Here's a sentence that confuses a lot of defense contractors in September 2026: one of our clients just passed their C3PAO CMMC Level 2 assessment with a perfect score — 110 out of 110 controls.
"Wait," goes the response. "Isn't CMMC paused?"
Phase 2 enforcement is paused — the mandate that certification be a condition of contract award. The assessment ecosystem is not. C3PAOs are still authorized, still assessing, and still issuing Level 2 certifications that DoD has confirmed remain valid. And a growing set of contractors has figured out that this gap between "not required" and "still available" is the biggest competitive opening the pause created.
Why Certify When Nobody's Making You?
1. Primes are making you — just more quietly
Prime contractors didn't pause anything. Supplier notices since July have told subcontractors to keep maturing their programs, and some primes kept firm Level 2 proof deadlines in place for their supply chains. When a prime is choosing between two capable subs — one holding a third-party certificate, one holding a self-signed spreadsheet — that choice takes about a second.
2. A certificate is the strongest affirmation defense that exists
The annual executive affirmation of NIST 800-171 compliance continued straight through the pause, False Claims Act exposure and all. An independent assessment team verifying all 110 controls is the most credible evidence an affirming official can stand behind. It converts "we believe we're compliant" into "a licensed third party verified it."
3. The queue, when it returns, will be brutal
The arithmetic that triggered the pause — roughly a hundred assessment organizations for a hundred-thousand-plus contractors — hasn't changed. Assessors have open calendars today that they will not have the quarter after certification becomes mandatory again. Certifying now means never standing in that line.
4. Certification survives the reform
Every credible reform outcome builds on NIST 800-171. A current Level 2 certificate — valid for three years — either satisfies the returning requirement outright or over-satisfies whatever streamlined regime replaces it. It's the one credential that wins in every branch of the decision tree.
What a Perfect Score Actually Took
About that 110/110: perfect scores are rare, and worth demystifying, because nothing about it was magic. What it took was the unglamorous version of readiness, executed completely:
- A gap assessment run against the assessment objectives — all ~320 of them — not just the control text;
- A tightly scoped boundary with documented data flows, so the assessment covered exactly what it needed to and nothing more;
- An SSP that described the environment as it actually ran;
- Evidence mapped objective-by-objective before the assessment team ever asked;
- Staff who could explain their own controls in interviews without coaching;
- A dry run that surfaced the weak spots while they were still fixable.
Key Takeaway: The pause didn't lower the bar for a C3PAO assessment — it lowered the wait to take one. The contractors treating 2026 as a preparation window are collecting certificates while their competitors collect assumptions. (And no — a past result is a track record, not a guarantee. Every environment earns its own score.)
The Window Is the Strategy
DoD's Reform Task Force recommendations are expected imminently, and formal decisions will follow. Between now and whatever comes next, three things are simultaneously true: assessors are available, certifications remain valid, and almost everyone else is waiting. Windows like that don't announce when they close.
If your controls are close, finish them. If you don't know where you stand, find out this month. Certified-during-the-pause is a phrase that's going to look very good in capability statements for the next three years.
