07/15/2026
The CMMC Phase II suspension is not a compliance vacation.
Some third-party assessment pressure has been paused, but the responsibility to protect CUI has not. Self-assessments continue. DFARS 252.204-7012 still applies. Incident reporting requirements remain in force.
For small and midsize defense contractors, stopping now could create expensive gaps that are difficult to explain or rebuild later.
Our latest article breaks down what changed, what did not, and how contractors can use the pause to strengthen their CUI scope, SSP, POA&M, evidence, and incident response procedures.
Read the full analysis:
https://culpersec.com/blog/cmmc-phase-ii-suspension-smb-defense-contractors
The CMMC Phase II suspension pauses some third-party pressure, not CUI duties. Here is what SMB defense contractors should review and document.
