$593,800
SBA Est. Cost Per Small Firm
100K+
Companies Awaiting C3PAO Review
Sept 2026
Reform Task Force Recommendations Due
What’s Still Required
The Level 2 third-party certification requirement is paused — the underlying security obligations are not. Contractors handling CUI must still maintain a current SPRS score under DFARS 252.204-7019, meet the safeguarding requirements of DFARS 252.204-7012, and implement NIST SP 800-171 Rev 2. Level 1 and Level 2 self-assessments remain fully required while the certification piece is under review.
What’s Paused
On July 13, 2026, the Department of War suspended the Level 2 third-party (C3PAO) certification requirement that was set to take effect November 10, 2026. DoW CIO Kirsten A. Davies cited SBA projections of more than $7 billion in annual compliance costs for small and mid-sized businesses, with some individual assessments potentially reaching $600,000, plus a shortage of approved assessors: roughly 100 C3PAOs for over 100,000 companies. A CMMC Reform Task Force is reviewing the program, with recommendations expected around mid-September 2026. The requirement is paused, not eliminated, so contractors should expect some version of it to return.