The Department of War recently announced a pause in the implementation of CMMC Phase 2 certification audits, creating questions and uncertainty across the Defense Industrial Base. While the third-party certification process is being delayed, one thing remains clear: the underlying cybersecurity and compliance requirements have not changed.
For defense contractors handling Controlled Unclassified Information (CUI), this announcement should not be interpreted as a reduction in compliance obligations. Requirements including DFARS 252.204-7012, NIST SP 800-171, SPRS score reporting, annual affirmations, and cyber incident reporting remain fully in effect.
The pause affects the timing of formal third-party CMMC certification audits—not the security controls organizations are required to implement and maintain.
Maintaining a strong cybersecurity program remains essential for protecting your organization from data breaches, operational disruptions, contract risks, and potential liability associated with inaccurate self-attestations. A proactive security posture is still one of the best ways to safeguard your business and your defense contracts.
Although certification audits are temporarily on hold, organizations that stop preparing now may face challenges when the program resumes. Continuing to mature your cybersecurity practices, document compliance activities, and address gaps will position your business for a smoother certification process in the future.
Regulatory changes can create confusion, but they should not derail your cybersecurity strategy. LaScala's CMMC Audit Readiness service is designed to help defense contractors establish, document, and maintain compliance with NIST SP 800-171 and CMMC requirements while preparing for future certification audits.
Our experts help organizations:
Whether you're just beginning your compliance journey or have already invested heavily in CMMC preparation, maintaining momentum now can help reduce risk and minimize future disruptions.
The current pause in CMMC certification audits changes the timing—not the destination. Defense contractors must continue meeting cybersecurity requirements and demonstrating compliance with applicable DoW regulations.
LaScala's CMMC Audit Readiness team can help your organization navigate this transition with confidence, ensuring you're prepared for future certification requirements while strengthening security today.
Have questions about your SPRS score, NIST SP 800-171 compliance, or CMMC readiness? Contact LaScala to learn how our CMMC Audit Readiness services can help your organization stay secure, compliant, and competitive.
Contact us today (734-224-4915 or info@lascala.com) to schedule a consultation and take the next step toward CMMC readiness.