CMMC Phase 2 Suspension: What Florida Defense Contractors Should Do Now

On July 13, 2026, the Department of War (formerly the Department of Defense) suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. Phase 2 was originally scheduled to begin on November 10, 2026, and would have expanded third-party Level 2 certification requirements for applicable contracts.

The pause doesn’t lower the security bar. DFARS 252.204-7012 still requires applicable NIST SP 800-171 safeguards, Phase 1 self-assessments remain in effect, and contractors must continue meeting their applicable assessment, SPRS reporting, and annual affirmation obligations.

For defense suppliers on Florida’s Space Coast and across Central Florida, this is a window to close cybersecurity gaps—not a reason to stop preparing.

CMMC status as of October 13, 2026: The department’s 60-day CMMC Reform Task Force review deadline passed on September 11. As of this update, no new Phase 2 implementation date or public recommendations have been announced. Check the official Department of War CMMC page for the latest guidance.

What Does the CMMC Phase 2 Suspension Mean?

CMMC is a Department of War program designed to protect sensitive government information throughout the defense industrial base. It establishes cybersecurity requirements for contractors and subcontractors that handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

Phase 1 began on November 10, 2025, introducing initial self-assessment requirements. Phase 2 was intended to expand third-party Level 2 certification requirements beginning November 10, 2026.

The July suspension changed that implementation schedule, but it did not remove existing cybersecurity obligations.

The department also directed that Phase 2 and Phase 3 requirements—the later phase that would have expanded certification requirements further—be removed from affected existing contracts through contract modifications. Contractors should review any modifications to determine which requirements currently apply.

The practical takeaway: distinguish between the suspended implementation timeline and the cybersecurity requirements that remain in force.

What Still Applies During the Suspension?

Contractors should continue addressing these core obligations:

• DFARS 252.204-7012: Applicable safeguarding requirements based on NIST SP 800-171 Revision 2, including the requirement to report qualifying cyber incidents within 72 hours.
• Phase 1 assessments: Required Level 1 and Level 2 self-assessments remain in effect under the applicable program rules.
• SPRS reporting and annual affirmations: Maintain required assessment records in the Supplier Performance Risk System (SPRS) and complete annual affirmations through the designated official.
• Enforcement: The department has stated that it will enforce NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments.
• Third-party certification: CMMC Level 2 assessments by authorized CMMC Third-Party Assessment Organizations (C3PAOs) remain available.

Inaccurate SPRS scores or compliance affirmations can expose a contractor to contractual consequences and potential False Claims Act liability. Companies should ensure that their assessment results accurately reflect implemented controls and available evidence.

For official guidance, visit the Department of War CMMC program page. The Cyber AB’s July 15, 2026 statement on the Phase 2 suspension confirms that C3PAO Level 2 certification assessments and other CMMC program elements remained operational and available following the announcement.

5 Steps Florida Defense Contractors Should Take Now

1. Review Your CMMC and DFARS Requirements

Start with your current DoD contracts, subcontracts, and applicable cybersecurity clauses.

Identify which systems handle FCI or CUI and establish which CMMC level, assessment status, reporting requirements, and security safeguards apply to your organization.

Review DFARS 252.204-7012, relevant CMMC clauses, SPRS records, and any contract modifications associated with the suspension.

Do not assume that every contractor requires the same certification level. Your obligations depend on the applicable contract and the information your organization handles.

2. Conduct a CMMC Readiness Assessment

A CMMC readiness assessment identifies gaps between your current security controls and the requirements you need to meet.

For Level 2, evaluate the 110 security requirements in NIST SP 800-171 Revision 2. Review whether controls are implemented, operating effectively, and supported by appropriate evidence.

Prioritize:

• Access control and least-privilege permissions.
• Multi-factor authentication (MFA).
• Security monitoring and audit logging.
• Vulnerability management and patching.
• Incident response and reporting procedures.
• System and communications protection.
• Security policies and supporting documentation.

The assessment should produce a prioritized remediation plan with clear owners, target dates, and evidence requirements.

Need help identifying security gaps? Start with ProSource’s free security assessment to review your environment and identify areas that need attention.

