the LOGZONE settlement, announced by the Department of Justice on 18 June 2026, an Alabama defense contractor posted a self-assessed 110 to SPRS in October 2021 — a perfect score. A DIBCAC assessment in February 2024 put the same environment at negative 170, on a scale that runs from −203 to 110. DoJ alleged the company knowingly submitted false claims for payment on two Navy contracts between May 2021 and March 2025 while failing to implement required NIST SP 800-171 controls. The settlement was $507,144, of which $253,572 was restitution, against roughly $682,000 in payments received under those contracts.

Two things are worth sitting with. The settlement is roughly three quarters of what the company was actually paid — not a rounding error against revenue, a multiple of the margin. And the gap between 110 and −170 is not fraud in the cartoon sense. It is what happens when somebody fills in a scoring worksheet without understanding that unimplemented controls carry negative weight, and nobody ever checks.

The Justice Department’s Civil Cyber-Fraud Initiative is now actively pursuing this category. With third-party assessment gone, the self-attestation is the only artifact in the file — and it is signed.

06   What to do in the next thirty days

• Pull your current SPRS score and find out who calculated it, and when. If the answer is “someone in IT, a few years ago,” that is the finding. Scores go stale as environments change.
• Re-run the scoring against the actual environment, with the negative weightings applied correctly. Most bad scores are arithmetic and scope errors, not dishonesty. They are equally actionable.
• Identify your affirming official by name and make sure they understand what they are signing. Under DFARS 252.204-7021 that is an individual attestation. Ask them whether they could defend the number.
• Keep going on the control work. The standard did not move. Any remediation you do now counts toward whatever the program looks like on the other side of the review.
• Do not repost a higher score to look better for a prime. That is precisely the act in the LOGZONE file.

07   What we are watching

• Whether the task force report, or any summary of it, is released publicly — and on what timeline.
• Whether the class deviation is extended, narrowed, or replaced with rulemaking.
• Whether primes keep requiring posted scores contractually even with the federal mechanism paused. Early signs are that they do; their own flow-down duty has not changed.
• Whether government-led DIBCAC assessment volume increases to fill the verification gap.