Defense Contractors

The RFI summary Federal News Network obtained puts the cost of CMMC in NIST SP 800-171 implementation and evidence assembly, and the task force's remedies are clearer CUI marking and machine-readable assessment evidence in OSCAL. Microsoft's one published availability table marks every Purview agent capability unavailable in GCC, and it publishes no per-capability table at all for GCC High or DoD.

The Phase 2 pause cut the schedule assessment firms were hiring and pricing against. Named assessors describe layoffs and cancellations, the accreditation body's own numbers show capacity still growing, and the one figure that moved the wrong way is the number of assessments in progress.

The first surveys since the CMMC Phase 2 pause show the compliance drift mostly did not happen. About 78% of contractors kept going; a roughly 22% minority slowed, and the pullback was in certification spend, not controls.

Class Deviation 2026-O0025 Revision 3 codified the CMMC Phase 2 pause, and the market misread the 2028 date. Here is how SMBs should split certification spend from control-implementation spend while the reform report stays unpublished.

Don't mistake a procedural pause in CMMC Phase 2 for a regulatory retreat. The compliance shadow is growing.

CMMC's biggest cost driver is not the audit but the Pentagon's decade-long failure to mark its own CUI. Two inspector general reports say the contractors are right.

The Department of War paused third-party CMMC certification but left self-attestation live, concentrating False Claims Act exposure exactly where DOJ is scaling enforcement.