The Pentagon Just Saved Small Contractors $593,800 Each — Here's Why

More than 120,000 small businesses in the defense supply chain were staring down a compliance bill that could top half a million dollars each, due in less than four months. On July 13, 2026, the Department of War hit pause. The suspension of CMMC Phase II doesn't erase the cybersecurity requirement — but it buys small contractors time, and possibly a cheaper path, before it comes back.

What was about to happen

The Cybersecurity Maturity Model Certification, or CMMC, is the Pentagon's framework for verifying that companies handling sensitive defense information actually secure it properly. Phase II of the program was scheduled to take full effect November 10, 2026, and it would have required more than 120,000 small businesses in the Defense Industrial Base to obtain certification — many through costly third-party assessments.

According to Small Business Administration analysis, the compliance costs were steep: roughly $593,800 per certification for firms requiring third-party assessment, and about $388,600 for firms eligible to self-assess. For a small manufacturer, machine shop, or IT contractor working on defense subcontracts, that's not a rounding error — it's often more than the value of the contracts the certification was meant to protect.

There was also a bottleneck problem: only about 100 approved assessors existed to certify a pool of 120,000-plus businesses, meaning even companies willing and able to pay would have struggled to get certified in time.

Why the Pentagon pulled back

The suspension followed months of pressure from the SBA's Office of Advocacy and small business stakeholders, who warned the Department of War that the CMMC framework as written was pushing small firms out of defense work entirely rather than making the supply chain more secure. Some contractors reportedly chose to walk away from defense contracts rather than absorb the certification cost — the opposite of what a security requirement is supposed to accomplish if it shrinks the pool of vetted suppliers.

Effective July 13, 2026, the Department of War suspended the Phase II rollout and launched a 60-day, top-to-bottom review of the entire program through a newly created CMMC Reform Task Force. As part of that process, the department also opened a formal Request for Information seeking direct feedback from contractors on how the framework should be restructured.

SBA Administrator's office publicly commended the move, framing it as a recognition that a security program which drives small businesses out of the defense industrial base ultimately weakens national security rather than strengthening it.

What's actually paused — and what isn't

This is the part contractors most often get wrong: the suspension applies specifically to Phase II's rollout. It is not a blanket pause on defense cybersecurity obligations.

• Phase I self-assessments remain mandatory. If your contracts already require a CMMC Level 1 self-assessment, that obligation has not changed.
• DFARS 252.204-7012 is still fully in force. This clause, which requires safeguarding covered defense information and reporting cyber incidents, was never part of the suspension.
• Phase II certification requirements are paused, not canceled, pending the 60-day review and whatever framework comes out of it.

Contractors who assume "CMMC is dead" and stop all cybersecurity compliance work are taking on real risk. The safer read is that the most expensive, most bottlenecked part of the program is under active reconstruction, while the baseline obligations that already existed keep applying.

What small contractors should do during the pause

• Keep current Phase I self-assessments up to date rather than treating the news as a reason to let compliance lapse.
• Maintain your System Security Plan and Plan of Action if you've already started Phase II preparation — that work isn't wasted, and a leaner future framework will likely still expect similar documentation.
• Submit feedback to the Request for Information if the original third-party assessment cost was a genuine barrier for your business. The task force is explicitly soliciting industry input during this window.
• Watch the 60-day review timeline closely. A revised framework, a new phase-in schedule, or updated cost structure is likely to emerge from it, and contractors who prepared during the pause will have an easier transition than those who stopped entirely.
• Don't drop cyber insurance or IT security spending on the assumption the requirement is gone — DFARS obligations and contract-specific security clauses remain active regardless of Phase II's status.

Why this matters beyond defense contractors

Even businesses with no defense contracts should pay attention to how this played out. It's a rare example of a federal compliance mandate being paused specifically because small businesses said the cost structure would push them out of a market — and the agency listened before the deadline hit, not after. If you're weighing whether to bid on defense-adjacent work you previously avoided because of CMMC cost fears, this review period is a reasonable moment to reconsider, provided you go in clear-eyed about Phase I and DFARS obligations that remain.

If defense contracting is new territory for your business, make sure the fundamentals are in order first — a clean EIN number and properly structured entity matter as much to a contracting officer as your cybersecurity posture. Many small contractors also lean on an SBA loan to cover working capital gaps between contract milestones, and it's worth understanding how that financing works before compliance costs are locked in. And because CMMC touches how you classify the people doing the security work, revisit our guide on independent contractor vs. employee classification if you're staffing up for a defense contract with a mix of employees and outside specialists.

The bottom line

Small defense contractors got a real reprieve, not a permanent exemption. The 60-day review clock started July 13, which means a revised framework could surface before the original November 10 deadline would have hit. Businesses that keep their Phase I and DFARS obligations current — and use this window to weigh in on what comes next — will be in a far better position than those who read "suspended" as "over."

Photo by Adi Goldstein on Unsplash