Urgency Notice — 60-Day Window The Department of War has suspended CMMC Phase II requirements. Phase I self-assessment obligations remain in effect. Review what remains in force — Use this grace period to audit-proof your business before the DOJ audits you.
Department of War · CMMC Phase II suspension · 13 July 2026
The CMMC Audit Paused.
Your False Claims Act Liability Just Tripled.
The Department of War has suspended Phase II third-party audits to ease the burden on small businesses. But they did not suspend the rules. Under Phase I, you are still contractually required to self-assess and upload your compliance score to the government’s Supplier Performance Risk System (SPRS).
Guessing or “pencil-whipping” your SPRS score is a federal crime. The Department of Justice’s Civil Cyber-Fraud Initiative is actively prosecuting contractors who submit inaccurate self-attestations. A variance between your posted score and a Government-led assessment triggers False Claims Act liability, not a corrective action plan.
Use this 60-day grace period to audit-proof your business before the DOJ audits you. — Fixed-price engagement. Two-week delivery.
U.S. Department of Justice · 18 June 2026
A 280-point variance. A $507,144 settlement.
In October 2021 a Huntsville-based logistics contractor posted a Summary Level Score of 110 to the Supplier Performance Risk System. That figure represents full implementation of all 110 security requirements in NIST SP 800-171.
In 2024 the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center assessed the same environment and calculated a score of -170, against a methodology floor of -203.
On 18 June 2026 LOGZONE, Inc. agreed to pay $507,144 to resolve False Claims Act allegations arising from two Navy contracts. Restitution accounted for $253,572 of that total, exceeding one third of the contract value received. The settlement contains no admission of liability.
- No reported breach. The exposure arose from the reported score, not from a compromise of the environment.
- No relator. The variance was identified through a routine Government-led assessment rather than a whistleblower filing.
- Not a large prime. The contractor is representative of the small-business segment of the defense industrial base.
The suspension applies to third-party certification assessments. Government-led assessments continue under the Department’s interim enforcement approach. The mechanism that produced this matter remains active.
Scope of the 13 July 2026 memorandum
What was suspended, and what remains in effect
Suspended effective 13 July 2026
- CMMC Phase II third-party certification assessments, previously scheduled to begin appearing in contracts on 10 November 2026
- Pending and future CMMC implementation milestones across Department solicitations and contracts
The Department of War Chief Information Officer has established a CMMC Reform Task Force to conduct a comprehensive review and deliver findings within 60 days.
Remaining in effect
- CMMC Phase I Level 1 and Level 2 self-assessment requirements
- Summary Level Score reporting in SPRS and annual affirmation
- NIST SP 800-171 Rev 2, all 110 security requirements
- DFARS 252.204-7012 safeguarding and cyber incident reporting
- DFARS 252.204-7019 and 252.204-7020 score reporting and Government assessment access
- Government-led assessments, identified explicitly in the Department release
- Department of Justice Civil Cyber-Fraud Initiative and False Claims Act exposure
- Prime contractor flow-down requirements
No item on this list is contingent on the Task Force review.
Readiness indicators
Eight indicators that determine whether your Summary Level Score is supportable
No contact information is required to view results. These indicators correspond to the evidence an assessor requests during a Government-led assessment.
- Can you produce a current System Security Plan that reflects the environment as configured, rather than as planned?
- Is the CUI boundary defined and documented, including cloud service providers and external service providers?
- Does your Plan of Action and Milestones identify a responsible owner and a completion date for each unimplemented requirement?
- Was the Summary Level Score calculated using the NIST SP 800-171 DoD Assessment Methodology point values, requirement by requirement?
- Can you produce objective evidence for each of the 110 security requirements assessed as implemented?
- Has the score been reviewed by personnel independent of those who prepared it?
- Is the annual affirmation current in SPRS, with an Affirming Official of record?
- If DIBCAC conducted an assessment next month, would you expect the resulting score to fall within 20 points of your posted score?
How JLGOV protects you
Ironclad Readiness. Defensible Scores. Zero Bureaucracy.
As a Registered Candidate C3PAO, JLGOV takes the fear and guesswork out of CMMC and NIST SP 800-171 compliance. We help you use this audit pause strategically.
-
Rapid Gap Analysis
We identify exactly which of the 110 NIST SP 800-171 security controls your network is missing, assessed against the environment as configured rather than as intended.
