On July 13, the US Department of War (DoW) suspended CMMC Level 2 third-party assessments pending a 60-day review. A lot of contractors read that as relief. I read it differently.

Let’s be clear on what was actually suspended, because the distinction is critical. The pause hit the assessment. It did not touch the requirement, nor did it touch enforcement.

DFARS 252.204-7012 still obligates you to implement NIST SP 800-171 and to report cyber incidents within 72 hours. DFARS 252.204-7019 and 7020 still require a current NIST SP 800-171 self-assessment score posted in SPRS, refreshed at least every three years, as a condition of award. Contracting officers still check SPRS. The Civil Division of the US Department of Justice (DoJ) is still running the Civil Cyber-Fraud Initiative it announced in October 2021. What went away is the third party who was going to corroborate your number.

The 110 controls have not moved since 2017

This is the part that gets lost around CMMC, especially with each pause. The substantive security requirement for CUI in the defense industrial base (DIB) has been the same 110 controls across 14 families since December 31, 2017. That was the compliance date set under DFARS 7012 for NIST SP 800-171. Rev 2 renumbered and clarified the standard and Rev 3 restructured it. The obligation itself has been sitting there for eight and a half years.

CMMC is not a new requirement. CMMC is a new verification mechanism the DoW bolted on after concluding that self-attestation alone was not producing implementation. Pausing the verification mechanism does not unwind the underlying control set any more than turning off a smoke detector makes a kitchen fire less likely. If you were non-conformant on July 12, you are non-conformant today. The only thing that changed is who was scheduled to notice.

Your exposure lives in the attestation, not the audit

Contractors talk about CMMC risk as audit risk: the C3PAO shows up, finds gaps, you fail, you lose the award. That is a commercial risk. It is limited and recoverable, as you can remediate and re-test.

False Claims Act exposure is different. It attaches to the actions you have already taken. When you posted a score to SPRS and then invoiced against a contract containing a DFARS 7012 clause, you made a representation of your security posture to the government. Per section 31 U.S.C. 3729, liability turns on “knowing,” which the statute defines to include actual knowledge, deliberate ignorance, and reckless disregard. Submitting a score without evidence to validate its accuracy is arguably reckless disregard.

The penalty is harsh: triple damages plus per-claim penalties. Perhaps scarier is that a whistleblower gets 15 to 30 percent.  Consider:

• Aerojet Rocketdyne settled with DoJ for $9 million in 2022. The relator, a former senior director of cybersecurity, took $2.61 million of it.
• LOGZONE, in June of this year, was fined $507,144 over its self-assessed SPRS score.

Neither case involved a failed C3PAO assessment. They involved a company’s own representation about its implementation of the required NIST SP 800-171 controls. 

I understand that the cost of a C3PAO assessment can be challenging for a small DIB supplier.  However, it’s a five-figure number, and FCA settlements are six- and seven-figure numbers before defense costs, before suspension and debarment referral, and before the reputational hit with your primes.

What else a C3PAO was buying you (beyond the certificate)

Set the CMMC Level 2 certificate aside for a second. The assessment produced something arguably more useful than a logo: a documented, independent record of what a qualified outside party observed about your environment on a specific date.

It’s a 3rd-party attestation. It is the difference between “our score is 105” (self-attestation) and “our score is 105, and here is evidence that a third party agrees with the score” (third party attestation).

Should the government knock on your door; a contractor who can produce independent validation is a contractor arguing about a good-faith disagreement over control interpretation. A contractor who cannot produce independent validation is a contractor arguing that they believed their own unverified number, and the only witness is the executive who attested to it.  The pause removed the C3PAO’s corroboration, i.e., your protection. It did not remove the statement you are responsible to uphold.

Two things worth doing in the next 60 days

1. Keep going. If you were mid-stream toward Level 2 certification with a C3PAO, the case for continuing is stronger now, not weaker. The review is 60 days. The legal/contractual requirement has not changed.  Programs that stopped and restarted during the 2021 CMMC 1.0 to 2.0 transition lost far more than 60 days of momentum, because SSPs go stale, POA&M owners move on, and evidence collection must start over. The controls you implement during the pause are controls that are implemented when the pause lifts, and they make your current SPRS score defensible in the meantime. The certification schedule moved. The security value did not.

• Consider getting independent validation anyway.  If you were not midstream, engage an appropriate qualified entity (e.g., a CMMC Registered Provider Organization (RPO)) to conduct an independent assessment against the 110 controls, document the evidence reviewed, and produce a written record of the basis for your score.

That record provides FCA protection because:

• It creates evidence of due diligence, dated, from someone other than you.
• Reckless disregard is a much harder charge for the government to prove against a contractor who commissioned an outside review, acted on the findings, and adjusted its score accordingly.
• It gives you a defensible methodology for the score rather than a spreadsheet nobody outside your IT team has looked at.
• It surfaces the gaps while you can still fix them and update SPRS, which is a materially better posture than surfacing them in response to a subpoena.

The bottom line

The DoW paused the CMMC audit program. It did not pause the obligation, and DoJ has given no indication that it is pausing anything. Prior to July 13, your NIST SP 800-171 compliance score was slated to be checked by a third party. Today it stands on one in-house signature. If you are comfortable with that, the pause is (temporary) relief. If you are not, make sure somebody independent can vouch for the number you already posted in SPRS.