The DoD suspended third-party C3PAO assessments. That does not mean CMMC went away. Your SPRS score, your SSP, your POA&M, and your False Claims Act liability are all still fully active. Here is exactly what changed and what you still must do.
The September 3, 2026 class deviation suspended CMMC Phase 2 third-party assessments. It did not suspend Phase 1 self-assessment requirements, SPRS submission, or False Claims Act liability. Every defense contractor with a DoD contract is still legally required to submit and maintain an accurate SPRS score.
The Department of Defense issued a class deviation on September 3, 2026 that suspended the requirement for CMMC Phase 2 third-party assessments by Certified Third-Party Assessor Organizations (C3PAOs). This was the formal certification process where an independent auditor would physically assess your cybersecurity posture before you could win certain DoD contracts.
That process — expensive, time-consuming, and complex — is on hold. But the confusion this created in the defense industrial base is dangerous. Many contractors read "CMMC suspended" and assumed their cybersecurity compliance obligations disappeared entirely. They did not.
| Requirement | Before Sept 3 | After Sept 3 |
|---|---|---|
| C3PAO Third-Party Assessment | Required for Phase 2 contracts | ⏸ Suspended |
| Phase 1 Self-Assessment (110 controls) | ✓ Required | ✓ Still Required |
| SPRS Score Submission | ✓ Required | ✓ Still Required |
| System Security Plan (SSP) | ✓ Required | ✓ Still Required |
| Plan of Action & Milestones (POA&M) | ✓ Required | ✓ Still Required |
| DFARS 252.204-7012 Compliance | ✓ Active | ✓ Still Active |
| False Claims Act Liability | ✓ Active | ✓ Still Active |
| Affirming Official Attestation | ✓ Required | ✓ Still Required |
This is the part most contractors miss. The DOJ Civil Cyber-Fraud Initiative — launched in 2021 — allows the government to pursue False Claims Act cases against defense contractors who knowingly submit inaccurate SPRS scores. Since 2021, the DOJ has collected over $2.6 billion in settlements under this initiative.
The False Claims Act carries treble damages — three times the value of any affected contract — plus civil monetary penalties per false claim and potential federal criminal prosecution of individual officers who signed the attestation.
An Affirming Official who signs an inaccurate SPRS attestation is personally attesting to its accuracy. If that attestation is knowingly false or recklessly inaccurate, they face personal civil and criminal liability — not just corporate liability. The suspension of Phase 2 assessments does not change this exposure.
The terminology did not help. "CMMC" has become shorthand for the entire DoD cybersecurity compliance framework — but CMMC technically refers to the certification program that includes C3PAO assessments. The underlying requirements — DFARS 252.204-7012, NIST SP 800-171, and SPRS submission — exist independently of CMMC and were never suspended.
Think of it this way: suspending the driving test does not mean you can ignore traffic laws. The rules of the road are still fully in effect. You are still liable if you cause an accident. The only thing that changed is you no longer need to pass a formal test before getting in the car.
If you are a prime contractor, you face an additional layer of responsibility. Under the DoD's flow-down requirements, you are responsible for ensuring your subcontractors also meet NIST SP 800-171 requirements. The suspension of C3PAO assessments does not eliminate your responsibility to verify your supply chain's cybersecurity posture before awarding subcontracts.
Primes who fail to adequately assess their subcontractors' cybersecurity compliance face potential contractual liability and False Claims Act exposure of their own.
Self-certification is now the permanent enforcement mechanism — not a temporary workaround. This means you control your compliance timeline and cost. You do not need to pay $50,000–$138,000 for a C3PAO assessment. A properly documented self-assessment with an accurate SPRS score is fully compliant with current DoD requirements.
A written document describing your information systems, the boundary of those systems, and the implementation status of all 110 NIST SP 800-171 controls. Required by control 3.12.4 — this is what an auditor or contracting officer would ask for first.
For every control that is not fully implemented, your POA&M documents the gap, your planned remediation approach, and your target completion date. Controls worth 5 points must be addressed within 90 days; lower-weight controls within 180 days. This document proves you are actively working toward full compliance.
A signed legal attestation from a senior company officer confirming that your SPRS score is accurate and that the SSP and POA&M are current. This is the document that creates personal legal liability — the Affirming Official must understand what they are signing.
ClearanceIQ guides you through all 110 NIST SP 800-171 controls, calculates your accurate SPRS score, and generates your complete submission package — SSP, POA&M, SPRS Worksheet, and Affirming Official Letter — ready to sign and submit.
Start Free Assessment → Start CERTIFY — Free to StartFree anonymous assessment · No login required · Documents from $999 · Three patents pending
The September 2026 class deviation removed one layer of compliance burden — the expensive C3PAO third-party assessment. It did not remove your legal obligation to assess your cybersecurity posture, document it accurately, and submit a truthful SPRS score to the government.
If you have not yet completed your NIST SP 800-171 self-assessment and submitted your SPRS score, you are currently out of compliance with DFARS 252.204-7012. That exposes your contracts, your company, and your Affirming Official to legal risk that the suspension of Phase 2 does nothing to reduce.
The good news: the path to compliance has never been clearer or more affordable. Self-certification is the law. Start with a free four-minute assessment at clearanceiq.io and know exactly where you stand.