Paused, Then Silent: What the CMMC Limbo Is Doing to the Ecosystem Built to Support It
After the Department of War paused CMMC Phase 2 and froze later phases, an unpublished reform report and lack of a new timeline left contractors and the assessment and training ecosystem unable to plan. The episode examines layoffs, canceled assessments, sunk costs and the risk of rebuilding capacity later, alongside evidence that assessor capacity may have been adequate and examples of other federal program freezes; it closes with a call for DoW to publish its findings and a reminder that contractors’ cybersecurity obligations and False Claims Act exposure remain.
Chapter 1
The Pause, Then the Silence
Eric Marquette
November 10, 2026 was supposed to be the day a Level 2 assessment from a C3PAO became a condition of award on certain Defense contracts. On July 13, the Department of War suspended the move to Phase 2. Phases 3 and 4 froze with it. Today we look at what happens when a program stops, and then stops talking. I'm joined by Paul Netopski and Roz the Rulemaker.
Paul Netopski
Let me be precise about what was frozen. Only the third party verification. Phase 1 self assessments still apply, and DFARS 252.204 7012 still obligates contractors to safeguard covered defense information. The department cited annual costs above $7 billion for small and mid size businesses, and roughly 100 authorized C3PAOs for a base of more than 100,000 companies. A 60 day CMMC Reform Task Force was stood up, and its request for information drew more than 1,100 responses by August 14.
Eric Marquette
CIO Kirsten Davies tied the decision to Secretary Hegseth's directive to reduce compliance barriers for small and medium businesses. I want to say plainly that this is a sympathetic goal. The cost pressure on small contractors is real.
Paul Netopski
It is, and nobody should wave that away. My interpretation of this is that the cost problem and the uncertainty problem are two separate problems. We can debate the first. The second is the one hurting people right now.
Roz the Rulemaker
There's a procedural wrinkle that matters here. On September 3, a class deviation directed contracting officers to strip third party assessment requirements out of contracts. Washington Technology reported that this moved the pause from policy to an enforceable rule, and that reversing it is a more involved process. So this is not a memo someone rescinds by lunchtime.
Eric Marquette
Then the review window closed.
Paul Netopski
The Task Force report reached the CIO around September 11. Davies had said it would take about 15 more days after the review to write recommendations, that the outcome could range from an overhaul to small tweaks, and that the report would be made public. Cyber AB's CEO told contractors to expect recommendations in early October.
Roz the Rulemaker
And as of October 16, the report was unpublished with no new Phase 2 date. As of October 20, no formal announcement on findings or the program's future. The CIO's own CMMC page still lists implementation as paused in Phase 1. Worth noting, the earlier reporting said publication is up to Davies. So the silence is a choice someone can end.
Eric Marquette
A pause is a decision. Silence is a condition. You can plan around a decision, even one you dislike. You can't plan around silence.
Chapter 2
What the Limbo Is Costing
Paul Netopski
Here's what silence looks like in the field. One C3PAO reported about half its clients pausing assessments until DoD provides next steps. At TechNet Augusta in August, assessors described layoffs across the 100 plus assessment organizations and cancellations of scheduled assessments. Forbes reported assessors being laid off and prospective assessors backing away from the career.
Eric Marquette
That connects to our earlier episode on the assessment bottleneck. Pre pause data from June showed 1,964 CCPs and over 1,000 CCAs competing for roughly 200 to 279 active assessments a month. That was a throughput problem. This looks more like a collapse.
Paul Netopski
The training side is the same story. The near term need for CCP and CCA certified assessors has largely evaporated, and enrollment in assessor training has likely stalled. One training guide warns candidates not to treat November 10 as a guaranteed demand date. Some advisors tell clients to hold certification spending until the Task Force reports. Each of those choices is rational. Together they drain the ecosystem.
Roz the Rulemaker
And remember why these firms exist. C3PAOs, training providers, and individual assessors paid for accreditation, ISO 17020 readiness, staffing, curriculum, and ecosystem fees, because the government signaled demand was coming. Now the demand is frozen, there's no timeline, and the fixed costs keep arriving.
Eric Marquette
Let's give the counterpoint its due, though. Some argue there was never a capacity problem.
Paul Netopski
They have data. April 2026 figures showed enough CCAs and Lead CCAs to field about 255 assessment teams. Assessors at Augusta said they had never turned a contractor away for lack of assessors. Cyber AB says all program elements, including C3PAO Level 2 assessments, remain available. So if capacity was adequate, the pause did not relieve a bottleneck. It risks building one, because some of these firms may not survive, and the capacity could be thinner when requirements return. That last part is my inference, not a finding.
Roz the Rulemaker
The pattern has precedent. In 2021, the move from CMMC 1.0 to 2.0 suspended pilots and narrowed third party assessment, which meant much less work for C3PAOs. The accreditation body addressed refunds and deferred renewals. Rulemaking was expected to take 9 to 24 months and ultimately took years.
Roz the Rulemaker
In February 2025, the Federal Highway Administration suspended EV charging funding already allocated to states while hundreds of projects were in development. A federal court blocked the freeze in June. The Department of Labor Fiduciary Rule was vacated in 2018 after firms spent many millions preparing. In July 2023, Congress let chemical security authority lapse, planned inspections were canceled, and about 250 employees were reassigned. And ACA Navigator funding was cut 84 percent, then 90 percent, from $100 million to $10 million, after which several Missouri groups stopped participating.
Eric Marquette
The common thread, and this is an inference, is that stopping is quick and rebuilding is slow.
Paul Netopski
Which brings me to the ask. Department of War, publish the report, or at least an interim timeline and direction. And contractors, your obligations did not pause. NIST SP 800 171 is still enforced through self assessments and select government led assessments, and False Claims Act exposure remains. Logzone paid roughly $500,000 over a near perfect self assessment score that an audit found wildly inaccurate.
Roz the Rulemaker
Those who keep investing will be ready whenever the direction comes.
Eric Marquette
And if the ecosystem keeps shrinking while we wait, the contractors who stopped will meet fewer assessors, longer queues, and higher prices.