When the Department of War suspended the transition to CMMC Phase II on July 13, 2026, many defense contractors read it as permission to stop. That is a risky reading. The Phase II transition and its third-party assessment requirements were suspended. The obligation to protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) was not.
Rutter built the CMMC Readiness Hub for this moment. It is a single place to understand what still applies, what may change, and what technical work keeps its value as the program evolves.
Rutter built the CMMC Readiness Hub for this moment. It is a single place to understand what still applies, what may return,
Here is the status as of mid-October 2026:
In short, the suspension did not eliminate defense contractors' underlying cybersecurity obligations. Applicable solicitations and contracts can still require Level 1 or Level 2 self-assessments, while existing safeguarding, reporting, and flow-down requirements continue to apply.
A self-assessment still carries consequences. Contractors are responsible for accurately representing the cybersecurity controls they have implemented, and the government may conduct its own assessments.
In June 2026, the Justice Department announced a $507,144 False Claims Act settlement resolving allegations that a defense contractor failed to comply with required NIST SP 800-171 cybersecurity controls. A later government assessment produced a score of -170 after the contractor had previously reported a self-assessment score of 110. The settlement involved allegations, with no determination of liability, but it illustrates the risk of reporting a cybersecurity posture that the implemented environment does not support.
The current CMMC pause also does not eliminate the underlying cybersecurity requirements. The Department continues to enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments while it reviews the program.
Organizations can use this period to clarify scope, close technical gaps, improve evidence practices, and make sure reported assessment results accurately reflect how their environments operate.
CMMC readiness is rarely just a documentation problem. Organizations also need an IT environment that can demonstrate that required controls are operating as intended.
Common readiness gaps include:
These issues can affect an organization's security posture, self-assessment results, evidence quality, and ability to demonstrate that required controls are operating consistently.
The Hub is organized around common questions defense contractors and suppliers face. Start with the resource closest to where your organization is today.
Rutter is not a C3PAO and does not perform formal CMMC certification assessments. That distinction matters, and the Hub makes it clear.
Rutter's role focuses on the technical environment behind CMMC readiness. That can include helping organizations understand where FCI and CUI reside, hardening identity and access, bringing endpoints under management, improving logging and backup practices, prioritizing technical remediation, and establishing repeatable evidence practices.
Rutter can also support the environment over time through managed IT and security operations, helping organizations maintain the technical controls and operational practices they have put in place.
When a formal third-party assessment is required, that assessment must be performed by an authorized assessment organization. Rutter's role is to help organizations build, remediate, document, and operate the technical environment that will ultimately be evaluated.
Organizations do not need to wait for the next CMMC announcement to strengthen the underlying environment.
A practical starting checklist for the next 90 days:
The value of this work extends beyond any single CMMC implementation milestone. Better identity controls, managed endpoints, tested recovery, useful logging, accurate scoping, and repeatable evidence practices strengthen the environment regardless of how the program evolves.
If you know you need technical help, request a CMMC-aware readiness assessment.
If your organization uses Microsoft technologies and you want to understand how Azure can support your readiness strategy, download the Azure CMMC Guide.
If you have a specific question about your environment, ask a Rutter expert.
Or begin at the CMMC Readiness Hub and follow the path that best fits your organization.
Requirements depend on your solicitations, contracts, flow-down clauses, information types, and other applicable obligations. Consult appropriate contractual, legal, and compliance advisors when interpreting requirements specific to your organization.