If your CMMC Level 2 assessment was scheduled — or you were budgeting for one — and the Department of War (DoW) suspension on July 13 put it on hold, you're in the most common position in the defense industrial base right now. The certification ceremony is paused. The homework is not. What's due today is the same thing that was due before CMMC existed: an honest NIST SP 800-171 self-assessment, posted to SPRS.
What Was Suspended — and What Wasn't
On July 13, 2026, the Department of War suspended CMMC Phase 2, including the November 10, 2026 milestone that would have required C3PAO certification in new solicitations. A reform task force is due to report its recommendations around mid-September. That's the whole suspension. Everything else stands:
| Requirement | Status | What it means for you |
|---|---|---|
| DFARS 252.204-7012 | In force | Safeguard CUI per NIST SP 800-171 and report cyber incidents within 72 hours |
| DFARS 252.204-7019 | In force | A current self-assessment score — no more than three years old — posted in SPRS |
| DFARS 252.204-7020 | In force | Give DoD access to verify, and flow the requirement down to your subs |
| Annual affirmation | In force | Your Affirming Official re-affirms your status in SPRS every year |
| DFARS 252.204-7021 (C3PAO certification) | Suspended | Cannot be required in new solicitations during the pause |
Put simply: the third-party check of your work is paused. The work itself — and your signed, posted claim that you did it — is still a condition of doing business with the DoD.
Why Accuracy Matters More Now, Not Less
Here's the part that surprises people. With certification paused, there is no assessor scheduled to catch an optimistic score. That doesn't make an optimistic score safer — it makes it more dangerous. An overstated SPRS score isn't an audit finding waiting to be corrected; it's a false statement to the government attached to every invoice you submit.
What "Doing the SPRS Self-Assessment" Actually Involves
If a prime or contracting officer has told you a score is due, here's the honest scope of the work:
- Define your boundary. Where does CUI live, who touches it, and on which systems? Scoping decides which of your systems the 110 controls apply to — and a tight boundary is the single biggest cost-saver in the whole process.
- Assess all 110 controls honestly. Each control is met, not met, or (in narrow cases) not applicable. Unmet controls subtract their DoD-assigned weight — 1, 3, or 5 points — from a starting score of 110. If you want the mechanics, we've written up the exact calculation method.
- Write the System Security Plan. The DoD Assessment Methodology assesses your implementation as described in your SSP. No SSP, no valid assessment — it's the document the score is anchored to.
- Put every unmet control on a POA&M. A Plan of Action & Milestones with realistic dates is the difference between "we have gaps and a plan" and "we have gaps."
- Post the score at sprs.apps.mil and keep the evidence — the SSP, the assessment record, the POA&M — where you can produce it on request.
Walk all 110 controls and get your score — free
CMMC Map's full self-assessment is free: every control in plain English, your live SPRS score as you work, and your gap list ranked by point value. No credit card, no trial clock. Pay $149/month only when you want the SSP, POA&M, and policies generated from your answers.
See where you stand →Don't Shelve the Level 2 Work
The task force reports in September, and the suspension is explicitly a pause, not a cancellation. Whatever shape CMMC takes after the review, one prediction is safe: it will still be built on NIST SP 800-171, and contractors with an accurate self-assessment, a real SSP, and a shrinking POA&M will be ready for it on short notice. Everything you do for the self-assessment transfers one-for-one.
The contractors who treat the pause as a holiday will be the ones scrambling when the music restarts. The ones who use it to get their score defensible — at self-assessment pace, without C3PAO deadline pressure — come out ahead either way.