If you’re a San Diego defense contractor — a machine shop in Miramar, a software subcontractor in Sorrento Valley, an engineering firm feeding the big primes — the news from July probably caught your eye: the Department of Defense suspended the Phase II rollout of CMMC 2.0, the step that would have made third-party Level 2 certification assessments mandatory in contracts starting this November.
Some contractors read that as a pause button on everything CMMC. It isn’t. Here’s a plain-English breakdown of what actually changed, what stayed in force, and what your company should be doing this quarter to keep its DoD pipeline open.
What actually changed: Phase II suspended, not CMMC itself
On July 13, 2026, DoD announced an immediate suspension of the CMMC Phase II transition and stood up a 60-day CMMC Reform Task Force to review the program and reduce its cost and administrative burden. Phase II would have introduced mandatory Level 2 certification assessments by C3PAOs (CMMC Third-Party Assessment Organizations) for applicable contract awards beginning November 10, 2026. That milestone, along with later ones, is now suspended pending the review.
What did not change: the underlying obligation to protect Covered Defense Information. DFARS 252.204-7012 — the clause that has required safeguarding CUI and implementing NIST SP 800-171 security requirements for years — remains in your contracts. Phase I self-assessment requirements remain in effect, contractors must still post assessment scores in SPRS where required, and cybersecurity requirements are still being enforced through self-assessments and select government-led assessments.
In short: the verification requirement was suspended, not the security requirement. A contractor with weak controls and no SPRS score is in no better position today than it was in June.
The San Diego angle: don’t lose your subcontracting seat
San Diego’s defense economy runs on subcontractors. Primes like General Atomics, Northrop Grumman, and BAE Systems push flow-down CMMC requirements to every tier of their supply chains — and CMMC applies at all tiers, scaled to the sensitivity of the information you handle. If you handle FCI, you need Level 1 (the 15 basic safeguarding practices). If you handle CUI, you’re in Level 2 territory: all 110 security requirements of NIST SP 800-171, organized across 14 control families.
Prime contractors are still screening their subs. Many of them have not relaxed their own supplier requirements at all — the suspension applies to the government’s phased rollout dates, not to a prime’s right to demand proof of your cybersecurity posture before awarding a PO. Contractors that use this pause to let their programs drift will be the ones scrambling when the reform task force lands and the clock restarts. Preparing now, while there’s breathing room, is the cheaper path.
What to do this quarter: a practical CMMC readiness checklist
Whether you’re aiming for Level 1 self-assessment or Level 2 certification, these are the moves that matter right now:
1. Know your scope and your level. Inventory every system that processes, stores, or transmits FCI or CUI. CMMC applies to those systems — plus any systems that provide security protection for them or aren’t logically or physically isolated from them. Properly scoping CUI out of general-purpose systems (dedicated enclaves, segmented networks) can dramatically shrink your assessment footprint and cost.
2. Get your SPRS score right. If you hold CUI under a 7012 clause, you owe an accurate NIST 800-171 self-assessment score in the Supplier Performance Risk System. Contracting officers check SPRS before award and before option exercises. The scoring methodology gives a maximum of 110 points, with a passing posture generally recognized at 88 (80 percent) and 180 days to remediate toward full implementation on conditional assessments. A stale or inflated score is a liability — re-validate it.
3. Close the high-point gaps first. Under the Level 2 scoring model, individual security requirements are weighted at 1, 3, or 5 points depending on criticality. Five-point controls — things like multifactor authentication, FIPS-validated encryption, and incident response — dominate the score. A remediation plan (POA&M) that knocks out the weighted gaps first gets you to award-readiness fastest.
4. Document everything an assessor will ask for. Self-assessment or C3PAO, the evidence list is the same: system security plans, policies and procedures mapped to the 110 controls, configuration baselines, vulnerability scan results, incident response records, training logs. If a practice exists but isn’t documented, it doesn’t exist for assessment purposes. This is where most small and mid-size contractors stall — not on technology, but on paperwork.
5. Treat cloud and managed IT as part of the boundary. Your assessment scope includes every provider that touches CUI — including your IT provider. FedRAMP-authorized cloud services, properly configured, can inherit a large share of the 110 requirements and materially reduce your own implementation burden. Make sure your MSP can show you exactly how your enclave is segmented, monitored, and backed up.
Why preparation now beats preparation later
The reform task force’s stated goal is reducing cost and burden — not eliminating the program. The most likely outcome of the review is a simpler, cheaper path to the same underlying requirements, not the disappearance of NIST 800-171 obligations that predate CMMC by a decade.
Contractors that keep building their programs during the suspension get three advantages: they stay eligible for prime subcontracts that carry their own flow-down demands, they keep their SPRS scores current for option exercises and new solicitations, and they’ll face a shorter, cheaper path to certification when mandatory third-party assessments return. The companies that treat the suspension as a holiday will be paying rush premiums later — if their contracts survive the wait.
How FIT Solutions helps defense contractors get CMMC-ready
Getting to CMMC readiness is an IT project before it’s a paperwork project. FIT Solutions is a San Diego managed IT and cybersecurity provider with a Security Operations Center in California and 24/7 monitoring, and we support defense contractors through the technical side of CMMC 2.0 requirements: scoping CUI environments, implementing NIST 800-171 controls, building the documented evidence assessors expect, and maintaining the monitored, segmented infrastructure that makes ongoing compliance sustainable rather than a fire drill.
Talk to FIT Solutions about your CMMC readiness at (888) 339-5694.
