CMMC Without the Deadline: What Orlando Defense Contractors Still Have to Do

November 1st, 2026

November 10, 2026 was supposed to be the date CMMC Phase 2 made third-party Level 2 certification a condition of award for Department of War contracts that involve controlled unclassified information. That date is still on the calendar. The requirement behind it is not.

On July 13, 2026, the Department of War (DoW, formerly the Department of Defense) suspended Phase 2 and paused Phases 3 and 4 while a CMMC Reform Task Force reviews the program. A September 3, 2026 class deviation told contracting officers to strip third-party assessment requirements from solicitations and contracts. The task force's report was due to the DoW Chief Information Officer on September 11, 2026 and, as this was written, had not been made public.

For a small defense contractor in Orlando, the easy read is that the pressure is off. That read is wrong. The suspension removed the audit machinery, not the underlying security obligations. Contractors still sign affirmations, still report scores in SPRS, and still answer to the False Claims Act when those numbers are not true.

What actually changed in July

The July memo suspended the part of CMMC that required a C3PAO third-party assessment for Level 2 and a Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) assessment for Level 3. Active solicitations carrying those requirements are being amended to remove them, and existing contracts are being modified before the next option period or administrative modification. Until a contract is formally modified, its terms remain binding.

During the suspension, program offices may require Level 1 self-assessment or Level 2 self-assessment. They may not require the third-party certification that Phase 2 would have imposed. No waivers are being granted during the review, and DoW has said the standards themselves are not being relaxed.

What did not change

The obligations that existed before CMMC remain in force, and they are the ones a contractor actually gets sued over:

• FAR 52.204-21 requires basic safeguarding for Federal Contract Information (FCI).
• DFARS 252.204-7012 requires protection of Controlled Unclassified Information (CUI), implementation of the 110 security requirements in NIST SP 800-171 Revision 2, and incident reporting within 72 hours.
• DFARS 252.204-7020(d) requires the contractor to report the extent of its NIST SP 800-171 compliance in the Supplier Performance Risk System (SPRS).
• DFARS 252.204-7021 requires a current SPRS affirmation for award and for option exercise.
• Level 1 still requires an annual self-assessment and affirmation, and Level 1 does not allow POA&Ms.
• Level 2 self-assessment and SPRS reporting continue where the contract calls for them.
• Government-led DIBCAC audits of selected contractors continue.

The affirmation is the sharp edge. The senior official who signs it attests that the controls are implemented now and will stay implemented. An inaccurate self-assessment or a stale SPRS score can create False Claims Act exposure under 31 U.S.C. 3729. Suspending Phase 2 did not suspend that statute.

Why this lands hard on Orlando contractors

Central Florida's defense economy runs through primes with large local footprints, including Lockheed Martin, L3Harris, Northrop Grumman, and RTX, alongside the simulation and training cluster around Research Park, the Naval Air Warfare Center Training Systems Division, and PEO STRI. Most of the companies doing the work are not the primes. They are machine shops, software shops, integrators, and engineering firms with 10 to 200 employees, and they receive CUI through flow-down clauses.

A subcontractor that never bid directly to DoW can still hold CUI on a laptop, a file server, or a project SharePoint site. The prime's obligation flows down. When a prime is asked to prove its supply chain is handling CUI correctly, a subcontractor with an outdated SPRS score becomes the prime's problem, and primes solve problems by finding another subcontractor.

The suspension also changes what a customer will ask for. Instead of demanding a C3PAO certificate, primes and contracting officers are now asking for the System Security Plan, the SPRS score, the POA&M, and evidence that the annual affirmation is current. Those artifacts existed before July and are still the price of doing business.

The work that still has to happen

1. Draw the CUI boundary

You cannot protect what you have not located. Map where CUI enters the business, which systems store or process it, who can reach it, and where it leaves. That usually means reviewing contracts and flow-down clauses, interviewing program managers, and checking file shares and email for technical data, drawings, specifications, and government-marked documents. A clear boundary shrinks the scope of everything that follows.

2. Keep the System Security Plan current

The SSP documents how each of the 110 NIST SP 800-171 controls is implemented. An SSP written for a bid and never updated is a liability, because it describes a company that no longer exists. Review it after any major change: a new cloud service, a new office, a new acquisition, or a new line of business.

3. Treat the POA&M as a schedule

Where the contract permits a Plan of Action and Milestones, every open item needs an owner, a date, and a cost. A POA&M that has not moved in a year is evidence that the control is not being fixed. Close items in the order that reduces risk: multi-factor authentication, boundary protection, encryption, audit logging, and configuration management first.

4. Re-affirm only what is true

The annual affirmation is not a renewal form. If a control regressed, the score is wrong until it is fixed or the gap is disclosed. Before signing, walk the controls with whoever runs the environment and confirm the evidence exists. If the score has to drop, drop it. A lower honest score is survivable. A false high score is a False Claims Act case.

5. Push the standard down

Your own subcontractors and vendors inherit the same problem. Flow-down clauses should require the same CUI handling, the same incident reporting, and the same affirmation discipline. Ask for their SPRS score before you share a package. The prime will ask you for the same thing.

6. Keep incident response current

DFARS 252.204-7012 requires reporting a cyber incident within 72 hours. That clock starts when you discover the incident, not when the investigation ends. The contact list, the reporting portal access, and the person authorized to submit the report need to be documented and tested, because a 72-hour deadline is not the moment to discover that the only person with credentials left the company.

What to watch next

Three things could change the picture again. The task force report may recommend a narrower program, a revised assessment model, or cancellation. The June 23, 2026 FAR Council proposed rule would extend NIST SP 800-171-derived CUI safeguarding requirements to all federal contracts, not only DoW contracts, which would keep the controls relevant even if CMMC shrinks. And individual contracts can still impose Level 1 or Level 2 self-assessment terms during the pause.

None of those outcomes rewards a contractor that stopped working. The companies that kept their SSP, POA&M, and SPRS data current will be able to answer whatever assessment model replaces Phase 2. The companies that treated July as permission to stop will need a year to catch up.

Start with the assessment you already owe

SemTech IT Solutions works with Orlando defense contractors on the technical side of NIST SP 800-171 and CMMC readiness: scoping the CUI boundary, closing control gaps, documenting evidence, and preparing for the self-assessment and affirmation cycle. Our cybersecurity services cover the controls that show up in every assessment, and a cyber health check gives you a current picture of where you stand before a prime or a contracting officer asks. Companies that need ongoing oversight can pair the technical work with vCIO and IT strategy services to keep the roadmap and the compliance calendar aligned.