Early CMMC adopters paid up. Now Phase 2 is frozen.
The Pentagon suspension doesn't void the certification, but it does void the first-mover advantage many small contractors bet on.
TL;DR
Contractors who earned CMMC Level 2 certification ahead of the Phase 2 mandate are now navigating a suspended program. IntelliGenesis, a small business, spent four months and a seven-day-a-week sprint to certify, driven partly by primes threatening to drop non-certified subs from teams. The July 13 DoD suspension froze Phase 2's third-party assessment ramp while keeping Phase 1 self-assessments in force. Early adopters say they'd do it again, but the competitive edge they bought is on hold alongside the requirement that created it.
IntelliGenesis made the bet that many small defense contractors were weighing in early 2026: get CMMC Level 2 certified before the mandate hits, or risk getting cut from prime contractor teams. The company went all in, a four-month sprint, over 50 policy documents written from scratch, CUI migrated to GCC High, and a team working seven days a week to reach the finish line.
Then the Pentagon suspended Phase 2.
The July 13 memo from DoD CIO Kirsten Davies froze the ramp-up of third-party assessment requirements that was set to begin November 10, 2026. Phase 1 self-assessments remain in place, but the competitive forcing function that drove companies like IntelliGenesis to certify early has, for now, lost its teeth.
"You can view it as, okay, we're paused, we're on hold," CEO Angie Lienert told Federal News Network. "But I know it's gonna come back." She and her team say they'd make the same decision again, the investment wasn't purely about winning the next contract. It was about being able to tell primes and contracting officers that the certification was done, period.
That posture isn't universal. The Professional Services Council reported last month that every member company mid-certification when the pause hit chose to continue the process. But the calculus for firms that haven't started yet has shifted. Why sprint toward a requirement whose enforcement timeline is now undefined? The 60-day review launched alongside the suspension (described by Davies as "top-to-bottom" and framed around Hegseth's Acquisition Transformation System) could reshape or replace the program.
Until then, the early adopters hold a credential whose market value depends entirely on whether primes keep demanding it voluntarily. Some will. Others won't bother while the DoD itself is reconsidering the program's structure.
Published ·Deep Fathom