CMMC Brief

Today: The Phase II suspension memo continues to ripple through the procurement landscape, with Crowell & Moring detailing how contractors should challenge solicitations that still carry C3PAO requirements, and GAO reminding agencies that past performance evaluation rules must be followed as written.

Policy & Rulemaking

CMMC Phase II Suspended, Reform Task Force Launched (Signed Memo, Memo 26-P-1023, July 13, 2026) DoW immediately suspended all CMMC Phase II milestones, including the November 10, 2026 C3PAO assessment phase-in, citing compliance costs and acquisition streamlining. The CIO is standing up a CMMC Reform Task Force with a 60-day review clock and a public RFI for industry feedback. A follow-up implementation memo directs contracting officers to amend active solicitations removing Level 2 C3PAO and Level 3 requirements "as soon as practicable" and to strip those requirements from existing contracts before the next option period or scheduled administrative modification. Phase I self-assessment obligations (Level 1 Self and Level 2 Self) remain in force. DFARS 252.204-7012 and NIST SP 800-171 Rev 2 compliance are unchanged. (Crowell analysis)

• Action: Continue maintaining your SSP and POA&M against NIST 800-171 Rev 2. Self-assessment scores in SPRS must stay current. Monitor the RFI for comment deadlines and submit feedback if your organization has a stake in how the program is restructured. Brief leadership that the C3PAO pathway is frozen but that self-attestation under the False Claims Act is now the enforcement lever.

Fixed-Price Contracting Mandate, CAS Rescission, PCB Supply Chain ANPRM The FAR Council issued guidance implementing the fixed-price contracting mandate under Executive Order 14402. Separately, the CAS Board finalized a rule rescinding four Cost Accounting Standards, and an advance notice of proposed rulemaking addresses printed circuit board supply chain requirements. (Crowell podcast)

• Action: The PCB ANPRM is worth watching if your products include electronics assemblies destined for DoW programs. The CAS rescission simplifies compliance for affected contractors. Review the fixed-price mandate guidance against your current contract mix.

Enforcement & False Claims

No new DOJ Civil Cyber-Fraud Initiative settlements or cyber-related FCA cases appeared in today's feed. The enforcement landscape remains as stated: with C3PAO assessments suspended, self-attestation accuracy is the exposure point. DOJ's Civil Cyber-Fraud Initiative has signaled it could expand scrutiny to false or inaccurate CMMC Phase I self-assessments. Any contractor whose SPRS score does not reflect actual implementation status carries qui tam and FCA risk right now.

• Action: Audit your SPRS score against your actual 800-171 implementation. If there are gaps between what you attested to and what you can demonstrate, document them in your POA&M and begin remediation before an enforcement action forces the question.

Contracting Impact

Solicitations Must Drop C3PAO Requirements; Contractors Should Protest If They Don't Crowell's follow-up analysis highlights that while agencies are directed to amend solicitations, the onus falls on contractors to monitor compliance. If a solicitation still contains Level 2 C3PAO or Level 3 requirements after the suspension memo, contractors should use the Q&A process and consider a pre-award bid protest. For procurements where proposals have already been submitted, contractors who were unable to comply with the now-suspended requirements may have grounds to argue they were improperly excluded, though the analysis differs depending on whether the procurement follows the pre-overhaul FAR or the FAR Overhaul (RFO 15.106). (Crowell)

• Action: Review every active solicitation your organization is tracking. If any still reference CMMC Level 2 C3PAO or Level 3 assessment requirements, flag them for your contracts team and counsel. Document the solicitation language and the suspension memo for a potential protest record.

GAO: Past Performance Cutoffs Must Follow Solicitation Language (B-424182.2, June 22, 2026) GAO sustained a protest against the VA for treating a three-year past performance window as a hard cutoff when the solicitation only said recent experience "may be viewed more favorably." The agency improperly excluded contracts with Exceptional and Very Good ratings. FAR 42.1503's three-year baseline does not override solicitation-specific recency language. (PilieroMazza, Crowell)

• Action: When responding to solicitations, include all relevant past performance references, not just those within three years. If you are excluded based on an arbitrary age cutoff that the solicitation did not establish, consult counsel about a protest.

NIST & Standards

No new NIST SP 800-171 or 800-172 revisions or CUI guidance published today. The operative standard remains NIST SP 800-171 Rev 2, which DoW explicitly confirmed as the self-assessment baseline during the Phase II suspension period.

Practitioner Pulse

The Crowell & Moring "Fastest 5 Minutes" podcast released a special edition covering the Phase II suspension, hosted by their cybersecurity and government contracts teams. Worth a listen for the legal nuances around the implementation memo's amendment directives and what "held in abeyance" means for contractors already mid-assessment. (Podcast)

The practical question on practitioners' minds: should you keep investing in C3PAO readiness? The suspension is real but temporary (60-day review clock). Contractors close to assessment-ready should maintain their posture, because (1) the underlying 800-171 obligation never went away, (2) primes can still contractually require third-party assessments regardless of DoW's program status, and (3) the FCA makes inaccurate self-attestation a financial liability today, not a hypothetical future risk.