CMMC Phase 2 Is Paused. Here Are the Next Steps.

For defense contractors navigating Cybersecurity Maturity Model Certification (CMMC) preparation and requirements, a change in the implementation timeline can raise an immediate question: Should we keep preparing, or wait to see what happens next?

The CMMC Phase 2 implementation timeline may be paused, but the cybersecurity risks facing the defense industrial base have not paused with it. Neither has the need to address Controlled Unclassified Information (CUI) security or additional cybersecurity requirements that apply to your organization today.

For contractors, this period presents an opportunity to shift the focus away from preparing for a specific date and toward strengthening the cybersecurity foundation that will remain valuable regardless of how CMMC evolves. This includes evaluating CUI security holistically as well as System Security Plans.

Jared MacDonald, NSTXL’s Information Systems Security Manager, recently addressed this topic in a new on-demand webinar for NSTXL members. Here are several of the most important considerations for defense contractors.

1. Start With Your CUI Security

One of the most important questions a defense contractor can answer is also one of the most fundamental: What CUI does your organization have, and where does it reside?

Understanding how CUI enters, moves through, and leaves your environment is foundational to determining what needs to be protected.

This is a useful time to revisit those assumptions. Confirm what information your organization handles, where it is stored, which systems interact with it, and who has access to it.

The goal is not simply to have documentation that says CUI is protected. Your understanding of the environment should reflect how information actually moves through the organization today.

2. Validate Your CMMC Scope

Once you understand where your CUI resides, take another look at your assessment scope.

Organizations may have made scoping decisions while working toward a particular CMMC preparation milestone. With additional time available, contractors can revisit those decisions and determine whether their documented scope still accurately represents their environment.

Ask questions such as:

• Which systems, assets, users, and processes interact with CUI?
• Have any systems or workflows changed since the scope was originally established?
• Does the documented scope match the way the organization actually operates?
• Are there assets or dependencies that may have been overlooked?

Accurate scoping helps organizations understand where security requirements apply and where additional attention may be needed.

3. Make Sure Your Documentation and Environment Tell the Same Story

Documentation should not exist solely to prepare for an assessment.

Your System Security Plan (SSP), inventories, assessments, Supplier Performance Risk System (SPRS) information, and supporting evidence should accurately reflect your current environment. That makes this a good opportunity to review whether those materials remain current.

If a security control is documented as implemented, can your organization demonstrate how it is implemented? If an inventory lists specific systems or assets, does that inventory still reflect reality? If changes have been made to your environment, have those changes made their way into the appropriate documentation?

The objective is alignment between what your organization says it does, what the evidence demonstrates, and what actually happens in your environment.

4. Keep Addressing Known Cybersecurity Gaps

A delayed timeline does not make an identified vulnerability or cybersecurity weakness disappear.

If your organization has already identified deficiencies, there is still value in addressing them.

This does not mean contractors should continue spending without considering how CMMC preparation may change. It does mean organizations can distinguish between investments dependent on an uncertain future requirement and cybersecurity improvements that strengthen the business regardless of what happens next.

Updating an outdated inventory, improving evidence, correcting inaccurate documentation, strengthening an existing control, or addressing a known security weakness can provide value beyond preparing for an assessment.

5. Don’t Build Your Strategy Around Predictions

Uncertainty can make it tempting to predict what the next version of CMMC will require and adjust plans accordingly. That creates its own risk.

Until additional guidance is available, defense contractors can focus on questions they can answer today:

• Where is our CUI?
• What is in scope?
• Which security controls have we implemented?
• Where do we have known weaknesses?
• Can we demonstrate what we’re doing?
• Do our assessments, documentation, evidence, and actual environment align?

Answering those questions creates a stronger cybersecurity foundation without requiring an organization to predict where CMMC is headed.

A Practical Approach: Stay Informed, Stay Accurate, and Stay Secure

For defense contractors deciding what to prioritize during this period, NSTXL recommends focusing on three principles:

• Stay informed. Continue monitoring official guidance and evaluate new developments based on how they affect your organization’s specific circumstances.
• Stay accurate. Keep assessments, SSPs, inventories, SPRS information, and supporting evidence aligned with the environment you operate today.
• Stay secure. Continuously evaluate CUI security and address cybersecurity risks within your organization.

Ultimately, CMMC preparation should be about more than reaching an assessment date. Contractors that understand their CUI, know their scope, can demonstrate their security practices, and maintain accurate documentation are building capabilities that remain useful even as implementation requirements evolve.

As Jared summarizes in the webinar: The CMMC roadmap may be paused, but your cybersecurity program shouldn’t be.

Watch the Full Webinar

NSTXL members can access Jared MacDonald’s CMMC Phase 2 webinar on demand for a deeper discussion of the current landscape and practical steps organizations can take during the pause.

Watch the on-demand webinar here.

Need Additional CMMC Support?

For organizations looking to take the next step, NSTXL has partnered with Beskar and Penacity to provide members with access to additional CMMC compliance and assessment resources.

Beskar supports organizations preparing for CMMC Levels 1 and 2 with services including gap and readiness assessments, documentation and training development, mock C3PAO assessments, and secure environments designed for handling protected workloads.

Penacity, an authorized Certified Third-Party Assessment Organization (C3PAO), provides services spanning gap analysis and implementation through CMMC Level 1 attestation and full C3PAO Level 2 assessments. Penacity also offers an isolated environment designed to reduce the complexity of securely handling CUI.

Whether your organization is beginning its CMMC journey, working through identified gaps, or preparing for an eventual assessment, these partnerships provide additional options for accessing specialized support based on your organization’s needs.

Explore NSTXL’s CMMC partners here.