On July 13, 2026, the Department of War announced that the Phase II requirements of the Cybersecurity Maturity Model Certification (CMMC) would be suspended immediately, originally coming into effect on November 10, 2026.
For MSPs supporting defense contractors, the CMMC Phase II suspension does not erase the work clients still need to understand, document, and defend.
Treat this as a practical guide when you are explaining the pause and for determining which readiness work should continue.
This article is based on the July 23, 2026 live session with Empath Co-founder Wes Spencer and Control Case Federal Division President Scott Singer. Scott works directly in the federal compliance space, making him a useful resource for understanding how MSPs should guide clients through this uncertainty.
MSPs can only help their clients decide what to do next when the reason for the CMMC suspension is explained in simple terms.
The recent announcement, in practical terms, paused CMMC Phase II requirements, which affects the next stage of the rollout tied to third-party assessments for certain contractors.
Many clients were working on meeting this deadline, but the pause doesn't indicate that CMMC has been cancelled. Neither does it mean that clients can disregard their existing cybersecurity obligations.
Self-assessment requirements are still included in the situation. Contractors who are dealing with controlled unclassified information must still know whether their present practices could stand up to examination.
The simplest way for MSPs to explain it is this: The assessment timeline changed. The security responsibility did not disappear.
What Scott made most clear was that the work should not be halted merely because the timeline had changed: “Just don’t stop, get it done, and then you can see what happens.”
If the client has already started documenting their environment, reviewing controls, gathering evidence, updating policies, or improving their SPRS score, the pause should not automatically stop that work.
Scott stressed the need to keep working towards a defensible score.
For the Level 2 self-assessment, he cited 88 as the minimum score and 110 as perfect, and warned MSPs and clients not to overinflate the number. A high score only helps if the client can support how they got there.
Help clients to arrive at a figure which shows where they really are and which would stand if someone asked for evidence.
Scott also advises that your MSP should have someone who knows how to get the client there; if they don't, they should bring in a partner who does.
Overall, the pause gives clients more time to get the work right. It should not necessarily become a reason to drop the work now and rebuild the same plan later.
Once the facts are clear and the client understands why readiness work may still matter, MSPs can help them decide what to do next.
That decision should be based on risk, not relief.
Some clients may still choose to slow down. Others may decide to keep moving, adjust the plan, or convert assessment work into a mock assessment or readiness review. The MSP does not have to make that decision for the client, but they should help the client understand what they are deciding.
Bring the conversation back to practical questions.
|
Question to Ask |
Why It Matters |
|
What defense contracts does the client have today? |
This helps clarify whether the client still has active obligations tied to CUI, cybersecurity controls, or flow-down requirements. |
|
What requirements are already written into those contracts? |
The CMMC pause does not automatically change existing contract language. Clients need to understand what they have already agreed to. |
|
What readiness work has already been started? |
If documentation, control reviews, or assessment prep are already underway, the client may be better served by adjusting the plan instead of stopping completely. |
|
What gaps are still open? |
The suspension does not remove security gaps. It only changes the pressure around when some of them may need to be proven. |
|
Who can accurately assess and support the client’s score? |
If the MSP does not have the right expertise internally, this is where a qualified partner may need to be brought in. |
|
What would happen if a prime contractor still expects proof of readiness? |
Prime contractors may continue asking for evidence, even while the broader rollout is uncertain. |
|
What would happen if requirements return in a revised form? |
Clients that keep moving will be in a better position than those who stop and have to restart later. |
This keeps the conversation grounded and gives the client a better way to decide whether to continue, pause, or adjust the work already underway.
If the conversation turns into contract interpretation, the safest path is to have the client involve legal or compliance counsel.
If the client chooses to pause, document what was recommended, what was declined, and what risk the client accepted. That documentation gives everyone something solid to return to if CMMC expectations change again.
Defense contractors remain responsible for protecting sensitive information, especially when clients, partners, and primes expect evidence that the work is being handled responsibly. MSPs can help by keeping the response practical: clarify the risk, document the decision, and support the controls that still make sense.
Wes brought the conversation back to risk, “Do you really want to put the contracts that you have on the line on the fact that you don’t think you’re ever going to go through this again?”
Clients need to answer this question before they slow down. That said, not all clients need to move at the same pace. What matters is that they understand the risks associated with whatever pace they choose.
This blog gives you the high-level, practical version of the conversation. For more nuance, watch the full Empath and ControlCase live session, where Wes and Scott walk through the CMMC Phase II suspension in more detail.
Empath is a learning and accountability platform built specifically for MSPs, with courses and resources across technical training, compliance, leadership, sales, service delivery, and client communication. We also cover timely MSP topics like this in the Empath newsletter. Subscribe for practical guidance, or start a 14-day free trial to equip your team with CMMC training and other MSP-specific courses inside the platform.