Issue link: https://iconnect007.uberflip.com/i/1546025
38 SMT007 MAGAZINE I AUGUST 2026 F E AT U R E A RT I C L E BY D I V YAS H PAT E L , M X 2 T EC H N O LO GY Since the recent announcement of the CMMC Phase 2 suspension, I have been closely following discussion in the Defense Industrial Base communi- ty, including vendors, customers, and cybersecurity specialists. We are all in a state of shock and confu- sion. In a memo to my clients, I shared some details for the decision. A common theme among those rea- sons is cost and capacity. We've learned that: • CMMC has prohibitive compliance costs, with individual bills approaching $600,000; SBA estimates above $7 billion annually across the base • There is a severe assessor shortage; roughly 100,000+ firms need assessments from only about 100 approved organizations • DoD stood up a 60-day CMMC Reform Task Force to recommend a lower-barrier replace- ment framework Even though the assessment timeline has changed, we advise staying the course. Basic cyber hygiene is good for all organizations, and the sus- pension does not change cybersecurity require- ments. Organizations that receive CUI or plan to, should continue to implement NIST 800-171r2. Self- assessments and SPRS score reporting are still re- quired and are not affected by the suspension. Guidance by Situation Depending on where you are in the process, the guidance may shift slightly. Here's what we're recommending. For companies pursuing certification on time Nothing you did is wasted. The controls you imple- mented to hit CMMC Level 2 are the same NIST 800-171 controls that remain contractually required today via DFARS and are self-attested. You're now ahead: Your System Security Plan, POA&Ms, and evidence are ready; your SPRS score is defen- sible; and if certification returns in some form, you'll re-enter near the front of the line. The one thing to pause on is spending: If you haven't yet paid for a C3PAO assessment, hold that check until the 60-day review clarifies what the future model looks like. Decoding the CMMC Suspension