On July 13, 2026, the Department of Defense suspended Phase 2 of the Cybersecurity Maturity Model Certification program, pausing the mandatory third-party assessment while a new task force runs a 60-day review. Most of the coverage is framing this as relief for contractors. We read it differently.
The pause didn’t take the compliance risk off the table. It relocated it. Before July 13, an independent assessor was going to walk your environment and vouch for it. That assessor is gone for now, so the only thing a contracting officer sees is the score you grade yourself, sign, and upload. The question stops being “will I pass someone else’s audit?” and becomes “can I stand behind the number I attested to?” That is no longer only a compliance question. It’s an architecture question, how your environment is actually built, permissioned, and watched, and that’s exactly the seam a Salesforce partner like Vectr works in.
Key Takeaways
- The real shift is from third-party validation to self-attestation. With C3PAO certification paused, your self-reported SPRS score is the whole ballgame, and it carries False Claims Act exposure if it’s wrong.
- A score is only as defensible as the environment behind it. If your CUI lives in Salesforce, the integrity of your attestation depends on how that instance is configured, permissioned, and monitored, not on a certificate.
- DoD suspended CMMC Phase 2, along with Phases 3 and 4, effective July 13, 2026, pending a 60-day review by a new CMMC Reform Task Force. This is a pause of the assessment mechanism, not a change to the underlying rule.
- Phase 1 self-assessment under DFARS 252.204-7021, SPRS score reporting, and annual executive self-attestation all remain fully mandatory. NIST SP 800-171 obligations under DFARS 252.204-7012 have been active since 2017 and don’t move because CMMC’s assessment timeline does.
- Pausing internal work is a strategic risk, not a reprieve. If Phase 2 resumes on a shortened timeline, C3PAO capacity will stay tight, and contractors who kept remediating will be first in line.
What Actually Changed, and Who’s Holding the Risk Now
The suspension pauses the mandatory third-party assessment conducted by Certified Third-Party Assessment Organizations (C3PAOs), along with the Phase 3 and Phase 4 rollout. Under the original schedule, Phase 2 was going to become the primary enforcement mechanism for suppliers handling Controlled Unclassified Information, phasing into contracts starting November 10, 2026, with formal C3PAO certification required as a prerequisite for award.
The 60-day review, run by a newly established CMMC Reform Task Force, gives DoD leadership time to evaluate assessor capacity, operational impact, and small business readiness. DoD’s CIO cited SBA data suggesting future phases could cost small and midsize businesses more than $7 billion a year. But note what the pause did not do. It didn’t repeal the rule, and it didn’t move the security controls. It removed the outside party who was going to check your work. Everything that the assessor would have verified is now verified by you, over your own signature.
That’s the shift that matters, and it’s easy to miss when the headline reads “suspended.”
From Someone Else’s Audit to Your Own Signature
With third-party certification on hold, the self-assessed SPRS score is the first, and often only, security signal a contracting officer sees when evaluating your bid. It just went from one input among several to the whole picture.
And it has teeth. Submitting an inaccurate SPRS score or a false annual affirmation can expose an organization to liability under the False Claims Act, and the government has actively pursued those cases. The suspension does nothing to reduce that exposure. If anything, it concentrates it: there’s no longer an assessor between you and the number you reported.
So the practical question for every contractor right now is simple. When you upload that score, can you prove the environment actually behaves the way the score says it does?
Why That Makes This an Architecture Problem, Not a Paperwork Problem
Here’s the connection most of the “keep calm and self-assess” coverage skips.
NIST SP 800-171, the standard CMMC verifies, isn’t a binder of policies. It’s a set of technical controls: identity verification, access management, multi-factor authentication, encryption, monitoring, boundary enforcement. Federal contractors handling CUI have been required to implement those since December 2017 under DFARS 252.204-7012, independent of where CMMC’s certification timeline sits. A self-assessment score is a claim about whether those controls genuinely live in your systems.
For a large share of defense suppliers, one of those systems is Salesforce, where business development, partner collaboration, and CUI often actually live. Which means your attested score is, in part, a statement about how your Salesforce instance is configured. Sharing rules, permission sets, field-level security, custom code, event monitoring, integration boundaries: these aren’t IT housekeeping. They’re the difference between a score you can defend and one you’re hoping nobody checks. A certificate could paper over a shaky environment for a while. A self-attestation can’t; it’s only as honest as the build underneath it.
That’s the through-line: the pause pushed the risk onto your own score, and your score is downstream of your architecture.
