Good Morning. On Monday, the Pentagon suspended CMMC Phase II. The third-party cybersecurity certification that more than 100,000 defense suppliers were scheduled to need by November 10. Companies that spent years and real money preparing just watched the finish line get removed.
The requirements underneath it remain fully enforceable, and that gap is where the risk now lies.
Was this email forwarded to you? Sign up here
🎯 THE SIGNAL
DoD CIO Kirsten Davies signed a July 10 memo, announced Monday, suspending CMMC Phase II immediately and halting the subsequent implementation milestones. Phase II would have required certification by a third-party assessor before contract award for companies handling CUI, starting November 10.
Davies gave reporters the math. More than 100,000 DIB businesses still needed a third-party assessment, with roughly 100 assessors available to conduct them. "The math just simply doesn't add up," she said. SBA data put future-phase compliance costs at over $7 billion annually for small and mid-sized firms and reported that CMMC was pushing companies out of the industrial base entirely.
What replaces it, for now? A CMMC Reform Task Force reporting within 60 days. Roughly mid-September, and a public RFI on compliance burdens with comments due August 14.
Phase 1 self-assessments stay in force.
The suspension covers only one verification mechanism.
Still fully in force:
DFARS 252.204-7012
NIST SP 800-171 Rev. 2
SPRS score submissions
Cyber incident reporting
All contractually mandatory and enforceable. DOJ's Civil Cyber-Fraud Initiative did not pause, and a company that relaxes its actual controls because the audit went away is building its own False Claims Act case.
The suspension also extends the summer's pattern, this is the third time in three weeks the department has lowered a barrier to entry while keeping or expanding the accountability behind it.
Change | What It Means for You |
|---|---|
Phase II third-party certification suspended | Money budgeted for C3PAO assessments is unfrozen. Redirect it to actual controls, not to celebration. |
DFARS 7012, NIST 800-171, SPRS all still mandatory | Your self-attested score is now the enforcement surface. Attest accurately; the FCA risk did not go anywhere. |
Reform Task Force reports in ~60 days | The replacement framework is being written now. The RFI below is your one input window. |
Solicitations already carrying Phase II language | Expect amendments. If a pending proposal references C3PAO certification, ask your contracting officer what applies. |
The audit is suspended, but the standard is not. Treat them as the same thing, or the correction arrives as an enforcement action rather than a task force report.
One market note. Companies that certified early lost a competitive differentiator on Monday, and the C3PAO assessment industry's entire mandate went with it. If your capture strategy leaned on being CMMC-ready while competitors were not, that edge is now worth whatever the task force says in September.
💰MONEY MOVES
All four from Monday's contract announcements:
TOTE Services, a commercial ship operator, took $2.21B to serve as vessel construction manager for up to eight Medium Landing Ships, awarding and managing the shipyard subcontracts itself, with options to $2.6B. Funded by the reconciliation bill, and competitively procured with one offer received. The Navy just outsourced its shipbuilding customer role, and this VCM model is the template for the auxiliaries coming behind it.
TransCanada Turbines, MTU Maintenance, and TEI-Tusas split a $370M IDIQ for depot overhaul of the fleet's LM2500 gas turbines, with the work performed in Canada, Germany, and Turkey. Allied industrial base as overflow capacity, in writing, on one of the most common engines in the fleet.
Boston Consulting Group was awarded $19.9M from the FMS Trust Fund to redesign the Army's defense export process. One bid solicited, one received. Read beside the ITAR Part 130 rule in the tracker: the export machinery is being rebuilt from two directions at once.
Vanderbilt University took a $10.6M AFRL modification for its assured neuro-symbolic software prototype, tripling the contract's face value. Formal-methods AI assurance is quietly becoming its own funding line.
📡OPPORTUNITY RADAR
CMMC Reform RFI — DoD CIO
What they want: industry input on CMMC cost drivers, administrative burden, which NIST 800-171 controls actually reduce risk, and how commercial cybersecurity tools and managed services could count toward compliance rather than as separate assessments. Seven specific questions. The controls question is worth reading twice: it implies the department is considering requiring fewer than the full 110.