-
Ironclad System Security Plan (SSP)
We draft the legally required System Security Plan that proves you are taking steps to secure Controlled Unclassified Information (CUI), describing the environment as operated.
-
Defensible SPRS Scoring
We calculate your precise, honest, and defensible SPRS compliance score under the NIST SP 800-171 DoD Assessment Methodology, with evidence mapped to each point value.
-
Safe Government Upload
We walk you through the process of uploading your verified posture to the SPRS database, giving you a legally backed compliance baseline.
Each finding is traceable to an artifact suitable for production to an assessor.
Questions from the defense industrial base
Frequently asked questions
No. The suspension applies to third-party certification assessments. Phase I self-assessment requirements, Summary Level Score reporting in SPRS, annual affirmation, NIST SP 800-171 Rev 2, and DFARS 252.204-7012 all remain in effect. The Department’s release states this directly.
The transition to Phase II requirements, previously scheduled to begin appearing in contracts on 10 November 2026, together with pending and future CMMC implementation milestones in Department solicitations and contracts.
The Department of War Chief Information Officer established a CMMC Reform Task Force to deliver findings within 60 days of 13 July 2026. Subsequent policy direction has not been announced. Any representation as to the outcome is speculative.
Yes. The Department’s release states that during the interim period it will enforce NIST SP 800-171 Rev 2 compliance through self-assessments and select Government-led assessments.
The False Claims Act attaches to representations made to the Government, and a posted Summary Level Score constitutes such a representation. In June 2026 a Navy contractor resolved False Claims Act allegations for $507,144 following a Government-led assessment that calculated a score 280 points below the contractor’s posted self-assessment. The matter involved no reported breach and no relator.
A score an independent reviewer can reconstruct from documented evidence. This requires a defined CUI boundary, a System Security Plan describing the environment as configured, a Plan of Action and Milestones with assigned owners and completion dates, and objective evidence mapped to each of the 110 security requirements.
That depends on whether the plan describes the environment currently in operation. The most frequently observed deficiency is a System Security Plan prepared during a proposal cycle and never reconciled against the production environment. That divergence is where a score ceases to be supportable.
In most cases, yes. The underlying security requirements are unchanged, and assessment capacity available during the interim period is unlikely to remain available if third-party requirements resume. Consult your C3PAO before suspending any in-progress activity.
Prime contractors establish subcontractor security requirements independently of Department policy, and many are maintaining existing requirements. Separately, obligations under DFARS 252.204-7012 run to the Government irrespective of prime contractor direction.
Not at present, and we will not represent otherwise. JLGOV holds Candidate C3PAO status, indicating that the organization has cleared Cyber AB screening and is in the pipeline for its own DIBCAC assessment. Candidate C3PAOs are permitted to provide readiness services. Candidate C3PAOs are not authorized to issue Certificates of CMMC Status. Separately, under 32 CFR 170.8(b)(17)(ii)(G), a firm that prepares an organization is barred from participating in that organization’s Level 2 certification assessment for three years. Provider status is verifiable at cyberab.org.
References. Department of War, “Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements,” 13 July 2026. U.S. Department of Justice, “Alabama Defense Contractor Agrees to Pay $507,144 to Resolve False Claims Act Liability Relating to Cybersecurity Violations,” 18 June 2026. 32 CFR Part 170. DFARS 252.204-7012, 252.204-7019, 252.204-7020. NIST SP 800-171 Rev 2. NIST SP 800-171 DoD Assessment Methodology.
This material is provided for general informational purposes regarding federal cybersecurity requirements. It does not constitute legal advice and does not establish an attorney-client or consultant-client relationship. Organizations should consult counsel regarding obligations under their specific contracts.
Confidential readiness review
Request an Immediate NIST 800-171 Gap Analysis & SPRS Score Review
Do not leave your business exposed to false claims liability. Submit your corporate email below to schedule a confidential readiness review with our CMMC specialists.
Engagement sequence
- Scope confirmation and fixed-price quotation within one business day
- Evidence request list issued prior to commencement
- Written findings delivered within two weeks
Intended for
Prime contractors and subcontractors holding or pursuing Department contracts subject to DFARS 252.204-7012, with a Summary Level Score posted or pending. Typically 10 to 250 personnel.
Engagement limitations
This engagement produces an accurate score supported by evidence. It does not produce an improved score in the absence of remediation, and no provider can represent otherwise.