What actually changed on July 13th, what quietly stayed exactly the same, and why the “finally, we can relax” crowd is about to get a very expensive education.
July 13th. The Department of War, yes, that’s the name now, we’ll all get used to it eventually, drops the announcement. They’re suspending the third-party certification phase of CMMC. Phase 2, the one that was locked and loaded for November 10th, 2026. And they’re launching a 60-day review of the entire program.
Within about four minutes, my inbox and every group chat I’m in lit up like a slot machine.
“It’s dead.” “Told you not to waste money on that.” “We’re off the hook, boys.”
And look, I get it. This stuff has been a moving target for years. Every time you think you’ve got the rules pinned down, someone in an acquisition office reshuffles the deck. So when the government says “pause,” the natural human reaction is to exhale, close the laptop, and go pour a drink.
I’m here to gently, okay, maybe not that gently, take the drink out of your hand.
Because the gap between what the headline says and what actually happened is enormous. And the companies that read the headline instead of the fine print are going to spend the next year making a very predictable, very avoidable mistake.
Let me walk you through the whole thing. What got paused, what absolutely did not, and the one dynamic almost nobody is talking about that should genuinely reshape how you think about all of this.
First, What Actually Got Paused
I want to be fair here, because something real did change. This isn’t nothing.
The government pushed off the requirement to bring in an accredited third-party assessor, a C3PAO, in the alphabet soup, to formally certify your compliance before you can win certain contracts. That requirement was set to start phasing into contracts this November. It’s now parked while they run their review.
They also eased off the hard federal deadline. The “get certified by this date or you’re locked out” pressure that everyone’s been white-knuckling? That’s loosened. For the moment.
So if you were staring down the barrel of a November certification date and sweating whether you’d make it, yes, you got some breathing room. That’s genuine. I’m not going to pretend otherwise.
But here’s where I need you to pay attention, because this is where most people stop reading and draw exactly the wrong conclusion.
They paused the inspection. They did not cancel the standard. They moved the exam date. They did not cancel the class.
Everything you were supposed to be doing to protect sensitive information? Still on the table. Still expected. Still, in most cases, legally required. The only thing that changed is when, and by whom, you’ll get formally checked.
Now, What Did NOT Change (Grab a Coffee, This List Is Long)
This is the part that got buried under the celebration, so let me lay it out plainly, one piece at a time.
NIST 800-171 is still the standard. All of it. Not a single control got repealed on July 13th. The entire framework, all 110 controls in Rev 2, is exactly as required today as it was on July 12th. The government hit pause on verifying your compliance. They did not hit pause on requiring it. If you were behind on the controls last week, you’re still behind on them this week. The homework didn’t disappear just because the teacher pushed the test.
DFARS 252.204-7012 is still law. It’s in your contract right now. This is the one people love to forget. That clause, the one obligating you to safeguard covered defense information and report cyber incidents, is already baked into your existing contracts. It didn’t blink. It didn’t soften. It didn’t wait around for CMMC. If you’ve signed a DoD contract with that clause in it, you are contractually and legally on the hook, full stop.
Level 1 self-attestation is still expected. If your business touches Federal Contract Information, and a shocking number of companies do without fully realizing it, you still owe those 15 basic safeguarding requirements. And you still have to attest that you’ve met them. Self-assessment continues, uninterrupted, exactly as before.
All the Level 2 readiness work is still the work. Here’s the one that stings for the “we’ll wait” crowd. Everything required to get ready for a Level 2 assessment, scoping your environment, identifying where your sensitive data actually lives, writing your System Security Plan, documenting your gaps in a Plan of Action, and actually implementing all 110 controls, every bit of that is still necessary. The assessment got postponed. The months of grinding preparation that go into surviving that assessment did not.
And this is the big one: your SPRS score still sits under False Claims Act exposure. Let me slow way down here, because this is the part that should make you sit up straight.
When you self-attest and post a score to SPRS, you are making a representation to the federal government. That’s not a formality. That’s not a checkbox. That is a legal statement, and if it’s wrong, if you claimed a score you couldn’t actually back up, you’ve potentially exposed your company to False Claims Act liability. We’re talking treble damages and per-claim penalties. The Department of Justice has a Civil Cyber-Fraud Initiative built specifically to go after exactly this kind of misrepresentation, and they’ve already collected settlements from contractors who overstated their cybersecurity posture.
The pause changed none of that. If anything, it sharpened it. Think about what actually just happened. The third-party assessor, the outside expert who would have walked in, checked your work, and either validated or corrected your self-assessment, that safety net got pulled back. So now, more than ever, the score you post is on you. There’s no C3PAO standing between your optimistic self-evaluation and a federal auditor. Just you and your attestation.
The checkbox went away. The accountability came into sharper focus. Read that twice.
The Part Nobody’s Talking About: Your Primes Are the Real Deadline Now
Okay. Here’s the section I actually sat down to write. Everything above is the setup. This is the point.
