Issue link: https://iconnect007.uberflip.com/i/1546025
32 SMT007 MAGAZINE I AUGUST 2026 remain fully in effect. DFARS 252.204-7012 and NIST SP 800-171 Rev. 2 controls are still enforce- able, and the Department of Justice has continued its Civil Cyber-Fraud enforcement activity, pursuing contractors who misrepresent their cybersecurity posture or submit inaccurate Supplier Performance Risk System (SPRS) scores. San Francisco Circuits completed its CMMC 2.0 Level 2 certification before the suspension was announced. That certification remains valid, and the security standards it reflects aren't contingent on what the mandate requires at any given moment. Omega EMS—Chris Alessio, CEO While the announcement changes the timing of formal CMMC Level 2 certification, it doesn't change our direction. Omega EMS remains fully committed to completing our cybersecurity roadmap and maintaining compliance with the underlying NIST SP 800-171 requirements (which have always been the technical foundation for CMMC). We made this investment because we believe it's the right long- term decision for our business and our customers, not simply because of a regulatory deadline. We'll continue executing our implementation plan and will pursue formal certification whenever the Depart- ment of War resumes the certification process. Our teams will continue executing against the mile- stones we've established. Externally, we'll commu- nicate the same message to customers: Omega EMS remains committed to achieving CMMC Level 2 certification and maintaining the highest stan- dards of cybersecurity regardless of changes to the government's implementation timeline. Customers are looking for trusted manufacturing partners, and that expectation hasn't changed. During the 60-day pause, very little changes operationally. We've already completed our Level 1 and Level 2 self-assessments and are actively closing all remaining gaps. The temporary pause simply provides additional flexibility in scheduling the formal third-party assessment. We'll use the additional time to further strengthen our cybersecu- rity posture and ensure we're fully prepared when formal assessments resume. We certainly appreciate any effort to streamline compliance requirements and eliminate unneces- sary administrative burden. If the government can simplify the certification process while maintaining strong security standards, that's a positive outcome for everyone. From Omega EMS's perspective, our investment in cybersecurity isn't changing. Whether the process becomes simpler or more efficient, our customers still expect secure systems, protected data, and a trusted manufacturing partner. Naprotek Naprotek is already certified under CMMC 2.0. As such, the suspension has no effect. Conclusion For contractors that were preparing for a third- party assessment ahead of the November 2026 deadline, the timing and cost of that assessment may now be worth reevaluating. But the work of implementing controls, maintaining documentation, and keeping SPRS scores accurate remains a live obligation. The companies that treat it that way will be better positioned, in whatever way the program is reshaped. SMT007