CMMC Phase 2 Suspension: What Florida Defense Contractors Should Do Now

On July 13, 2026, the Department of War (formerly the Department of Defense) suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. Phase 2 was set to start on November 10, 2026. It would have required third-party Level 2 certification on more contracts.

The pause does not lower the security bar. DFARS 252.204-7012 still requires the NIST SP 800-171 safeguards that apply to you. Phase 1 self-assessments are still in effect. And you still need to keep up with your assessments, SPRS reporting, and annual affirmations.

For defense suppliers on Florida’s Space Coast and across Central Florida, this is a window to close cybersecurity gaps. It is not a reason to stop preparing.

CMMC status as of October 13, 2026: The department’s 60-day CMMC Reform Task Force review deadline passed on September 11. As of this update, no new Phase 2 implementation date or public recommendations have been announced. Check the official Department of War CMMC page for the latest guidance.

What Does the CMMC Phase 2 Suspension Mean?

CMMC is a Department of War program. It protects sensitive government information across the defense industrial base. It sets cybersecurity rules for contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

Phase 1 began on November 10, 2025, with the first self-assessment requirements. Phase 2 was meant to add third-party Level 2 certification starting November 10, 2026.

The July suspension changed that schedule. It did not remove the cybersecurity rules you already have to follow.

The department also directed that Phase 2 and Phase 3 requirements be removed from affected existing contracts through contract modifications. (Phase 3 was the later phase that would have expanded certification further.) On September 3, 2026, Class Deviation 2026-O0025 Rev 3 made this binding. Contracting officers must now accept Level 1 and Level 2 self-assessments. They must also remove third-party assessment requirements at the next option period or contract modification. Until your contract is modified, its current clauses still govern. Review any changes to your contracts to see which requirements apply now.

The practical takeaway: the timeline is on hold, but the security requirements are not.

What Still Applies During the Suspension?

Keep working on these core obligations:

• DFARS 252.204-7012: Safeguards based on NIST SP 800-171 Revision 2. This includes reporting qualifying cyber incidents within 72 hours.
• Phase 1 assessments: Required Level 1 and Level 2 self-assessments are still in effect under the program rules.
• SPRS reporting and annual affirmations: Keep required assessment records in the Supplier Performance Risk System (SPRS). Make sure the designated official completes each annual affirmation.
• Enforcement: The department has said it will enforce NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments.
• Third-party certification: Level 2 assessments by authorized CMMC Third-Party Assessment Organizations (C3PAOs) are still available.

Inaccurate SPRS scores or compliance affirmations can expose a contractor to contract risk and possible False Claims Act liability. Make sure your assessment results match the controls you have in place and the evidence you can show.

For official guidance, visit the Department of War CMMC program page. The Cyber AB’s July 15, 2026 statement on the Phase 2 suspension confirms that C3PAO Level 2 certification assessments and other CMMC program elements stayed open and available after the announcement.

5 Steps Florida Defense Contractors Should Take Now

1. Review Your CMMC and DFARS Requirements

Start with your current DoD contracts, subcontracts, and the cybersecurity clauses in them.

Find out which systems handle FCI or CUI. Then confirm which CMMC level, assessment status, reporting rules, and security safeguards apply to you.

Review DFARS 252.204-7012, the CMMC clauses in your contracts, your SPRS records, and any contract changes tied to the suspension.

Do not assume every contractor needs the same certification level. Your obligations depend on your contract and the information you handle.

2. Conduct a CMMC Readiness Assessment

A CMMC readiness assessment identifies gaps between your current security controls and the requirements you need to meet.

For Level 2, review the 110 security requirements in NIST SP 800-171 Revision 2. Check that each control is in place, works as intended, and is backed by evidence.

Focus first on:

• Access control and least-privilege permissions.
• Multi-factor authentication (MFA).
• Security monitoring and audit logging.
• Vulnerability management and patching.
• Incident response and reporting procedures.
• System and communications protection.
• Security policies and the records that support them.

The assessment should produce a remediation plan in priority order. Each item needs a clear owner, a target date, and the evidence required.

Need help finding security gaps? Start with ProSource’s free security assessment. We will review your environment and flag the areas that need attention.

