CMMC Phase II Suspension: What it means for your business.

September 10, 2026

The suspension of CMMC Phase II has created a lot of discussion across the Defense Industrial Base, but the practical takeaway for contractors is simpler most people think.

What changed?

Phase II of the CMMC program was slated to take effect in November of this year. Phase II includes requirements on some contracts to achieve CMMC Level 2 certification via C3PAO audit. The Department of War announced an immediate suspension of Phase II requirements while it conducts a review of the program.

What did NOT change?

DFARS 252.204-7012 requirements remain in effect, and contractors are still expected to protect covered defense information. This mandates compliance with NIST SP 800-171 and restricts use of cloud service providers to those that meet the FedRAMP Moderate (Class C) baseline. During this period, the Department stated it will continue enforcing cybersecurity compliance through NIST SP 800-171 self-assessments and selected government-led assessments.

For businesses, this means:

You may not need a C3PAO assessment right now.
You still need a compliant NIST SP 800-171 environment.
You still need a System Security Plan (SSP), documented controls, and evidence that your security program is operating as intended.
You still need to use Cloud Service Providers that meet the FedRAMP Moderate (Class C) baseline.
Prime contractors and customers will likely continue evaluating cybersecurity maturity when selecting suppliers.

The biggest mistake organizations can make is viewing this suspension as a reason to pause cybersecurity efforts. Whether the future brings a revised CMMC program, a different certification approach, or a return to third-party assessments, the underlying requirement remains the same: Protect sensitive defense information and demonstrate that you're doing it.

Organizations that continue building strong NIST 800-171 programs today will be in a far better position regardless of how the regulatory landscape evolves.

First Column IT is a CMMC Registered Provider Organization (RPO) and we love helping our clients achieve their compliance goals! If your company needs help meeting your DFARS requirements or self-attesting to CMMC, we would love to help you!

January 24, 2023

The Right Collaboration Tech Makes for a More Efficient Business

There is so much about business that has changed over the last decade. What are the biggest gauges that we've seen is the inflation of cost affecting businesses and the need to scale back without affecting their workforce too dramatically. This has led to a culture of collaboration that has popped up over the last few years. Let's look at three ways that any business is (or should be) using collaboration nowadays.

January 23, 2023

Who is Handling These Critical IT Tasks In Your Organization?

Your business might have a full-time IT person, but it also might not have one, and in cases like this, you might find yourself waiting to call your go-to person until you are experiencing a full-blown problem. The reality is that your internal, non-IT staff should not be responsible for the job of your IT department, and if you are relying on someone externally to handle your technology help, then you’ll want to make sure they tick all of the following boxes.

January 21, 2023

The IoT is Intriguing, but is it Right for You?

The Internet of Things has been one of the most talked about technologies over the last decade. So much so, that many businesses want to do what they can to utilize this new technology for the betterment of their business. The Internet of Things, however, can have positive and negative effects on your business. In this month's newsletter, we'll take a look at the good and bad the IoT can provide for your business.

Welcome to the First Column IT Tech Blog