Cherry Bekaert is postponing our November 2, 2026, webinar, CMMC Reform: What the Task Force Review Means for Defense Contractors, because the Department of War (DoW), formerly the Department of Defense, CMMC Reform Task Force has not yet released its findings. In the meantime, here is where things stand and what you can do now.
1. CMMC Requirements Haven’t Gone Away
The July 13, 2026, DoW memo suspended the move to Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) Program. It did not suspend existing obligations.
DFARS 252.204-7012 still requires contractors that handle Controlled Unclassified Information (CUI) to implement the 110 security requirements in NIST SP 800-171 Rev. 2. The CMMC rule at 32 CFR Part 170 also remains in place, and any change to the program itself would require formal rulemaking.
The pause changes the timeline, not the obligation. Keep implementing, maintaining and documenting your NIST SP 800-171 program. NIST SP 800-171 Rev. 3 is on the horizon, but Rev. 2 remains the contractual baseline today.
2. Level 2 (Self) Is Not the Old SPRS Score
Phase 1 remains in effect. Level 1 (Self) and Level 2 (Self) requirements continue to appear in solicitations and contracts under DFARS 252.204-7021.
If your last submission was a DFARS 252.204-7019 Basic Assessment, expect more. Under 7019, you reported a summary score to the Supplier Performance Risk System (SPRS). A Level 2 (Self) assessment is a formal assessment. This means:
- Every Requirement Assessed: Each of the 110 requirements is marked Met, Not Met, or N/A against the NIST SP 800-171A assessment objectives, using adequate methods to assess requirements (interview, test and examine).
- Scored Under 32 CFR Part 170: Conditional status requires an assessment score that meets the 80% threshold established by CMMC, with additional restrictions on which security requirements can remain on a Plan of Action and Milestones (POA&M).
- Time-bound Remediation: Permitted plan of action and milestones (POA&M) items must be remediated within 180 days to achieve Final status, which is valid for three years.
- Executive Accountability: An Affirming Official must affirm compliance in the Supplier Performance Risk System (SPRS) and renew that affirmation annually.
- Defensible Evidence: Secure and retain assessment artifacts for six years, organized so they can be produced if your assessment is reviewed.
- Independence and Oversight: As a best practice, use the appropriate level of independence. The Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DCMA DIBCAC) may review your assessment.
Scrutiny is also arriving earlier. Contracting officers are increasingly asking for System Security Plans (SSPs) during proposal evaluations, so a weak SSP can cost you an award before any assessment takes place.
3. Help Is Available for Small and Mid-sized Contractors
A compliant NIST SP 800-171/CMMC Level 2 program takes sustained effort: scoping, documentation, technical configuration, evidence and ongoing monitoring. Many small and mid-sized businesses (SMBs) don’t have that expertise in-house, and a full-time security leader isn’t always in the budget.
Fractional support can close that gap. Cherry Bekaert’s virtual chief information security officer (vCISO), Compliance-as-a-Service, and CMMC program management services provide experienced guidance and ongoing program oversight as a cost-effective alternative to a full-time hire.
A note on independence: Cherry Bekaert is an authorized CMMC Third-Party Assessment Organization (C3PAO) and a Registered Practitioner Organization (RPO). Advisory services are subject to independence requirements; we do not provide both consulting and a CMMC certification assessment to the same organization.
What To Do Now
- Confirm your CUI scope. Identify where CUI enters, is stored, processed and transmitted, and who and what touches it.
- Update your SSP and keep it proposal-ready. Describe how each requirement is actually implemented in your environment.
- Perform a gap assessment against the NIST SP 800-171A assessment objectives and track remediation to closure.
- Conduct a mock Level 2 (Self) assessment using adequate methods to test and examine each requirement, and with the appropriate level of independence.
- Organize your evidence. Map artifacts to requirements now, so they’re ready for assessment and secure retention.
- Designate your Affirming Official: a senior leader who understands what the annual affirmation commits the company to.
- Review your contracts and flow-downs. Check for DFARS 252.204-7012, -7019, -7020, and -7021 clauses, and monitor what your primes require of you.
We’ll Reconvene When There’s Guidance
Cherry Bekaert will host the webinar once the Task Force’s findings or new DoW guidance are released, and registrants will be notified of the new date. If you have questions about your obligations or a Level 2 (Self) assessment, or would like to learn more about our CMMC services and cybersecurity services, contact our CMMC advisors today.
