CMMC’s Third-Party Assessments Are Paused. The Standard of Care Isn’t

The article explains the Department of War's July 13 suspension of CMMC Phase 2 third‑party assessments, emphasizing that while the certification requirement is paused the underlying DFARS/NIST 800‑171 security obligations remain intact; contractors must continue to self‑assess, maintain SPRS scores, and manage risk. The author discusses capacity and cost issues that drove the pause, warns that primes and DOJ enforcement still preserve strong incentives to be accurate in attestations, and urges organizations to focus on tangible cyber hygiene and preparedness rather than treating the pause as a repeal.