United States – October 28, 2026 -- The Pentagon's suspension of CMMC Phase II third-party assessment requirements has made contractors' own self-attestations the main compliance record, raising their exposure under the False Claims Act (FCA). Mandatory C3PAO certifications remain on hold following the Department of War's class deviation, but Phase I self-attestation is still fully active.
Phase I obligations and prime contractor requirements remain in force
Contractors must still self-attest compliance with NIST SP 800-171 Rev. 2 wherever DFARS 252.204-7012 applies. The 110 controls in that standard remain the legal baseline for any organization that processes or stores controlled unclassified information (CUI).
Prime contractors can also require CMMC Level 2 C3PAO assessments through supply chain clauses, independent of the Department of War's action. Suppliers must meet flow-down requirements and submit Supplier Performance Risk System (SPRS) scores, or risk losing contracts.
Self-reported SPRS scores now carry greater FCA liability
With no third-party check behind a submission, internal representations entered into federal databases carry more legal weight. The Department of Justice does not distinguish between a false third-party certification and a false self-attestation. Even unintentional misreporting can expose contractors to FCA enforcement, whistleblower suits and contract forfeiture.
Experts urge three steps: Rev 3 parameters, mock assessments, audit trails
Speakers at the webinar "Beyond the Pause: How Defense Contractors Can Master CMMC Readiness" recommended that contractors:
- Begin incorporating the organization-defined parameters introduced in NIST SP 800-171 Rev 3 into their Rev 2 implementation, tailoring controls to operational technology and information security needs.
- Run a mock assessment. It costs less than a third-party assessment because it avoids certification costs such as eMASS submission, and prime contractors increasingly accept mock assessment documentation in place of formal third-party audits.
- Build an audit-ready trail by documenting assessment methodology, continuously validating operational evidence and verifying that written policies match day-to-day operations.
Cloud tools handling CUI must meet FedRAMP Moderate/Class C
Under DFARS 252.204-7012, cloud platforms that store or process CUI, including governance, risk and compliance (GRC) software, must meet FedRAMP Moderate/Class C standards. Hyperproof Gov runs on FedRAMP Certified Class C (Rev5) infrastructure. It offers automated SPRS scoring based on real-time control health, System Security Plan management, and continuous evidence mapping across multiple frameworks to avoid duplicate evidence collection.
The webinar featured experts from Aprio, Choice Cyber Solutions and Hyperproof.