DoD's July 13 suspension of CMMC Phase 2 gave every defense contractor with an open Plan of Action and Milestones a convenient excuse to slow down. Some will take it. That is exactly why the ones who don't will come out ahead. NIST SP 800-171 compliance was never contingent on the third-party assessment DoD just paused, and the contractors who keep closing POA&M items during this review period will walk into whatever comes next already audit-ready, while their competitors are still explaining why they stopped.
The suspension created a genuine gap. DoD's CIO and Undersecretary for Acquisition and Sustainment established a CMMC Reform Task Force with 60 days to review the program, and the public Request for Information collecting industry input closes at noon Eastern on August 14, 2026. Realistically, that puts a published outcome somewhere in the September to October window, not next week. For a contractor with three or four open POA&M items and an RFP season on the horizon, that is roughly six to eight weeks of runway with no third-party audit deadline hanging over the work.
Six weeks does not sound like much until you count what most POA&M backlogs actually contain. A handful of access control gaps, an incident response plan that needs updating, a handful of unresolved configuration management items. Most contractors carrying an open POA&M are closer to done than they think, and a compressed deadline is usually what has been missing, not additional controls.
Nothing about the DFARS 252.204-7012 safeguarding and cyber incident reporting clause changed on July 13. Nothing about the 110 requirements in NIST SP 800-171 changed either. Self-assessment, SPRS score posting, and the annual affirmation of continuous compliance remain active obligations for every contractor handling Controlled Unclassified Information, regardless of whether a C3PAO ever reviews the file.
The scoring mechanics behind that self-assessment have not moved. Under the NIST SP 800-171 DoD Assessment Methodology, a contractor needs a score of at least 88 out of 110 to receive Conditional status, with any remaining Not Met items closed within 180 days to convert that Conditional status to Final. A contractor sitting below 88, or one carrying a Conditional score past its 180-day window, has a compliance gap that shows up in SPRS today, suspension or no suspension.
And the enforcement risk that actually reaches a courtroom was never part of the CMMC rule in the first place. The Department of Justice's Civil Cyber-Fraud Initiative pursues False Claims Act cases against contractors who misrepresent their cybersecurity posture in a certification, an SPRS entry, or a contract deliverable. That initiative was not mentioned in DoD's suspension announcement because it did not need to be. It operates independently of CMMC and remains fully active.
Two behaviors are emerging across the Defense Industrial Base right now, and they will separate winners from also-rans once the Reform Task Force publishes its findings. One group is treating the suspension as license to pause remediation work, reasoning that a third-party audit is no longer coming and self-assessment feels lower-stakes. That reasoning holds up only until the next SPRS review, the next prime contractor questionnaire, or the next proposal evaluation that scores cybersecurity maturity as part of a technical factor.
The other group is doing the opposite: closing every open item they can reach, documenting the evidence trail while the pressure is off, and treating the next few weeks as a dress rehearsal for whatever assessment mechanism eventually replaces or reinstates Phase 2. That second group is also the one positioned to win teaming decisions. Primes selecting subcontractors for CUI-touching work are not waiting for a task force recommendation to ask about SPRS scores. A clean, current, fully closed self-assessment is a competitive signal today, independent of what DoD decides about C3PAOs in September.
RFP season timing makes this more concrete. Contractors who close their POA&Ms now enter Q4 proposal season with a documented, defensible posture instead of a running list of open items they hope nobody asks about. Waiting for regulatory clarity before finishing remediation work solves nothing, since the underlying 110 requirements are not going to shrink no matter what the task force recommends.
The Reform Task Force will publish a recommendation eventually, and it will change something about how CMMC gets enforced. It will not change the 110 requirements in NIST SP 800-171, and it will not retroactively excuse a contractor that let its POA&M slide during the review window. Atlantic Digital's vCISO Services give contractors a dedicated resource to close remediation items on a fixed schedule instead of an open-ended one, and Atlantic Digital's CMMC Strategy Experts track how the eventual task force recommendation will change what a closed POA&M needs to demonstrate.
Contact us today to learn more.
If CMMC Phase 2 is suspended, why keep closing POA&Ms? Because the requirements of the POA&M addresses, the 110 controls in NIST SP 800-171 and the safeguarding obligations under DFARS 252.204-7012, were never part of the suspended Phase 2 third-party assessment. Self-assessment, SPRS reporting, and annual affirmation remain active regardless of the C3PAO pause.
What is the SPRS score threshold for POA&M closure? Under the NIST SP 800-171 DoD Assessment Methodology, a contractor needs a score of at least 88 out of 110 to receive Conditional status, with any remaining Not Met items closed within 180 days to reach Final status. A score below 88 or a Conditional status past its 180-day window represents an open compliance gap in SPRS.
Can the Department of Justice still pursue False Claims Act cases during the CMMC suspension? Yes. The DOJ's Civil Cyber-Fraud Initiative operates independently of the CMMC program and was not affected by the July 13 suspension. Contractors who misrepresent their cybersecurity posture in a certification or SPRS entry remain exposed to that enforcement track.
How long does the CMMC reform window realistically last? The CMMC Reform Task Force has 60 days from its formation to complete its review, with public RFI input due August 14, 2026. A published recommendation is realistic in the September to October timeframe, giving contractors a limited but usable window to close remediation work before any new requirement takes effect.
