CMMC Phase 2 Paused: What Still Applies to Small Machine Shops (October 2026)

CMMC is a verification program. Level 1 covers Federal Contract Information and is verified by an annual self-assessment. Level 2 covers Controlled Unclassified Information (CUI) and lines up with the 110 requirements in NIST SP 800-171, verified by self-assessment or by a third-party assessor (a C3PAO), depending on the contract. Phase 2 of the rollout was the stage that brought third-party Level 2 assessments into contracts, and that stage is what the July memo suspended.

The class deviation goes further for day-to-day contracting: contracting officers were told to remove or modify CMMC requirements, so new solicitations may arrive without a CMMC clause, and existing ones may be changed. 'Until further notice' means there's no end date. The task force review could bring the program back as it was, change it, or slow it down. One law firm summed up the pause as 'a big deal with little immediate impact,' and for most small shops that's accurate.

DFARS 252.204-7012. If the clause is in your contract or flowed down in a PO, you're still required to safeguard covered defense information by implementing NIST SP 800-171 Rev 2, to report cyber incidents to DoD, and — if a cloud service stores that information — to use one that meets the FedRAMP Moderate equivalency standard. None of that depended on CMMC.

SPRS scores. Where a contract calls for a Level 1 or Level 2 (Self) assessment, a self-assessment score posted in the Supplier Performance Risk System is still expected. If you handle CUI and aren't sure what your prime expects, ask them directly rather than assuming the pause covers it.

False Claims Act exposure. A score you post or a cybersecurity representation you make is a statement to the government. If it overstates what your shop actually does, the legal risk exists with or without a CMMC assessor in the picture. The pause removed an inspection, not the requirement to tell the truth about your controls.

DoD's own estimates for a small business, covering the assessment only: Level 2 with a C3PAO about $104,670 over three years, Level 2 self-assessment about $37,196 over three years, and Level 1 about $5,977 a year. Industry estimates of the total for a small shop reaching Level 2, remediation included, run $80,000–250,000 over three years.

The pause mostly defers the first number. The remediation behind the second number was already required by 7012 if you hold CUI. A shop that stops working on 800-171 because the assessor isn't coming is betting that the requirement will vanish, and nothing in the current memo says it will.

Start with an inventory. List which contracts and POs carry 7012, which drawings and models arrive marked CUI, and every place those files end up: email, a shared drive, the CAM workstation, the shop system, the backup drive, a USB stick at the machine. Most small shops find the list is longer than they expected.

Then shrink it. Every system that touches CUI is a system you have to secure and document, so fewer systems in scope means fewer controls to evidence. Keep your SPRS score honest and current, with a plan of action for the gaps. If you work with an MSP or a CMMC Registered Provider Organization, this is a good time to scope with them, while there's no deadline. MEP centers and APEX Accelerators also help small defense suppliers with cybersecurity. Check dodcio.defense.gov every month or so, because the task force's review could change the timeline quickly.

Your shop system usually holds the drawings, part numbers, routings, and travelers for controlled work, which puts it in scope. If it's a cloud product, 7012's FedRAMP equivalency rule applies to the vendor (see our guide on FedRAMP equivalency for job shops). If it runs on a box in your building, there's no outside cloud provider, but the box is in your own CUI scope and has to be secured like any other system.

Traveler's Shop Server is designed for the second path: the whole shop system on hardware you own, in your building, with CUI and technical data kept off third-party clouds. The Shop Server Defense edition, planned at $6,500 one-time, adds a hardened FIPS-mode configuration, an encrypted backup drive with customer-held keys, an 800-171 control mapping and SSP template excerpt, and support from US persons only. It's pre-launch, and no product makes a shop compliant on its own; the box is designed to support the controls your program already needs. Details and the free reservation form are at /shop-server, and /for/cmmc-machine-shops covers the defense-shop picture. New to the term? See /glossary/cui.