Since the DoD paused CMMC Phase 2 in July, the question I hear most from defense contractors in Honolulu, Hawaii and Guam is some version of "Can we stop now?" I get it. CMMC has been expensive, confusing, and a moving target. But my answer is no, and I want to explain why.
The pause delayed one thing: the requirement for a third-party C3PAO certification as a condition of contract award. It did not pause the security requirements behind CMMC Level 2. If you handle Controlled Unclassified Information (CUI), the 110 controls in NIST 800-171 are still required. Your SPRS score is still required. Your annual affirmation is still required. And from where I sit, the legal risk of getting those wrong has gone up.
What Did the DoD Actually Pause?
The DoD paused mandatory third-party CMMC assessments. It did not pause the underlying NIST 800-171 requirements.
The Department of War (formerly the Department of Defense) suspended CMMC Phase 2 on July 13, 2026. Phase 2 would have required third-party assessments across all contracts involving CUI starting November 10, 2026. Phases 3 and 4 were put on hold, and a CMMC Reform Task Force was created to review the program.
The pause has since become more formal. On September 3, the Department reissued the class deviation behind the suspension. It directs contracting officers to remove third-party CMMC requirements from solicitations and contracts, permits Level 1 and Level 2 self-assessments, and keeps NIST SP 800-171 Rev 2 as the baseline under DFARS 252.204-7012.
The Task Force report went to the DoW CIO in September but has not been made public. Cyber AB CEO Matthew Travis has pointed to early October.
The way I explain it to clients: the verification method changed. The standard did not.
Reason 1: The CMMC Level 2 Requirements Never Went Away
If your contracts include DFARS 252.204-7012, you are still required to implement all 110 NIST 800-171 controls. That was true before CMMC existed, and it is still true today.
Safeguarding FCI and CUI, implementing NIST 800-171, rapid incident reporting, and certifying compliance all come from requirements outside the CMMC Program, and the pause does not touch them. The CMMC self-assessment obligation also continues.
When a contractor tells me CMMC doesn't apply to them, I walk them through the DFARS clauses already in their contracts. And if their prime requires it, it's a requirement regardless of what the DoD does, because the subcontract is a private agreement between the two companies.
CMMC Level 2 is built on those same 110 controls. When a client tells me they're pausing their CMMC project, what I hear is that they're pausing work they're already contractually required to do. In most organizations, those are the same project with the same people and the same budget line. Stopping one stops the other.
Reason 2: Your SPRS Score Now Carries More Legal Weight
A self-assessment is a legal representation to the federal government. With no third-party assessor involved, your signature is the only thing standing behind the number you post in SPRS. This is the reason I spend the most time on with clients.
Here's what I see in practice. When contractors score themselves, they are almost always generous. I have yet to do a gap assessment where the company's own score held up. The most common gap by far is documentation. No company we've assessed has had the right documentation in place, including companies that paid another firm to write it for them.
The Department of Justice is still pursuing contractors whose claims don't match reality. In June 2026, LOGZONE agreed to pay $507,144 after posting a perfect score of 110 that a later government review put at negative 170. That case started with the government's own assessment, not a whistleblower.
In September, Honeywell reached a $2 million settlement over alleged NIST 800-171 failures, and those allegations came from a whistleblower lawsuit. These cases often come from insiders in IT, security, or compliance roles who can see the gap between what a company reports and how its systems actually work.
The government is also still checking. DoD leaders said they will enforce NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments during the interim.
When I review a self-assessment, I look at it the way an assessor would. Is there evidence for every control marked "met"? Does the System Security Plan describe the environment as it exists today, in enough detail? Is the POA&M honest? If the answer to any of those is no, the score is a liability, not a credential.
Reason 3: Primes Still Use CMMC Level 2 as a Filter in Hawaii and Guam
The federal timeline is only one source of pressure. Prime contractors set their own supplier requirements, and many haven't relaxed them.
Primes enforced supplier cybersecurity requirements before the DoD rollout and have continued since the pause. If you're a subcontractor in Honolulu, Hawaii or Guam, your prime's flowdown clauses and security questionnaires may matter more to your next award than any Pentagon announcement. Many primes are still working out how flowdown should work, so my guidance to subs has been simple: match the CMMC level of the DoD contract you support.
This matters here more than most places. The DoD is one of the largest drivers of Hawaii's economy, and Guam's strategic role keeps contract activity high. Local primes have plenty of subcontractors to choose from, and a strong security posture is one of the easiest ways to stand out.
A voluntary C3PAO assessment is still an option. The DoD's own FAQ confirms companies can pursue one voluntarily and that reported results will be visible in SPRS. When you're competing against firms that only self-attest, an independent assessment is a clear differentiator.
I don't tell every client they need a voluntary assessment right now. I do tell every client handling CUI that they should be in a position to pass one.
Reason 4: The Pause Is Temporary, and Remediation Takes Longer Than the Pause
This pause reads as a reform, not a repeal. When third-party requirements return, contractors who kept working will be months ahead of those who stopped.
