Top story
The Cyber AB used its July town hall to draw a line between the program and the pause. CMMC.com's recap, published July 29, reports that "the CMMC program itself has not been paused. What's on hold are the Phase 2 contractual requirements." The same recap says recommendations from the Reform Task Force are expected around early October 2026. C3PAOs can still issue Level 2 certifications, and contracts can still require Level 1 (Self) or Level 2 (Self).
Rules and policy
- Law firms read the memo the same way. Latham & Watkins (July 30) notes that contracting officers must "amend active solicitations to explicitly remove those requirements and to modify existing contracts" that contain Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. Holland & Knight's July 31 alert describes two memos: one from the CIO and one from the acquisition and sustainment office implementing it. Why it matters: expect contract modifications, not just a change in future solicitations.
Industry and enforcement
- Practitioner programs are being rebuilt. At a July 30 forum for Registered Practitioner Organizations, the Cyber Engagement Forum (Cyber EF), "a wholly owned nonprofit subsidiary of The Cyber AB," laid out "a quarter-by-quarter plan to rebuild the CMMC practitioner program between now and mid-2027." It said "Training is being built to NIST SP 800-171 Rev 3." It also listed "A validation system for RPO services and products" for Q1 2027. Why it matters: consultant credentials are going to change. Ask any RPO you hire how it's preparing.
- SBA Advocacy held its RFI roundtable on July 30. The session was off the record.
Still on the radar
- The RFI closes at 12:00 p.m. ET on August 14.
- No DOJ cyber-fraud settlements were announced this week.
Watch list
- The task force's review timeline: 60 days from July 13.
- Contract modifications removing Level 2 (C3PAO) language.
What to do this week
- If you hold or are pursuing a Level 2 certification, keep going. The program continues, and a certification still counts with primes.
- Read the next modification to your contract before you sign it.
- If you're responding to the RFI, you have two weeks.
Sources
- July 2026 Cyber AB Town Hall Recap (CMMC.com, July 29, 2026)
- The Cyber EF Just Gave a CMMC Practitioner Program Update (CMMC.com, July 30, 2026)
- What Defense Contractors Should Know About DoD Suspension of CMMC Phase 2 (Latham & Watkins, July 30, 2026)
- DoW Suspends CMMC Phase II Requirements (Holland & Knight, July 31, 2026)
- Roundtable on DoW's RFI for the CMMC's Reform Task Force (SBA Office of Advocacy, July 23, 2026)
This briefing summarizes public sources for general awareness. It is not legal advice. Check the linked primary sources before acting on any item.