Defense Contractors Persist in CMMC Certification Amid Phase 2 Pause

The Defense Industrial Base (DIB) landscape is currently navigating a significant transition regarding cybersecurity measures, particularly concerning the Cybersecurity Maturity Model Certification (CMMC). A recent survey conducted by Redspin—a leading provider of CMMC services—revealed that the majority of defense contractors are either actively pursuing or have achieved Level 2 certification. This is a noteworthy trend, particularly given the forthcoming pause in CMMC Phase 2, set to commence on November 10, 2026. While some organizations are understandably taking a moment to reassess their certification strategies, the survey indicates a broader resilience and continued investment in cybersecurity practices.

The impending pause in the CMMC Phase 2 rollout has created a paradox for many contractors: while it may provide an opportunity to slow or reassess certification efforts, the obligations under the Defense Federal Acquisition Regulation Supplement (DFARS) and National Institute of Standards and Technology (NIST) guidelines remain firmly in place. These regulations, specifically addressed in DFARS 252.204-7012, place critical emphasis on the protection of Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). As a result, even amidst the shift toward a more flexible certification landscape, compliance with these established standards is non-negotiable for contractors seeking to maintain their competitiveness in federal procurement.

The data released from Redspin's latest report, "Committed to the Mission: The State of the DIB with CMMC in Flux", highlights key findings from its summer 2026 survey. Notably, approximately 78.2% of surveyed organizations reported they are either progressing toward CMMC certification or are already Level 2 certified through a third-party assessment. Rather than retreating to a status quo in light of the certification pause, an overwhelming majority, 75%, of respondents are committed to maintaining or even increasing their cybersecurity investment across various operational technologies.

Redspin's analysis underscores an interesting trend: while there are sectors within the DIB that are reconsidering their immediate certification requirements—21.9% noted they are delaying their certification efforts—this is counterbalanced by a robust commitment among the majority to uphold and enhance cybersecurity measures. Approximately 75.4% to 84.4% of organizations reported unchanged cybersecurity spending across a spectrum of technologies, even as we see a slight pullback in spending specifically aimed at CMMC certification.

Investments in areas such as managed services, risk management, compliance tools, and consulting aimed at NIST/DFARS frameworks appear to be resilient, displaying a preference among contractors to enhance their overall cyber postures. These insights signal a recognition among DIB players that independent validation and robust cybersecurity frameworks are integral not only for compliance but also for the overall strength and longevity of their operations in federal contracts.

Addressing these trends, Dr. Thomas Graham, Vice President and Lead Cybersecurity Certification Advisor (CCA) at Redspin, emphasized, “While the pause allows some organizations to slow down, many are continuing to push forward, recognizing that CMMC might be in flux, but the commitment to protect CUI is unwavering.” This sentiment highlights a critical understanding within the defense contracting community: cybersecurity is not merely a regulatory hurdle but a cornerstone of operational integrity.

As procurement and supplier management teams engage subcontractors in readiness discussions, leveraging Redspin’s research should prove invaluable. Understanding that while federal timelines may fluctuate, expectations from primes for cybersecurity compliance remain unchanged is essential for maintaining healthy contractor-prime relationships.