CMMC is (Not) Cancelled

### Executive summary: The Department of War has suspended the rollout of CMMC Phase II audit requirements and opened a 60-day review, but self-assessment requirements for CMMC Levels 1 and 2 and existing FAR/DFARS contract clauses remain in force; contractors should continue implementing and reporting NIST SP 800-171 controls. The report explains likely reasons for the delay (flow-down misapplications, CUI misclassification, widespread non-compliance, and limited auditor capacity), warns of False Claims Act risks for non-compliance, and notes an RFI with responses due by 12PM EST on August 14, 2026.