Who should care: every company in the DIB, and especially small and non-traditional firms, whom the task force has named as its priority. The 60-day review will write whatever replaces Phase II, and the RFI is the input channel.
Comment deadline: August 14, 2026, 12:00 PM ET. Noon, not midnight, same trap as the DARPA wave. Submissions are by email only, to the two addresses in the notice; there is no portal.
Massed Modular Aircraft (MMA) — DIU, CSO area of interest
What they want: a theater-range attritable UAS carrying at least 2,800 lbs of payload to a 2,300 nm combat radius, MOSA architecture, one-to-many operator control, full-scale prototype flying within 21 months. The solicitation names the missions the MQ-9A performs today as the target set.
Who should care: airframers and autonomy houses that can manufacture cheaply at rate. Open to US and international vendors under OT authority. IOC in FY2031 is defined as 20 deployable aircraft.
Response deadline: July 23, 2026, 11:59 PM ET.
Specular MIST Prize Challenge — DIU, Navy RCO, NIWC Pacific
What they want: USV payloads across three lanes: threat radar simulators, autonomous electronic attack, and passive electronic surveillance. Six-page white paper, unclassified for Phase 1.
Who should care: RF and EW houses. A $5M prize pool, $250K just for making the at-sea demo in Southern California this September, and the fine print asks for production pricing at 1 through 300 units, which means the Navy wants a production line, not a demo.
Phase 1 deadline: July 22, 2026, 11:59 PM ET.
Deadline watch, from the tracker: DARPA's SBIR topic-author window closes on July 22; FASt responses due on July 23; GSA's LLM clause comments due on August 3; ITAR Part 130 comments due on August 14; PCB rulemaking due on August 31.
Pro members: all of it, with our competitive notes → Hub
🧭PEOPLE & POSTURE
Kirsten Davies, the DoD CIO, just made the biggest compliance call of the year, and her framing points at where the task force will land: "tangible cyber hygiene rather than third-party certifications." The task force reports to her. If cybersecurity touches your product line, she is now a principal on your map.
DRPM-UxS director: still unnamed, day 17. The August 15 clock runs.
📊READER PULSE
Results from Tuesday. We asked how a fixed-price default changes your bidding. Five votes, same as last issue. Two of you are shifting toward performance-based fee structures; two are already mostly fixed-price and expect no change; and one is building risk premiums into the bid.
Nobody picked bidding less government work, and that makes three straight polls where the most drastic option got zero votes. Either this readership is unusually steady, or the worried do not tap polls. We will find out which as the sample grows.
This issue's question. One tap, anonymous, results Tuesday.
Had your company already spent money preparing for CMMC Phase II?
🔮PREDICTIONS
Record: 0-0. Three calls open: a DRPM-UxS director named by August 15 from outside the service acquisition corps, at least 20 of 24 CFO Act agencies posting Part 16 deviations by July 31, and NDAA conference slipping past Thanksgiving.
On the deviation call: the deadline was Wednesday, and our count of the deviation guide that day found 20 of 24 CFO Act agencies with Part 16 deviations posted. The four without. Energy, Interior, USAID, and SBA. Our counting method, on the record: a Part 16 deviation listed on the guide counts, and July 31 grading uses the same rule. The call sits at threshold with two weeks of straggler-watching left.
⭐TIP OF THE SPEAR PRO
DIU's Massed Modular Aircraft solicitation, above, is our June report walking around in the wild. Attritable Mass argued that the department would move MQ-9 missions onto cheap, expendable airframes; DIU just put that requirement out to bid with a deadline next week. The report's competitive-field chapter maps who is positioned to win it, company by company, and the supply chain chapter explains why the 21-month prototype clock is the hard part.
Pro members get the full report, the Intelligence Hub with all our tracked opportunities, and starting this Monday, the Huddle: a five-minute brief off the tracker before your week starts.
For everyone who spent on CMMC prep, what did Phase II readiness actually cost you, in dollars or in hours, before Monday's suspension?
Hit reply. Anonymity guaranteed. If we get enough answers, the aggregate becomes a number nobody else has.
Semper Fi,
-Justin