Everyone’s been treating CMMC as a government mandate. A Washington thing. A “when does the DoD force my hand” thing. And so when the DoD eased off, people naturally assumed the pressure eased off with it.
That’s the fundamental misread. Because for a huge chunk of the defense supply chain, the government was never the real driver in the first place. Your prime contractors are.
Here’s how this actually works, in plain English. When a prime contractor signs a deal with the DoD, they take on obligations to protect sensitive information. And they cannot fulfill those obligations alone, not when they’ve got a supply chain of subcontractors, vendors, and partners all touching that same sensitive data. So the obligation flows downhill. It flows to you. That’s the whole concept of flow-down, and it’s written into the contracts that govern these relationships.
Now here’s the critical piece: the prime does not need the government’s permission to demand compliance from you. They don’t need to wait for CMMC Phase 2 to come back. They don’t care about the 60-day review. Their contractual exposure is right now, today, and they are going to protect themselves by pushing requirements straight down to their suppliers, regardless of whatever Washington decides about the certification calendar.
So what does that look like on the ground? It looks like NIST 800-171 language written directly into RFPs. It looks like CMMC-readiness clauses in purchase orders and supplier agreements. It looks like a prime’s supply-chain risk team sending you a questionnaire and asking, pointedly, what your SPRS score is and whether you can back it up.
And here’s the brutal, simple truth underneath all of it: a prime can drop you tomorrow. They don’t need a federal deadline to do it. If you can’t demonstrate you’re protecting their data, you’re a liability on their risk register, and liabilities get replaced with suppliers who took this seriously.
That relationship? That commercial reality? It did not get paused on July 13th. Not one bit. If anything, the pause makes primes more cautious, not less, because now they can’t point to a government certification to vouch for their suppliers. They have to satisfy themselves. Which means they’re going to lean harder on you, not softer.
The DoW just stepped back from being your deadline. Your primes stepped right into that spot. And they’re a far less patient boss.
What We Know vs. What We Don’t
I try to be straight with you in these, so let me draw the honest line between what’s solid and what’s still fog.
What we know for certain: The standards are live. NIST 800-171 didn’t move. DFARS 7012 is still in your contracts and still legally binding. Level 1 self-attestation is still expected. Your SPRS score still carries real legal weight. The prep work still takes months. And your primes are still going to demand compliance regardless of what the government does. All of that is rock solid.
What we honestly don’t know: We don’t know exactly what falls out of this 60-day review. We don’t know precisely when formal third-party assessments resume, could be a modest delay, could be longer. We don’t know whether the program gets restructured on the other side, and if so, how. Anyone telling you they know the final shape of CMMC right now is selling you something, and you should keep a hand on your wallet.
But here’s the thing about that uncertainty, it cuts the opposite direction from how people want to read it. “We don’t know when the inspection comes back” is not a reason to stop preparing. It’s the single best reason to be ready when it does. Because it will. And when it does, the readiness work will look exactly the same as it does today, except you’ll have less runway to do it in.
So What Do You Actually Do With This?
Let me make it dead simple, because I don’t want you walking away with a philosophy, I want you walking away with a to-do list.
Know your gaps. Do an honest, objective-level assessment of where you stand against 800-171. Not a vibe check. Not “our IT guy says we’re probably fine.” An actual, defensible evaluation of every control and every objective underneath it.
Close them. Work your Plan of Action. Knock down the gaps methodically. This is the part that takes months, which is exactly why starting now instead of later is the entire ballgame.
Prove it. Keep the evidence. Maintain it continuously, not as a mad scramble the week before someone asks. Your self-assessment should be defensible on demand, something you can stand behind in front of a prime’s risk team or, if it ever comes to it, a federal auditor. Not a hopeful guess you scribbled once and forgot about.
This, by the way, is exactly the problem we built CMMCSync to solve. Continuous readiness at the objective level, so when your prime asks or when the assessments come back, your score isn’t a nervous shrug, it’s a documented, defensible position. Because in a self-attestation world with the safety net pulled back, “I think we’re compliant” is a sentence that should keep you up at night.
The Bottom Line
The reprieve is on the paperwork ceremony. That’s it. It’s not on the security work. It’s not on your contract obligations. It’s not on your legal exposure. And it’s most definitely not on what your customers, your primes, expect from you next quarter.
The companies treating July 13th as a vacation are going to be the ones scrambling when the music starts again. And in the meantime, they’ll be quietly losing bids and losing accounts to the competitors who never stopped moving. Because those competitors will walk into a prime’s procurement conversation with a clean, defensible answer while the “we decided to wait” crowd fumbles for an excuse.
Waiting isn’t a savings. It’s a bet that the deadline never comes back and that none of your primes ever ask. That is a genuinely terrible bet, and you know it.
So don’t take it. Know your gaps. Close them. Prove it. Stay eligible to win the new business and keep the accounts you’ve already bled to earn.
And as always, stay safe out there.
Respectfully,
David Dean Mauro | NetGain Technologies | Cyber Crime Junkies Media | Author, Moving Target Crime Trilogy