DoD paused CMMC over cost. Its own RFI data points at NIST SP 800-171. Should you keep spending on Level 2?

What exactly was paused?

The Small Business Administration's July 13, 2026 release said DoD suspended the CMMC Phase II requirements, originally scheduled to take effect November 10, 2026, and began a comprehensive review. The SBA cited compliance costs "approaching as much as $600,000" and more than 100,000 small businesses affected.

The review was described as 60 days of feedback followed by a 15 day report, 75 days in all. FNN reports it has now run past 100 days.

What does the RFI data show, according to FNN?

• Who answered. DoD reviewed 997 responses. 509 of them, 51 percent, came from the defense industrial base, and the rest from vendors, consultants and others. A government source told FNN a task force of about 20 people reviewed more than 1,100 comments in three days.
• Where the cost sits. In an internal DoD email FNN quotes, the top cost concerns were implementing and maintaining NIST SP 800-171 controls: licensing and recurring costs such as Microsoft 365 GCC High, enclaves, external service providers, and inconsistent interpretation between primes, subcontractors, assessors and guidance. Documentation and evidence packages were also named, and inconsistent CUI marking across DoD was a top driver.
• The heaviest requirements. System security plans ranked as the most burdensome, followed by FIPS validated encryption.
• The assessment itself. DoD wrote that the average assessment cost cited directly by a subset of respondents was $47,000, and that prices came down over the first year. About 47 percent named third party assessor cost as a top driver, which put it fifth overall.
• Certifications so far. FNN reports that 2,433 companies held Level 2 third party certifications in September 2026. An industry source told FNN that assessment capacity was never more than half used during Phase 1.

Why does that matter for your budget?

Put the reported $47,000 average assessment cost next to the figure of up to $600,000 the SBA cited. In the data FNN describes, the large numbers come from building and running the NIST SP 800-171 program: the System Security Plan, FIPS validated encryption, GCC High licensing, enclaves and outside service providers. The assessment is the smaller line.

That matters because pausing CMMC Phase II pauses an assessment requirement. It does not remove the work behind most of the cost, because that work comes from NIST SP 800-171.

What has not changed?

DFARS 252.204-7012 and NIST SP 800-171 obligations for contractors that handle CUI exist independently of CMMC. The pause concerns the CMMC Phase II requirements. If your contracts carry 7012 and you handle CUI, the 110 requirements and the System Security Plan that describes how you meet them are still yours to maintain. That is our reading of the clauses, not something FNN reported.

What should you do next?

1. Pull your active contracts and mark which ones carry DFARS 252.204-7012 and involve CUI.
2. Point your readiness budget at the NIST SP 800-171 work first: a current SSP, FIPS validated encryption, and your enclave or cloud decision. Under 7012 that work is owed whatever happens to Phase II.
3. Keep a dated record of what is implemented and what is still open, so the outcome of the review changes your timeline and not your starting point.
4. Treat the reported $47,000 average as a reference point, not a quote. Your scope sets your number.

Sources

• Federal News Network, Jason Miller, October 26, 2026, DoD's reasons for CMMC pause falling apart in face of RFI responses
• SBA, July 13, 2026, SBA commends the suspension of CMMC Phase II for small defense contractors
• NIST SP 800-171 Rev 2, Protecting Controlled Unclassified Information