In July the Pentagon paused the third-party half of CMMC. In September it put that pause into binding acquisition guidance. In the same month the Justice Department collected $2 million from a defense manufacturer over controls it said were in place and were not. Both of those things are true at once, and the second one is the one that costs money.
The pause is now contract guidance
In the first week of September 2026 the Pentagon issued Revision 3 of class deviation 2026-O0025. It carries the July 13 suspension into the rules contracting officers actually follow. New solicitations may ask for Level 1 or Level 2 self-assessments only. Third-party Level 2 certification and Level 3 government assessments are off the table for now, and contracting officers are told to remove or revise CMMC requirements in existing contracts as those contracts are modified.
What the deviation does not touch: DFARS 252.204-7012 and the 110 controls of NIST SP 800-171 Revision 2 stay in force. So do your SPRS score and your annual affirmation. The third-party check went away. The obligation did not.
The reform report is still not public
The review drew more than 1,100 industry responses, over 10,000 pages, and the Pentagon's chief information officer has said people, not software, are reading them. In September she described a shift away from point-in-time compliance toward continuous security, with more attention on factory-floor operational technology. On how the government will verify compliance, she said that is still something the department needs to resolve.
As of this brief the task force recommendations have not been published. At its September 29 town hall, the CMMC accreditation body said announced changes are now more likely at the end of October than the start. Treat any specific prediction you hear before then as a guess.
The enforcement case of the quarter
In early September a large aerospace manufacturer agreed to pay $2,042,518 to resolve False Claims Act allegations that one of its networks did not meet NIST SP 800-171 controls required by a Defense contract, from April 2020 through December 2023. The case began with a whistleblower, and the government joined it in August. The settlement is not an admission of liability. It is a price.
Put that next to the June case we covered in Brief 004, where a contractor reported a perfect score of 110 and a government assessment later found negative 170. The pattern has not changed. The risk is not the missing certificate. It is the number you signed.
Know your real number before you affirm it again. Our cyber read scores you against the 110 controls on the spot, before we ask your name. Ten minutes, free.
Meanwhile, on the quantum side
On September 21, 2026, FIPS 140-2 validated cryptographic modules moved to historical status. Existing systems can keep using them. New federal acquisitions should specify FIPS 140-3. And January 1, 2027 is still the date new national security system acquisitions must support the CNSA 2.0 post-quantum algorithms. If you build anything that touches those systems, your customer will ask.
What to do this quarter
- Rebuild your SPRS score from evidence, control by control, before your next affirmation. An unsupported score is the single largest exposure most small suppliers carry right now.
- Read every contract modification for the deviation language. Until a signed modification changes your terms, your current terms apply.
- Keep 7012 fully in place: incident reporting inside 72 hours, and cloud services that meet the FedRAMP Moderate equivalent standard.
- List the cryptographic modules your systems rely on and which shop-floor systems touch controlled information. Both lists are where the next round of requirements is pointed.
- Watch for the task force report, expected late October at the earliest, and read it as a change in method, not a change in whether you owe the work.