My two cents and personal opinions only:
The Phase 2 suspension feels more like a postponement than a halt of any kind.
"Additionally, the Department will begin a comprehensive review of CMMC aimed at aligning with Secretary of War Pete Hegseth's Acquisition Transformation System (ATS) directives prioritizing speed to capability, lowering barriers for small, medium, and non-traditional businesses, and replacing bureaucratic compliance with scalable, resilient cybersecurity measures."
I think this quote is the heart of the matter. I've seen estimates of ~80,000 contractors with level 2 requirements. According to this analysis it lists for CMMC Level 2:
Adoption rate: 8% (certified), 42% (in progress)
Average implementation time: 12-18 months
Compliance cost range: $75,000 – $300,000
(sources in link)
... which leads me to believe there's an estimated half (~40,000) of contractors where level 2 isn't on their radar.
Of course these aren’t official DoW numbers, but they paint a reasonable picture of the landscape.
I believe C3PAOs and assessors are still needed, and how/where they fit in will be realized during this 60-day window (or at least, eventually).
Speaking as someone who's not yet CMMC certified, I'm confident saying that the pursuit of becoming certified is worthwhile and I plan on doing so as soon as I can (because those T3 background checks won't be getting any shorter!)
Back
posted in
Announcements
Phase 2 Suspension
Public Group
CMMC Professionals Network
Don't navigate CMMC alone. Join our nonprofit community for the hands-on education, credentials, and resources to advance your CMMC career.