News & Events

Has CMMC been suspended, and do defense contractors still need to comply with NIST 800-171?

In this episode of CyberSound, Jason Pufahl and Mark Jennings explain what the DoD’s CMMC Phase 2 suspension actually means for defense contractors. They discuss why the November Level 2 third-party certification was paused, the 60-day program review behind it, what still applies under DFARS 252.204-7012, NIST SP 800-171, SPRS self-assessments, DIBCAC audits, and the False Claims Act, and why organizations should continue preparing for CMMC rather than putting compliance on hold. Whether you’re planning a C3PAO assessment or wondering if the pause changes your obligations, this episode explains what changed, what didn’t, and what comes next.