CMMC Phase 2 Paused: What Michigan Manufacturers Owe Now

Did the CMMC Phase 2 pause just save your shop from a five-figure audit? Maybe. But it did not take a single security requirement off your plate.

On July 13, 2026, the Department of War suspended CMMC Phase 2, which would have required third-party C3PAO certification in new defense contracts starting November 10, 2026. A Reform Task Force was given 60 days to review the program. On September 3, the pause was written into acquisition rules through a class deviation. As of early October, no restart date has been announced.

A lot of West Michigan machine shops, injection molders, and tool-and-die suppliers heard "paused" and stopped their compliance work. That is a mistake. Here is what changed, what did not, and what a smart supplier in Grand Rapids, Holland, or Muskegon should do with the extra time.

What the CMMC Phase 2 Pause Actually Changed

The CMMC Phase 2 pause removed one thing: the requirement for a third-party C3PAO assessment as a condition of new contract awards.

Under the July 13 implementation procedures, contracting officers cannot add new Level 2 (C3PAO) or Level 3 requirements to solicitations during the review. Existing solicitations and contracts that already contain those requirements are supposed to be amended or modified. CMMC waiver procedures are also on hold.

That is the full list. The official CMMC status page from the Department of War CIO confirms that the rest of the program stays in place.

One practical tip: if your contract or subcontract still says "Level 2 (C3PAO)," do not assume the press release rewrote it. Ask your contracting officer or prime for the written amendment before you cancel or schedule an assessment.

What Michigan Defense Suppliers Still Owe

You still owe every security control you owed before July 13. The pause changed who checks your work, not what the work is.

Here is what remains fully in force:

• DFARS 252.204-7012. If you handle Controlled Unclassified Information (CUI), this clause has required you to protect it since 2017. It is still in your contracts.
• NIST SP 800-171 Rev. 2. The 110 security requirements in NIST SP 800-171 are the standard you must meet for CUI. Nothing about that changed.
• 72-hour incident reporting. DFARS 7012 requires you to report a cyber incident affecting CUI to the DoD within 72 hours of discovery. Most small suppliers have never tested that process.
• SPRS scores. You must keep a current NIST 800-171 self-assessment score in the Supplier Performance Risk System. Primes check it.
• CMMC Phase 1 self-assessments. Level 1 and Level 2 self-assessments, plus the annual affirmation by a senior official, remain mandatory where your contract requires them.

The quiet risk is the affirmation. When a company officer signs off that the business meets these controls, that signature can carry False Claims Act exposure if the claim is not true. The Department of Justice has used the False Claims Act against contractors who misrepresented their cybersecurity. A pause in third-party audits does not lower that risk. If anything, it puts more weight on your own honest self-assessment.

Why Primes Are Not Waiting

Your biggest customer may not care that Phase 2 is paused.

Large primes and Tier 1 automotive-defense suppliers carry the liability for their supply chains. Many have their own supplier security requirements written into purchase orders, separate from the government's CMMC timeline. Those commercial requirements did not pause on July 13.

Supplier security questionnaires increasingly ask for the same things a C3PAO would check: a System Security Plan, a Plan of Action and Milestones, multifactor authentication on every account that touches CUI, and evidence of encrypted storage and email.

For a West Michigan supplier, losing a prime relationship costs far more than any assessment fee. Treat your prime's questionnaire as the real deadline.

How to Use the Pause: A 90-Day Plan

The smartest suppliers are treating the pause as free prep time. When Phase 2 returns, and most observers expect some form of third-party assessment to return, C3PAO calendars will fill fast. The shops that are already ready will get assessed first.

Here is a practical 90-day plan.

Days 1 to 30: Scope and score.

• Map exactly where CUI lives: which systems, which people, which file shares, which email accounts. A tight boundary cuts cost dramatically.
• Run an honest NIST 800-171 self-assessment against all 110 requirements. Compare the result to the score currently posted in SPRS.
• If the numbers do not match, fix the SPRS entry. A score you cannot defend is a liability.

Days 31 to 60: Close the high-value gaps.

• Turn on phishing-resistant multifactor authentication for every user and admin in the CUI boundary.
• Confirm that CUI is stored and sent only through systems that meet FedRAMP Moderate or equivalent requirements.
• Write or update your System Security Plan so it describes how each control is actually met today, not how you hope to meet it.

Days 61 to 90: Prove it works.

• Run a tabletop exercise for a ransomware or CUI exposure incident. Time how long it takes to reach the 72-hour reporting step.
• Collect evidence for each control: screenshots, policies, logs, and training records. An assessor will ask for proof, not promises.
• Brief the senior official who signs the annual affirmation. They should understand what they are attesting to.

Michigan suppliers also have help available. The Michigan Manufacturing Technology Center, known as The Center, is Michigan's NIST Manufacturing Extension Partnership affiliate and supports small manufacturers with cybersecurity resources. Some state and federal programs also offset the cost of gap assessments.

Where a vCISO Fits for a Small Manufacturer

Most 30-to-150-person manufacturers do not need a full-time security executive. They do need someone accountable for the System Security Plan, the SPRS score, and the incident response plan.

That is the job of a virtual CISO. A vCISO owns your compliance roadmap, sits in on prime customer reviews, and keeps the documentation current, for a fraction of the cost of a full-time hire. Paired with Cybersecurity as a Service, the same team can run the tools that produce your evidence: MFA, endpoint protection, logging, and backup.

The goal is simple. When an assessor or a prime asks, "Show me," you can.

Frequently Asked Questions

Is CMMC canceled?

No. CMMC is not canceled. Only Phase 2, the requirement for third-party C3PAO certification in new contracts, was suspended on July 13, 2026, pending a Reform Task Force review. Evolv Technology Solutions advises Michigan defense suppliers that Phase 1 self-assessments and DFARS 7012 obligations remain fully in force.

Do I still need to comply with NIST 800-171 during the CMMC pause?

Yes. If you handle Controlled Unclassified Information, DFARS 252.204-7012 requires you to implement the 110 controls in NIST SP 800-171 and report cyber incidents within 72 hours. The CMMC Phase 2 pause did not change that requirement in any way.

When will CMMC Phase 2 start again?

There is no announced restart date as of early October 2026. The November 10, 2026 date is no longer an active deadline. Evolv recommends that West Michigan manufacturers keep preparing now, because C3PAO assessment capacity is likely to be tight once third-party assessments resume.

Can a small manufacturer afford CMMC compliance?

Yes, if the scope is tight. The biggest cost driver is how many systems and people touch CUI. Evolv Technology Solutions helps Grand Rapids and West Michigan manufacturers shrink that boundary first, then close gaps with a vCISO and managed security tools, which keeps the cost far below a full-time security hire.

What happens if my SPRS score is wrong?

An inaccurate SPRS score creates legal risk, because the score and the annual affirmation are representations to the government. If your real posture does not match the posted score, correct it and document a plan to close the gaps. Evolv's vCISO team can run a fresh NIST 800-171 assessment to give you a score you can defend.

Get a Free CMMC Readiness Review

The CMMC Phase 2 pause is a window, not a pass. Evolv Technology Solutions offers a free CMMC readiness review for West Michigan manufacturers and defense suppliers. We will help you scope your CUI, check your SPRS score against reality, and build a 90-day plan.

Schedule your free consultation at evolvtechsolutions.com.

This article is general information, not legal or contracting advice. Confirm your specific obligations with your contracting officer or qualified counsel.