The month CMMC Level 2 was suspended and I kept the half I sign myself, at 69K MRR

That was the second paragraph of an email from a procurement manager at our prime contractor, and I read it four times before I understood that it was not a contradiction. We had crossed 69K MRR eleven days earlier. We are six people. We build data tooling, and fourteen months ago we took a subcontract on a defence programme because the work was interesting and the invoices were predictable. I had spent most of a quarter planning for a certification deadline in November 2026. That deadline had been suspended six weeks before this email arrived, I had cancelled the project and told the team we had our quarter back, and the email I was staring at was explaining, politely, that I had celebrated the wrong thing.

Quick answer (2026). This diary is a composite. I write these from several small software companies I have run or advised, with the revenue figures moved and identifying details blended, so no single client is identifiable. The mechanism underneath is not blended and every source is linked below. On 13 July 2026 the Department suspended the CMMC Phase II requirements that were due to bite on 10 November 2026. What was suspended is the part a third party performs on you. What survived is the part you perform on yourself and sign, along with the contract clause underneath it, whose own deadline had passed 3,116 days before the suspension was announced. The relief was real. It just removed the assessment I would have booked and left the one somebody else books.

The relief I thought I had been given

The announcement is short and it is not hiding anything. The Department of War CIO's CMMC page states that on 13 July 2026 it announced "the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which was originally scheduled for November 10, 2026". The press release the same day describes "initiating a 60-day study of the future of this program".

I read that on a Monday morning, forwarded it to my two senior engineers with a single line of commentary, and closed the project. We had budgeted for an assessment by a third party and roughly a quarter of one engineer. I moved the engineer onto a customer integration that had been waiting since March. For six weeks that felt like the best operational decision I had made all year.

The sentence in the same announcement

Here is what I had not read, in the same press release, four paragraphs down. "It is critical to note that this action does not eliminate the requirement for companies to protect federal data." And then, specifically: "All defense contractors and subcontractors remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012."

And above it, in the first paragraph, a sentence I had skimmed past because it sounded like boilerplate reassurance rather than a description of my obligations: "All Phase I self-assessment requirements remain firmly in place."

Nobody concealed anything from me. The Department named the surviving clause, in the announcement of the suspension, in a sentence beginning with the words it is critical to note. I had read the headline and stopped.

The deadline that was already 3,116 days old

So I went and read DFARS 252.204-7012, which I had never opened, because in my head the obligation was the certification and the certification was a 2026 problem.

The clause says: "The Contractor shall implement NIST SP 800-171, as soon as practical, but not later than December 31, 2017."

December 31, 2017. I had been running a project plan against 10 November 2026. The deadline that actually bound the contract I had signed was 3,236 days earlier than the one in my plan, and on the morning the suspension was announced it was 3,116 days in the past. I was not early for anything. I was eight and a half years late for a different thing, and the thing I had been early for was the one that got cancelled.

The clause also defines the reporting phrase it uses, and the definition "means within 72 hours of discovery of any cyber incident". That is the only clock in this whole story measured in hours, and it was the one nobody had ever mentioned to me.

The clause that carries its own instructions to spread

I had assumed this arrived because somebody at the prime negotiated it into our subcontract, which would mean somebody could negotiate it out. Paragraph (m) of the same clause tells the contractor to "Include this clause, including this paragraph (m), in subcontracts", and to do so "without alteration, except to identify the parties".

Including this paragraph (m). The clause requires its own propagation rule to travel with it, which is why it reached a six person company four tiers from the programme office in a form nobody along the chain was permitted to soften. The only edit anyone is allowed to make is writing in the names.

Who picks the timing now

This is the part I would go back and tell myself, and it is the reason I now think I read the suspension exactly backwards.

The press release says that during the interim period "the Department will enforce cybersecurity compliance with the NIST SP 800-171 Rev 2 standard through self-assessments and select government-led assessments".

Count what changed. Before the suspension I was heading toward an assessment by a third party: an event I would have paid for, scheduled, prepared for, and known the date of eighteen months in advance. After the suspension that event is gone. What remains is a self-assessment, which is a document I produce and stand behind, and a government-led assessment, which happens if and when somebody selects me.

