The third-party assessment requirement due Nov. 10 is on hold, but NIST SP 800-171 self-assessments, SPRS scores, and annual affirmations still apply
ASHBURN, Va., Nov. 10, 2026. Today was the day the Department of War’s Cybersecurity Maturity Model Certification (CMMC) program was due to enter Phase II, when third-party assessments would have become a standard condition of award for many contracts involving controlled unclassified information. That phase remains suspended. Shadowbear, a veteran-owned managed cybersecurity provider that serves as the outsourced security team for businesses without one, today published a checklist for Northern Virginia defense contractors on what the suspension did not change.
Kirsten Davies, the department’s chief information officer, suspended Phase II on July 13, 2026, and directed a CMMC Reform Task Force to review the program within 60 days. As of Nov. 9, the task force’s findings had not been published and no new start date had been set.
The suspension did not withdraw the CMMC rule or change the clauses already in most defense contracts. Phase I, in effect since Nov. 10, 2025, still requires Level 1 and Level 2 self-assessments where a contract calls for them, a score posted in the Supplier Performance Risk System (SPRS), and an annual affirmation by a senior company official. DFARS clause 252.204-7012 still requires contractors that handle covered defense information to implement the 110 security requirements of NIST SP 800-171 Revision 2 and to report cyber incidents to the department within 72 hours. Individual contracts can also set deadlines of their own.
Three steps for contractors
1. Confirm what your contracts require. Check each contract and subcontract for DFARS 252.204-7012, DFARS 252.204-7021, and any CMMC level, and note in writing any deadline each one sets for this year.
2. Make the SPRS score accurate and current. Score the company against all 110 NIST SP 800-171 requirements, update the system security plan and the plan of action and milestones, and post the result (scores run from -203 to 110) before the annual affirmation comes due.
3. Keep the evidence current all year. Keep the logs, scan results, training records, and policies that show how each requirement is met, so a self-assessment, a contract review, or a future third-party assessment draws on the same record. Compliance automation platforms such as Vanta collect and organize that evidence; the program itself stays with the contractor.
“The pause moved one deadline. It did not change the contract clauses most contractors have already signed,” said Ian Garrett, founder of Shadowbear. “A contractor that keeps its score honest and its evidence current has a good answer on every contract today, and it will be ready for whatever the task force recommends.”
Shadowbear’s Cyber Defense Suite covers many of the technical controls behind those requirements, including 24/7 managed detection and response, endpoint protection, security monitoring with one-year log retention, zero-trust network access, vulnerability scanning, and patching, and keeps the records that show they are in place. Shadowbear is SPECTRA Certified and was ranked No. 35 on the Washington Business Journal’s 2026 list of the Cybersecurity Companies in Greater Washington.
Contractors can book a Cyber Defense Consult at shadowbear.com/contact to review their environment, risks, and goals.
About Shadowbear
Shadowbear is a veteran-owned managed cybersecurity provider based in Ashburn, Virginia. Its Cyber Defense Suite gives businesses 24/7 managed detection and response, security monitoring, employee phishing training, and compliance support for frameworks including CMMC, NIST SP 800-171, SOC 2, and ISO 27001, with no internal security team required. Shadowbear is SPECTRA Level 1 certified and a Vanta partner. Learn more at shadowbear.com.
Media Contact
Ian Garrett, Founder
Shadowbear
571-680-6880