3. Protect Controlled Unclassified Information

Understand where CUI is stored, who can access it, and how it moves between employees, systems, suppliers, and third-party providers.

Review permissions, remote access, endpoint security, file sharing, cloud services, and links to outside systems.

Practical safeguards start with MFA and access limited to authorized users. Keep software supported and watch for suspicious activity. Test your incident response and backup recovery steps.

Security tools alone do not establish CMMC compliance. Your controls must work together to protect the information in scope and meet applicable requirements.

4. Maintain Accurate Documentation and SPRS Records

Your security controls need evidence that matches your real environment.

Review your System Security Plan (SSP), assessment results, system inventories, access reviews, security policies, and incident response steps. Where the rules allow it, record known gaps and fixes in a Plan of Action and Milestones (POA&M).

Make sure required assessment results are in SPRS. The designated affirming official must complete annual affirmations on time.

Accurate records show your security posture. They also lower the risk of making compliance claims you cannot support.

5. Decide Whether to Pursue CMMC Level 2 Certification Now

The suspension raises a practical question: should your business keep preparing for a third-party Level 2 certification?

It may make sense to keep going if:

• A prime contractor expects certification for your work.
• You are pursuing contracts that require a specific CMMC status.
• Your controls and documentation are ready for an independent assessment.
• Certification fits your plans to win new work.

Prioritize readiness first if:

• Significant NIST SP 800-171 gaps remain.
• Your documents or assessment records are not complete.
• Your current contracts do not require third-party certification.
• You need to understand how the suspension affects your contract requirements.

In its July 15, 2026 statement, The Cyber AB confirmed that C3PAO Level 2 certification assessments were still available. A Level 2 certification can still be valuable if you work with primes. But base the decision on your contracts, your readiness, and your business goals. Do not base it on the old Phase 2 start date alone.

Why CMMC Compliance Matters for Florida Defense Contractors

Florida’s defense supply chain includes aerospace and defense manufacturers, engineering firms, and simulation and training providers. It also includes the subcontractors that support government programs.

The Space Coast: Melbourne, Palm Bay, and nearby Brevard County towns have a strong aerospace and defense manufacturing base. Suppliers to these programs may need to protect sensitive technical data. They may also need to manage cybersecurity across design systems, production floors, and supplier links.

Orlando and Central Florida: The region has a large simulation, training, engineering, and technology base tied to defense and aerospace. Smaller subcontractors may find it hard to pin down which systems handle CUI. Documenting existing controls and lining up requirements across many suppliers can be just as hard. See our cybersecurity services in Orlando for local support.

ProSource serves businesses in Melbourne, Orlando, and Oviedo. Learn more about its Melbourne IT services, engineering IT services, and manufacturing IT services.

For these businesses, the suspension buys time to improve security and close compliance gaps. It does not remove the need to protect government information.

How an IT Partner Can Help With CMMC Readiness

CMMC preparation takes technical controls, documentation, risk management, staff practices, and ongoing monitoring, all working together.

An experienced IT and cybersecurity partner can help you review your environment. That means stronger endpoint and access controls, better monitoring, organized records, and a clear order for fixes. ProSource’s security consulting team works with businesses preparing for CMMC and other compliance audits.

ProSource provides managed IT, cybersecurity, and compliance services to help businesses manage technology risk.

Its Compliance as a Service offering helps businesses work through their compliance requirements. Its cybersecurity services help strengthen security monitoring and risk management.

An IT partner can support the technical work and your readiness. But it does not make you CMMC compliant on its own. It also cannot replace a required independent assessment by a C3PAO.

Prepare for the Next CMMC Update

The CMMC Phase 2 suspension has changed the implementation timeline, but it has not removed the need for strong cybersecurity.

Florida defense contractors should use this time to review their requirements and protect CUI. They should also keep compliance records accurate and close gaps in their NIST SP 800-171 controls.

Not sure where your business stands? Schedule a free ProSource Security Assessment. We will help you find security gaps and build a practical plan to fix them.

Compliance note: CMMC policies and contract requirements can change. Check current guidance with the official Department of War CMMC program and your contracting authority before you make compliance decisions.