What happened
The Department of Defense has suspended Phase Two of the Cybersecurity Maturity Model Certification program, and some contractors are reading the pause as permission to slow down. A DataBreachToday analysis by Andrew Ellis argues the opposite: the gap before NIST SP 800-171 Revision 3 reaches contracts is a preparation window that will not come again.
The timing is the reason. NIST published SP 800-171 Revision 3 in May 2024, superseding Revision 2 as its current security requirements for protecting controlled unclassified information in nonfederal systems. Revision 2 was subsequently withdrawn because Revision 3 replaced it, and Revision 3 ships with SP 800-171A Revision 3, which holds the matching assessment procedures. But the CMMC Level 2 regulatory baseline is still Revision 2. The 110 security requirements that Level 2 incorporates, and the assessment methodology used against them, all come from Revision 2, which 32 CFR Part 170 identifies as the Level 2 standard.
So the two run on different clocks. CMMC Level 2 assessments continue against Revision 2 while the underlying standard has already moved on. The department paused the Phase Two transition but did not remove Phase One self-assessment obligations, and DFARS clause 252.204-7012 still requires contractors to protect covered defense information. The DoD has also started preparing for a future implementation of Revision 3.
Why this is a GRC story
An obligation is not a certification date. The contractual duty to safeguard covered defense information never paused. Keeping the certification timetable separate from the security duty is what stops a compliance program from stalling whenever a policy timeline moves.
Mapping early is cheaper than remediating late. The move from Revision 2 to Revision 3 changes expectations, and the work involved is unglamorous: reviewing policies, checking whether current technology still supports each requirement, collecting evidence and closing gaps. That takes longer than most teams budget for when a clause suddenly appears in a solicitation.
Evidence gets reused, not rewritten. Contractors that maintain their current implementation while running a structured transition analysis arrive ready. Those that treat the pause as a holiday will rebuild their evidence from scratch under deadline pressure.
What to watch
Watch for the department's implementation plan for Revision 3, and for any clause or regulation that formally shifts the Level 2 baseline. Until either lands, the sensible posture is dual: keep readiness against the standard in force, and document where you expect Revision 3 to bite, including owners and dates. The pause is not a retreat from protecting controlled unclassified information. It is time that will not be returned to you.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.