If you machine parts, build assemblies or ship anything that ends up in a defense program, November 10, 2026 was circled on your calendar. That was the day CMMC Phase 2 was supposed to start: outside auditors checking your cybersecurity before you could win certain contracts.
On July 13, 2026, the Department of War paused Phase 2 and started a review of the whole program. A lot of SE Wisconsin shops heard "paused" and stopped working on it.
That's the mistake. The audit date moved. The rules in your contracts did not.
What the pause changed
Phase 2 would have required many contractors that handle Controlled Unclassified Information (CUI) to pass a Level 2 assessment by an authorized third-party assessor (a C3PAO) as a condition of award. That requirement is on hold, along with later CMMC milestones, until the Department finishes its review.
Nobody has announced when Phase 2 comes back or what it will look like. Several law firms tracking the program expect it to return in some form. Plan for that.
What still applies to you today
Phase 1 self-assessments
Phase 1 started November 10, 2025 and was not paused. Solicitations can still require a Level 1 or Level 2 self-assessment and a current score posted in SPRS, the DoD's supplier risk system.
DFARS 252.204-7012
If your contracts carry this clause and you handle CUI, you already owe the 110 security controls in NIST SP 800-171, plus reporting a cyber incident to the DoD within 72 hours.
FAR 52.204-21
Even if you only handle basic contract information, this clause requires 15 basic safeguards: access control, passwords, patching, malware protection and physical security.
Your prime's requirements
Prime contractors can still require Level 2 certification from their suppliers through their own flow-down terms. The DoD pause doesn't stop your customer from asking.
Why waiting costs you
A Level 2 assessment checks 110 controls, and auditors want proof, not promises. Policies have to be written down. Multi-factor authentication has to be on. Logs have to be kept. Getting a typical 20-to-100-person shop there takes months, not weeks.
Your SPRS score is also a sworn statement. If it says you meet controls you don't, that's a False Claims Act problem, and the Justice Department has been bringing those cases.
When Phase 2 comes back, the shops that kept going will bid. The shops that stopped in July will be calling an assessor with everyone else.
What to do in the next 90 days
| Step | What it means | Who usually owns it |
|---|---|---|
| Find your CUI | List which contracts, drawings and files carry CUI markings, and where they live: email, file server, CAD workstations, a shared drive. | Owner + IT |
| Check your SPRS score | Make sure the score on file is current and matches what's actually in place. Fix it if it doesn't. | Owner + IT |
| Close the big gaps first | Multi-factor authentication, patching, backups, logging and who has admin rights. These carry the most weight in an assessment. | IT |
| Write it down | A System Security Plan (SSP) and a Plan of Action (POA&M) for anything still open. No document, no credit. | IT + compliance advisor |
| Ask your primes | Find out if your biggest customers plan to require Level 2 certification regardless of the federal timeline. | Owner / sales |
How IDN helps
IDN handles the IT side of the work. We find where your CUI actually lives, put multi-factor authentication, patching, backups and logging in place, and document what's done so your SSP reflects reality. We work alongside your compliance advisor or assessor. We don't replace them.
We're in Racine, and we've supported SE Wisconsin manufacturers since 2004. When something breaks on your floor, you get a response in 10 minutes, from people who already know your network.
- CLIENTS SERVED
- 1,000+
- RESPONSE SLA
- 10-MIN
- IN SE WISCONSIN
- SINCE 2004
CMMC questions from SE Wisconsin shops
- Is CMMC canceled?
- No. On July 13, 2026 the Department of War paused Phase 2, the third-party assessment requirement that was due November 10, 2026, and started a program review. Phase 1 self-assessments still apply, and so do the cybersecurity clauses already in your contracts.
- Do I still have to post a score in SPRS?
- If your contracts include the DFARS clauses that call for a NIST SP 800-171 assessment, yes. Phase 1 solicitations can also require a current self-assessment score. Keep it current and accurate, because it's a statement to the government.
- We only make parts to a print. Do we handle CUI?
- Often, yes. Technical drawings and specifications for defense programs are commonly marked as CUI. Check the markings on what your customers send you, and ask your prime if you're unsure.
- Can my customer require CMMC certification even though Phase 2 is paused?
- Yes. Prime contractors set their own supplier requirements and can flow down Level 2 certification regardless of the federal timeline.
- How long does it take to get ready for a Level 2 assessment?
- For most small and mid-size shops it takes months. Much of the time goes to writing policies and collecting proof, not buying tools. Starting now puts you ahead of the backlog when Phase 2 returns.
Find out where your shop stands
IDN's free IT assessment shows you where your CUI lives, which controls are already in place and which gaps to close first. You get a prioritized list, in plain language.