I did not lose an auditor. I lost the auditor whose calendar I controlled, and kept the auditor whose calendar I do not. The relief removed the predictable check and left the unpredictable one, and for six weeks I filed that under good news.

The gate was never going to be the government

The other thing I had wrong was who would enforce any of this. I pictured an agency. It is my customer, and the mechanism is DFARS 252.204-7020, which says the contractor "shall not award a subcontract or other contractual instrument" of this kind "unless the subcontractor has completed, within the last 3 years" at least a basic assessment posted to the government's supplier system.

Shall not award. Not shall penalise, not may terminate. The prime is forbidden from giving me the next task order until the assessment exists, which is why the email was from a procurement manager rather than a lawyer and why it had a Friday in it. The companion provision at 252.204-7019, which I am citing in text rather than linking because 7020 already carries the operative point, puts the same three year window on the offeror side, describing a current assessment as one "not more than 3 years old unless a lesser time is specified in the solicitation".

That clause was not suspended. So on 13 July the regulatory gate opened and the commercial gate stayed exactly where it was, and the commercial gate is the one attached to my revenue.

What a number you sign yourself is worth

I want to be careful here, because this is the part where it would be easy to write something frightening and slightly false.

A self-assessment is a representation. The False Claims Act attaches to false representations made to get paid, and it prices them as "a civil penalty of not less than $5,000 and not more than $10,000, as adjusted by the Federal Civil Penalties Inflation Adjustment Act of 1990", plus, and this is the operative clause, "3 times the amount of damages which the Government sustains because of the act of that person".

Read the statute alone and it looks like a five thousand dollar problem. The statute tells you itself that it is not, in the words as adjusted, and the adjustment lives at 28 CFR 85.5. That table notes that "All figures set forth in this table are maximum penalties, unless otherwise indicated", and the False Claims Act row is one of the few that is otherwise indicated: it carries a minimum of 14,308 dollars and a maximum of 28,619 dollars per violation.

So the current published floor, 14,308 dollars, is 1.43 times the ceiling printed in the statute. Both ends have moved by a factor of about 2.86. I have now hit this shape three times in eighteen months of reading these things, and I have stopped quoting any statutory dollar amount until I have found the table that replaces it.

None of that is a prediction about me. It is the reason the half of the regime that survived is the half that deserves the attention, because a certificate is somebody else's assertion about you and a self-assessment is your own.

What I got wrong

I went looking for a rule. My first instinct was to find the suspension in the Federal Register, because that is where I have learned to go. It is not there. I searched published documents from June 2026 onward and found nothing on this programme. The action is an announcement plus two memoranda. If you only trust the rule text, you will conclude nothing happened, and you will be wrong in both directions at once.

I assumed relief meant fewer people could assess me. On one axis it is the opposite, as above. Fewer scheduled assessments, same number of possible ones, and less warning.

I assumed the exclusion of a certification meant the exclusion of a standard. The standard is NIST SP 800-171 and it is named in the surviving clause, the surviving self-assessment and the press release's own description of interim enforcement. The certification was a wrapper around it.

Limits

I could not retrieve the assessment methodology document that both clauses cite by URL, because a standard client fails the TLS handshake against that host. So there are no scoring figures anywhere in this piece, including the one you may have seen quoted elsewhere about how low a score can go. I have not verified how False Claims Act violations are counted in practice, so I have deliberately not multiplied that per violation range by a number of invoices. The 60 day study window closed on 11 September 2026; as of 20 September the Department's CMMC page still carries the suspension notice and I could find no published successor, which is a statement about what I could find. This is United States federal defence contracting and it is a diary, not legal advice.

What actually happened

We booked the assessment. It cost less than the certification would have, it took eleven days, and the number we posted was worse than I would have guessed and better than I feared. The engineer went back onto the integration afterwards. Nothing bad happened to us, which is not the same as nothing having been at risk.

The one thing I would tell you

When a regulator gives you relief, read the announcement for what it kept, not for what it cancelled. Mine named the surviving clause explicitly, in a sentence that began with the words it is critical to note, and I still managed to file the whole thing under good news for six weeks. The suspension was real and the saving was real. It just happened to remove the obligation that came with a date, an invoice and a stranger's calendar, and leave the one that comes with my signature.