The CMMC Assessor Requirement Just Got Suspended. The Personnel Qualification Rule Didn't.
October 7, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
The Department of War suspended the CMMC Phase 2 third-party assessment requirement in July 2026, but this changes almost nothing about your underlying obligation. Self-assessment against NIST SP 800-171, DFARS 252.204-7012 safeguarding duties, and the requirement that cyberspace personnel hold a qualifying certification under DoD 8140.03 all remain fully in force, and in some ways the pause raises your exposure rather than lowering it.
What Did the Department of War Actually Suspend?
It suspended the outside auditor, not the standard. On July 13, 2026, the Department of War announced the immediate suspension of CMMC Phase 2, which had been scheduled to make third-party C3PAO certification a condition of contract award starting November 10, 2026. Phase 1 self-assessment requirements, which took effect in November 2025, were left untouched, and DFARS 252.204-7012 and CMMC self-assessment requirements remain unaffected by the pause.
The reasoning behind the pause was cost and capacity, not a judgment that the controls themselves are unnecessary. DoD leadership cited Small Business Administration estimates that future CMMC phases could cost small and mid-sized businesses more than $7 billion annually, with only around 100 approved assessment organizations available to certify more than 100,000 companies in the defense industrial base. A CMMC Reform Task Force now has 60 days to study the program and report back, and until it does, DoD will rely on self-assessments and select government-led assessments rather than mandatory outside audits.
Does This Mean the CUI Controls Go Away?
No. Every contractor handling Controlled Unclassified Information still has to implement all 110 security requirements in NIST SP 800-171 Revision 2, and CMMC Level 2 still uses a scoring model that requires a minimum of 88 out of 110 points to reach a conditional certification status, with any gaps documented in a Plan of Action and Milestones. What changed is who checks your work.
That distinction matters more than it sounds like it should. With no outside assessor validating your score before a contract award, the legal exposure sits entirely on the signature your own organization puts on the self-attestation. Legal counsel tracking the suspension have flagged this directly: inaccurate or unsupported self-attestations posted to SPRS present continuing False Claims Act exposure that the removal of third-party review does nothing to reduce, and arguably increases. A wrong self-score is no longer a finding a C3PAO catches before you bid. It is a claim the government can later decide you made falsely.
Who Has to Be "Qualified," and Under What Rule?
This is where a separate mandate does work that CMMC alone cannot. DoD 8140.03, the Cyberspace Workforce Qualification and Management Program, requires that personnel in cyberspace work roles hold a qualifying certification or training credential, and it explicitly reaches beyond government employees. The manual applies to contracted support personnel whose performance work statement requires the performance of cyberspace work, identified by work role and proficiency level, and it requires that personnel certifications maintain relevancy through periodic review rather than being treated as a one-time box to check.
That obligation runs independently of whatever CMMC assessment model survives the 60-day review. A self-assessed contractor still has to show, if asked, that the people who configured its access controls, its incident response process, or its system boundary actually hold a credential the framework recognizes for that role. This is why the personnel side of your compliance file deserves as much attention as your SSP right now, and it is a natural fit for a curriculum built specifically around governance, risk, and compliance documentation rather than pure technical configuration.
The certification landscape here is uneven by design, and it rewards planning your team's credentials around actual work roles instead of buying the same certification for everyone.
| DCWF Proficiency Level | Typical Work Role | Common Qualifying Certification |
|---|---|---|
| Basic / IAT II | Systems administrator, help desk | CompTIA Security+ |
| Intermediate | Cyber defense analyst | CompTIA CySA+ |
| Advanced / IAT III, IAM II-III | ISSM, security architect | ISC2 CISSP |
CISSP does the most work of any single credential in this table. It satisfies IAT Level III, IAM Level II and III, and all three IASAE levels, mapping to roughly 44 percent of approved DCWF work roles across five of the framework's seven workforce elements. CompTIA's certifications cover a wider band of entry and mid-level roles, and the vendor notes it holds approval for seven certifications across 30 work roles under DoDM 8140.03, including Security+ and CySA+.
How Should a Program Manager Prove Compliance Without a Third-Party Stamp?
You prove it the way you would have proven it if the C3PAO market had never existed: with a paper trail that names people, not just tools. Build a roster that maps each cyberspace-coded role on your contract to the individual filling it, the certification that satisfies that role's 8140.03 requirement, and the date it was last verified as current. That roster becomes your answer when a contracting officer, a prime, or eventually an auditor from whatever program emerges from the reform review asks who is accountable for a specific control.
A few things belong in that file beyond the roster itself:
- The signed self-assessment score and the supporting evidence for each of the 320 assessment objectives under NIST SP 800-171A, kept current rather than reconstructed after the fact.
- A POA&M for any control scored short of full implementation, with realistic remediation dates rather than placeholders.
- Certification records for every person in a cyberspace-coded role, refreshed on the renewal cycle the credential actually requires, not on a schedule your organization invented.
None of this is new work created by the suspension. It is the work CMMC Phase 2 would have outsourced verification of, and that verification is now sitting back on your desk. If your current bench doesn't map cleanly to the roles your contracts require, Forge University's certification resource library is a reasonable place to check what a given credential actually covers before you commit training budget to it. Programs built around CISSP in particular pull double duty here, since it satisfies senior 8140.03 work roles while also giving your ISSM a working command of the governance documentation a self-assessment file needs to survive scrutiny. If you want a study plan built around this, you can start training whenever you're ready.
What This Means for Your Next Contract Cycle
Treat the suspension as a delay in who checks your homework, not a change in what homework is due. Contracts that already carried CMMC Level 2 C3PAO language are being modified to remove it, but the underlying control set, the self-assessment scoring model, and the personnel qualification duty under DoD 8140.03 are not going anywhere while the reform task force does its work. Contractors who keep their certification rosters and self-assessment evidence current through the review period will be the ones who can pivot quickly to whatever verification model the Pentagon lands on in the fall, instead of scrambling to rebuild a compliance file from scratch.
The safest read of a 60-day policy review is that it ends with a different verification mechanism, not with fewer controls. Staff who already hold role-appropriate certifications under 8140.03, and a self-assessment file that can stand on its own without an assessor's signature, are the two things that carry over no matter what the task force decides.