Speak with a Vectr Solutions expert about your compliance architecture
Why This Isn’t a Reason to Pause the Work
A review period isn’t a deadline extension and shouldn’t be treated as one. You can still win a contract award under a conditional compliance status while you finish remediation, but full baseline implementation is still owed eventually, and now that promise lives in a document you personally signed.
There’s also a capacity argument that punishes waiting. If DoD resumes Phase 2 or Phase 3 on a condensed timeline, the assessor bottleneck comes right back: roughly 100 authorized C3PAOs against more than 100,000 companies that will eventually need one. Contractors who keep remediating their System Security Plans and Plans of Action and Milestones through this window will be first in line when assessments restart. And more immediately, they’ll be the ones who can stand behind their SPRS score on every solicitation between now and then.
What We’re Telling Clients to Do in the Next 60 Days
We’re not advising anyone to stand down. We’re advising them to use this window, because it’s the cheapest chance they’ll get to make their score real.
- Keep self-assessments and SPRS documentation current, and treat the number as something you may have to defend under FCA scrutiny, because you might.
- Run a genuine gap assessment against your actual environment, not a checklist. If CUI touches Salesforce, that means validating configuration, sharing model, monitoring, and every integration boundary against the controls your score claims.
- Close the gaps in your SSP and POA&M now, while there’s no scheduled audit pressure, so that if Phase 2 comes back on a short clock, remediation is behind you.
- Watch for the CMMC Reform Task Force’s recommendations (expected roughly 60 days out) and respond to the public request for information feeding the review if it affects you.
Salesforce Government Cloud: The Environment, and the Line You Still Own
If your contracts involve CUI, Covered Defense Information, or ITAR-controlled data, a standard commercial cloud generally can’t meet the safeguarding obligations under DFARS 252.204-7012 and NIST SP 800-171. That data has to sit in at least a FedRAMP Moderate or equivalent environment, and Government Cloud Plus clears that bar comfortably. It delivers FedRAMP High, with Government Cloud Plus Defense extending to the most sensitive DoD Impact Level 4 and 5 categories.
But here’s the part that ties back to your score: GovCloud doesn’t grant automatic compliance. Salesforce secures the data centers, the network, and physical security. You remain fully responsible for permissions, sharing rules, custom code, and every integration you bring in. That’s the Shared Responsibility Model, and it’s the exact boundary where a self-attested score is won or lost. The platform gives you a compliant foundation; whether your attestation is true depends on what you build on top of it.
Source: https://architect.salesforce.com/docs/architect/fundamentals/guide/data360_security_architecture
We saw this directly with an aerospace and defense manufacturer building unmanned aerial systems for military applications. They needed a secure, compliant environment to run business development across commercial and government segments. Vectr built a FedRAMP-aligned Salesforce Government Cloud instance staffed exclusively by U.S. citizen resources, layered in MFA, SSO, and Salesforce Shield event monitoring, and delivered a centralized, audit-ready pipeline: the kind of environment whose SPRS score you can actually stand behind.
The same principle held for MindPoint Group, a cybersecurity firm that itself provides FedRAMP assessments to federal clients. They needed a GovCloud Salesforce instance, separate from their commercial environment, that met FedRAMP requirements while integrating with their existing SOC tools. If the suspension has you rethinking whether your own architecture would survive its own attestation, our breakdown of when it’s actually time to move to GovCloud is a good next read.
Why Partner with Vectr Solutions
We don’t replace your C3PAO or your compliance officer, and we won’t pretend to. What we do is sit at the intersection of federal compliance and Salesforce architecture, translating requirements like DFARS 252.204-7021 and NIST SP 800-171 into the permission sets, sharing rules, monitoring configurations, and integration boundaries that make a self-attested score defensible. That’s a delivery-first model, built by Salesforce architects who have done this inside real GovCloud environments for regulated clients, not a framework on a slide.
The certification mechanism paused. The signature you put on your SPRS score did not. Whether you’re maintaining self-assessment documentation, weighing a GovCloud migration, or preparing for whatever comes out of the 60-day review, our Salesforce Advisory & Governance team can run the gap assessment before an auditor, or a False Claims Act plaintiff, finds the gap for you.
Keep Your Compliance Posture Moving, Even During this Pause
A paused certification requirement isn’t a paused obligation, and with the assessor gone, the weight of proof moved onto you. Vectr Solutions helps government contractors build Salesforce architecture that makes their compliance posture, and the score they attest to, something they can defend as CMMC continues to evolve.