3. Protect Controlled Unclassified Information

Understand where CUI is stored, who can access it, and how it moves between employees, systems, suppliers, and third-party providers.

Review permissions, remote access, endpoint security, file sharing, cloud services, and connections to external systems.

Practical safeguards include enforcing MFA, limiting access to authorized users, maintaining supported software, monitoring suspicious activity, and testing incident response and backup recovery procedures.

Security tools alone do not establish CMMC compliance. Your controls must work together to protect the information in scope and meet applicable requirements.

4. Maintain Accurate Documentation and SPRS Records

Your security controls should be supported by evidence that accurately reflects your environment.

Review your System Security Plan (SSP), assessment results, system inventories, access reviews, security policies, and incident response procedures. Document identified gaps and remediation activities in a Plan of Action and Milestones (POA&M) when permitted by the applicable requirements.

Ensure that required assessment results are recorded in SPRS and that annual affirmations are completed on time by the designated affirming official.

Accurate records help demonstrate your security posture and reduce the risk of making unsupported compliance representations.

5. Decide Whether to Pursue CMMC Level 2 Certification Now

The suspension raises a practical question: should your business continue preparing for a third-party Level 2 certification?

Continuing toward certification may make sense if:

• A prime contractor expects certification for your work.
• You are pursuing contracts that require a specific CMMC status.
• Your controls and documentation are ready for an independent assessment.
• Certification supports your business development strategy.

Prioritize readiness first if:

• Significant NIST SP 800-171 gaps remain.
• Your documentation or assessment records are incomplete.
• Your current contracts do not require third-party certification.
• You need to understand how the suspension affects your contract requirements.

In its July 15, 2026 statement, The Cyber AB confirmed that C3PAO Level 2 certification assessments remained available. A Level 2 certification can remain valuable for contractors working with primes, but businesses should make the decision based on their contractual obligations, readiness, and commercial goals—not the previous Phase 2 start date alone.

Why CMMC Compliance Matters for Florida Defense Contractors

Florida’s defense supply chain includes aerospace and defense manufacturers, engineering firms, simulation and training providers, and the subcontractors that support government programs.

The Space Coast: Melbourne, Palm Bay, and surrounding Brevard County communities have a strong aerospace and defense manufacturing presence. Suppliers supporting these programs may need to protect sensitive technical information and manage cybersecurity across design systems, production environments, and supplier relationships.

Orlando and Central Florida: The region has a significant simulation, training, engineering, and technology ecosystem connected to defense and aerospace. Smaller subcontractors may face particular challenges determining which systems handle CUI, documenting existing controls, and coordinating requirements across multiple suppliers.

ProSource serves businesses in Melbourne, Orlando, and Oviedo. Learn more about its Melbourne IT services, engineering IT services, and manufacturing IT services.

For these organizations, the suspension offers time to improve security and resolve compliance gaps—but it does not eliminate the need to protect government information.

How an IT Partner Can Help With CMMC Readiness

CMMC preparation requires coordinated technical controls, documentation, risk management, employee practices, and ongoing monitoring.

An experienced IT and cybersecurity partner can help your organization review its environment, strengthen endpoint and access controls, improve monitoring, organize documentation, and prioritize remediation.

ProSource provides managed IT, cybersecurity, and compliance services to help businesses manage technology risk.

Its Compliance as a Service offering supports organizations evaluating compliance requirements, while its cybersecurity services help strengthen security monitoring and risk management.

An IT partner can support technical implementation and readiness, but does not automatically establish CMMC compliance or replace a required independent assessment by a C3PAO.

Prepare for the Next CMMC Update

The CMMC Phase 2 suspension has changed the implementation timeline, but it has not removed the need for strong cybersecurity.

Florida defense contractors should use this period to review their requirements, protect CUI, maintain accurate compliance records, and close gaps in their NIST SP 800-171 controls.

Not sure where your organization stands? Schedule a free ProSource Security Assessment to identify potential security gaps and develop a practical plan for addressing them.

Compliance note: CMMC policies and contractual requirements can change. Verify current guidance through the official Department of War CMMC program and your contracting authority before making compliance decisions.