Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.
Last updated: October 2026
As of October 2026, CMMC Phase 2 is suspended, contracting officers accept self-assessment in place of C3PAO certification, and the Department of War's CMMC Reform Task Force has not yet published its report. For CMMC readiness in Honolulu and everywhere else, the underlying security requirements have not moved, and enforcement has continued. The original version of this post said all DoD contracts had to be CMMC-compliant by October 1, 2026. That was never the rule, and it is not the situation today. This post explains what is new, what it means, and how CMMC readiness should look for a Honolulu contractor right now. If you want the month-by-month history, see our 2026 CMMC recap.
Where the Pause Stands
Phase 2 is suspended, and nothing has replaced it yet.
On July 13, 2026, a memo from DoW CIO Kirsten Davies, with an implementing memo from USD(A&S) Michael Duffey, suspended Phase 2 and pending and future milestones. It launched a CMMC Reform Task Force with a 60-day review. An RFI closed August 14, 2026 with more than 1,100 responses. The review window closed September 11, 2026.
At the time of this update, the task force report has not been published and no new rule has been proposed. Anyone telling you exactly what the next phase looks like is guessing.
What Revision 3 of the Class Deviation Does
Class Deviation 2026-O0025 Revision 3, issued September 3, 2026, is the document that governs contracts today.
- Contracting officers accept a Level 1 or Level 2 self-assessment in place of a C3PAO certification.
- C3PAO requirements in existing contracts are removed at the next option or modification.
- The Department of War (DoW, formerly the DoD) keeps its DIBCAC Medium and High assessment authority.
Revision 3 replaced Revision 2, issued July 16, 2026. The difference is that Revision 3 made the suspension binding in acquisition regulation rather than policy guidance.
What Did Not Change
The pause is narrower than many contractors think. These remain in effect:
- DFARS 252.204-7012. All 110 NIST SP 800-171 requirements, 72-hour incident reporting, 90-day image preservation, malware submission to DC3, and FedRAMP Moderate or equivalent for cloud services handling CUI.
- 32 CFR Part 170, the CMMC program rule.
- Self-assessment requirements in DFARS 252.204-7021 and 252.204-7025.
- SPRS affirmations by a senior official.
- DIBCAC assessments.
- The False Claims Act.
- Primes' private flow-down requirements.
C3PAOs still conduct voluntary Level 2 assessments, and certifications remain valid for three years.
The FAR CUI Rule: The Next Big Change to Watch
On June 23, 2026, the FAR Council re-proposed the FAR CUI rule. It would apply NIST SP 800-171 Revision 3 to CUI across the federal government, not only the DoW.
It is not final. CMMC still assesses Revision 2, and a DoD class deviation from May 2, 2024 keeps defense contractors on Revision 2. If the FAR rule becomes final, contractors that work with civilian agencies as well as the DoW may face Revision 3 requirements on that side. I would read it, but I would not re-baseline a CMMC program around it yet.
Enforcement Did Not Pause
The False Claims Act has been the sharpest consequence for inaccurate cybersecurity claims, and 2026 added two settlements.
- LOGZONE, June 18, 2026: $507,144. The company reported an SPRS score of 110. DIBCAC found -170.
- Honeywell Aerospace, September 1, 2026: $2,042,518, with a whistleblower share of $375,823. This settlement came after the pause began.
These follow earlier cases including MORSECORP ($4.6 million, March 2025) and Georgia Tech Research Corporation ($875,000, September 2025). Penalties can reach treble damages plus a per-claim civil penalty. "Knowingly" includes reckless disregard, and whistleblowers can file suits on their own.
The lesson for Honolulu contractors is simple. The pause changed who verifies your score. It did not change the consequences of getting it wrong.
The CMMC Ecosystem by the Numbers
The assessment ecosystem grew substantially before the pause. As of mid-2026:
- About 100 authorized C3PAOs.
- More than 1,000 CMMC Certified Assessors (CCAs) nationwide.
- Nearly 2,000 Level 2 certified contractors by July 2026, according to Federal News Network.
ISACA has held the CAICO role, which oversees assessor training and certification, since December 2025.
In Hawaii, the numbers are much smaller. As of September 2026, Intech Pacific has two of the three CCAs based in Hawaii. That matters when you compare CMMC Honolulu providers, because few local firms have assessor experience in house.
The Cost Debate
Cost is part of why the pause happened.
On July 29, 2026, CSIS compared a Small Business Administration estimate of about $594,000 in total compliance cost for a small contractor against the DoW's roughly $102,000. The difference is largely implementation versus assessment. I cover that in our post on the DoD's CMMC cost numbers.
What CMMC Readiness Looks Like in Honolulu Today
CMMC readiness today means being ready for whatever the task force decides, without waiting for it.
The biggest misconception I see runs in both directions. Some contractors think they can buy a product and be compliant. Others think CMMC is too costly and impossible. Neither is true, and the pause has made both groups more confident in the wrong direction.
My advice to Honolulu contractors:
- Keep implementing. 7012 requires the 110 requirements now.
- Re-score with an outside check. If your SPRS score came from an internal review, have it checked.
- Fix documentation. It is the most common gap I find, every time.
- Get SPRS and PIEE access sorted. It can take days to weeks.
- Decide whether to certify voluntarily. For some contractors, a certification now is a competitive advantage with primes.
Check Your CMMC Readiness With Intech Pacific
Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam, with CCPs and CCAs on staff.
To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.