The Task Force makes recommendations. The Department decides what to adopt. Any real rule change takes time. We've seen this before. CMMC was paused for review in 2021 and came back as CMMC 2.0, with five levels reduced to three and third-party requirements narrowed rather than abandoned.
DoD leadership has also been clear that the goal is better verification. At the Billington summit, CIO Kirsten Davies said cyber remains critical and called for moving from point-in-time checks to continuous verification. If that direction holds, the next version may expect more ongoing evidence, not less.
In my experience, closing gaps in multifactor authentication, FIPS-validated encryption, audit logging, and CUI boundary definition takes months for most small and midsize contractors, not weeks. Just getting access to SPRS and PIEE can take days or weeks if nobody has set it up. Assessor capacity was already tight: reporting on the pause cited more than 100,000 companies needing assessments and roughly 100 authorized C3PAOs.
Island logistics make the runway even shorter. Hardware takes longer to get here, local talent is limited, and Guam contractors have even fewer resources to draw on. Everything in Hawaii and Guam has to be planned further ahead than it would be on the mainland.
Waiting doesn't reduce the work. It only shortens the runway.
Reason 5: CUI Requirements Are Expanding Beyond the DoD
The CMMC pause applies to one department. Other parts of the federal government are moving the other way.
In June 2026, the FAR Council updated its proposed rule extending similar safeguarding and incident reporting requirements to CUI under all federal contracts. If it's finalized as drafted, a narrower CMMC scope may not offer much relief.
This is where my role at Intech comes into focus. I'm accountable for whether our clients' security spending actually pays off. A mature NIST 800-171 program supports federal work across agencies, stronger cyber insurance applications, lower ransomware risk, and better answers on the security questionnaires commercial customers now send. That's a return on investment that holds up no matter what the Task Force recommends.
I often compare IT health to personal health. You don't stop taking care of yourself because your next checkup got rescheduled.
What I Recommend Contractors in Honolulu, Hawaii and Guam Do During the Pause
Separate control implementation from certification readiness. Keep the first moving without exception. Make a deliberate, documented decision about the second.
Here's the checklist I'm walking clients through:
1. Confirm your contract requirements. Pull every active contract and pending solicitation. Note which include DFARS 252.204-7012, -7019, -7020, and -7021, and whether any C3PAO requirements have been formally removed.
2. Validate your SPRS score against evidence. Re-score all 110 controls honestly. If a control is marked "implemented," make sure you can produce the evidence today.
3. Confirm SPRS and PIEE access. Make sure the right people have working accounts now, not the week you need to post a score.
4. Update your System Security Plan. Reflect your current environment, including cloud changes, new tools, and staff turnover. Most SSPs I review are not detailed enough.
5. Review your POA&M. Assign owners and realistic dates. An honest POA&M showing progress is far more defensible than an inflated score.
6. Confirm your CUI boundary. Know where CUI lives and who can access it. If fewer than roughly 25 to 50 percent of your staff need CUI access, a CMMC enclave may reduce scope and cost. Above that, an enterprise approach usually makes more financial sense. I generally recommend GCC High only for companies handling ITAR or NOFORN data. For most others, Microsoft 365 GCC or commercial is sufficient.
7. Check prime expectations. Ask your primes directly whether their requirements have changed, and get the answer in writing.
8. Keep your team and budget intact. For a 50-person company doing CMMC across the enterprise, I typically see around $100,000 to meet all controls, about $75,000 for a C3PAO assessment, and $50,000 to $100,000 per year to maintain compliance and tools. Pulling that budget now means rebuilding it later.
9. Make a deliberate call on a voluntary C3PAO assessment. If you have a clear competitive or prime-driven reason, pursue it. If not, target full readiness so you can move quickly.
Let's Talk About Where You Stand
I've spent more than two decades watching organizations either prepare early or scramble late. The pause gives you time. Use it to validate your SPRS score, close real gaps, and document your controls so you're ready for whatever comes next.
And remember why this program exists. CMMC helps you win contracts and strengthens your own security, but its real purpose is protecting the information our warfighters depend on.
If you're a DoD contractor or subcontractor in Honolulu, Hawaii or Guam, I'm happy to sit down and talk through your contracts and your current posture. Start with a CMMC Readiness Assessment or contact Intech Pacific to set up a conversation.
About the Author
Terence Tang is VP Client Strategy at Intech Pacific, a Honolulu-based provider of managed IT, cybersecurity, and compliance services for businesses and DoD contractors in Hawaii and Guam. He has worked in IT, cybersecurity, and compliance since 2000 and holds the CMMC Certified Assessor (CCA), CISSP, and CISM certifications. Terence leads client strategy at Intech Pacific. He helps organizations meet CMMC, NIST 800-171, HIPAA, and PCI requirements and make sure their managed IT services deliver real value. He has been involved in more than 100 CMMC gap assessments. Terence is active with ISC2 Hawaii, ISACA Hawaii, the Guam Contractors Association, and SAME Honolulu and Guam.
