CMMC Hit Pause, the FAR Council Hit Play

What it is

Huntress's field read on the July 13, 2026 DoD "strategic pause" of CMMC Phase 2 and the June 23, 2026 FAR Council proposed CUI rule — focused on what still binds contractors and their MSPs despite the headline. The summary already lists the mechanics; what it omits is the enforcement and timing detail below.

What still binds you

• Phase 1 self-assessments are live and unchanged since November 2025. Solicitations still carry the CMMC provision (DFARS 252.204-7025) and contracts the clause (DFARS 252.204-7021); SPRS scores still get submitted. A Level 2 contract has always required ≥88/110 — Phase 1 just means someone is now checking. DFARS 252.204-7012 (CUI safeguarding, 72-hour reporting) has not moved since 2017.
• False Claims Act exposure arguably got worse. Higher minimum scores plus an annual affirmation of score accuracy by a senior company official create more chances to misrepresent. DIBCAC assessment teams are now cooperating directly with DOJ on FCA cases — no whistleblower required.
• Primes are ignoring the pause. Prime contractors have already sent supplier notices telling subs to keep going. Flowdown obligations come from the contract, not a press release.

The FAR rule's reach

The proposed rule extends CUI/incident-reporting clauses to all FAR-based federal contractors, not just the defense industrial base, and moves the baseline from NIST 800-171 Rev 2 to Rev 3 — a restructure and expansion, not a citation cleanup. CMMC Level 2 stays on Rev 2, so a mixed defense/civilian contractor could face two revisions of the same standard simultaneously. Huntress predicts a CMMC move to Rev 3 in 2027 to realign the two rules. The 72-hour reporting requirement flows down to subcontractors, "which means it eventually lands on somebody's MSP."

One POA&M carve-out worth knowing

Beyond the restrictions in the summary: the single exception to the "3- and 5-point requirements must be fully met" rule is CUI encryption — it can ride a POA&M at 3 points if you are already encrypting but the module is not FIPS-validated. That is the only carve-out.

Timing / caveats

• The FAR rule's comment window closed July 23, 2026. There is no final rule — nothing in it is live contract language today. Do not rewrite a security program off a proposed rule.
• The CMMC Reform Task Force reports to the CIO within 60 days of July 13; recommendations land roughly September/October 2026.
• The pause suspends the certification tier (third-party assessment for solicitations after November 10, 2026). Proving compliance is not paused.