10/15/2026
New Hampshire and Massachusetts defense manufacturers: the CMMC pause doesn't mean you can stop.
In July, the Department of Defense suspended CMMC Phase 2, which required third-party (C3PAO) certification, and started a program review. In September, a DFARS class deviation confirmed that Level 1 and Level 2 can be met through self-assessment for now.
What has NOT changed:
DFARS 252.204-7012 is still in every applicable contract, including 72-hour cyber incident reporting.
NIST SP 800-171 is still the required security baseline.
A current SPRS score is still a condition of contract eligibility.
The smart move is to use this window. Remediation is usually the most expensive part of compliance, and it takes 6–18 months. The shops that keep working now will be ready when third-party assessments come back. The ones that wait will be scrambling.
KC Technologies helps manufacturers with NIST 800-171 gap assessments, SPRS scoring, SSP/POA&M documentation, and the network work behind them, including firewalls, segmentation, and shop-floor CNC/DNC isolation.
Questions about where you stand? Send us a message.